UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,021
Published in 7 days
1,097
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,021 vulnerabilities
  1. Medium 4.9

    CVE-2015-0268 · Xen

    The vgic_v2_to_sgi function in arch/arm/vgic-v2.c in Xen 4.5.x, when running on ARM hardware with general interrupt controller (GIC) version 2, allows local guest users to cause a denial of service (host crash) by writing an invalid value to the GICD.SGIR register.

    Published 16 Feb 2015 · NVD
  2. Medium 6.4

    CVE-2014-0227 · Apache Tomcat

    java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked…

    Published 16 Feb 2015 · NVD
  3. Medium 6.4

    CVE-2014-9512 · rsync

    rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.

    Published 12 Feb 2015 · NVD
  4. Medium 4.3

    CVE-2014-8110 · Apache ActiveMQ

    Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 12 Feb 2015 · NVD
  5. Unrated

    CVE-2015-1579 · Slider Revolution

    Slider Revolution: Path Traversal

    Published 11 Feb 2015 · WPVulnerability
  6. Medium 4.3

    CVE-2015-1571 · Fortinet FortiOS

    The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the Fortinet_Factory certificate and private key. NOTE: FG-IR-15-002 says "The Fortinet_Factory certificate is unique to each device ... An…

    Published 10 Feb 2015 · NVD
  7. Medium 4.9

    CVE-2015-1377 · Webmin

    The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file.

    Published 10 Feb 2015 · NVD
  8. Medium 6.8

    CVE-2015-1432 · phpBB

    The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.

    Published 10 Feb 2015 · NVD
  9. Medium 4.3

    CVE-2015-1431 · phpBB

    Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite."

    Published 10 Feb 2015 · NVD
  10. Medium 4.3

    CVE-2015-1566 · DNN Platform

    Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 9 Feb 2015 · NVD
  11. Low 2.1

    CVE-2015-1563 · Xen

    The ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local guests to cause a denial of service by causing a large number messages to be logged.

    Published 9 Feb 2015 · NVD
  12. Medium 5.0

    CVE-2015-1463 · ClamAV

    ClamAV before 0.98.6 allows remote attackers to cause a denial of service (crash) via a crafted petite packer file, related to an "incorrect compiler optimization."

    Published 3 Feb 2015 · NVD
  13. High 7.5

    CVE-2015-1462 · ClamAV

    ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upx packer file, related to a "heap out of bounds condition."

    Published 3 Feb 2015 · NVD
  14. High 7.5

    CVE-2015-1461 · ClamAV

    ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted (1) Yoda's crypter or (2) mew packer file, related to a "heap out of bounds condition."

    Published 3 Feb 2015 · NVD
  15. Medium 4.3

    CVE-2015-1433 · Roundcube

    program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.

    Published 3 Feb 2015 · NVD
  16. High 7.5

    CVE-2014-9328 · ClamAV

    ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upack packer file, related to a "heap out of bounds condition."

    Published 3 Feb 2015 · NVD
  17. Unrated

    WPV-cb1d77d83774 · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 3 Feb 2015 · Fixed in 1.9.51 · WPVulnerability
  18. Unrated

    WPV-48e52c8a0c82 · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 3 Feb 2015 · Fixed in 1.9.51 · WPVulnerability
  19. High 7.8

    CVE-2015-1452 · Fortinet FortiOS

    The Control and Provisioning of Wireless Access Points (CAPWAP) daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to cause a denial of service (locked CAPWAP Access Controller) via a large number of ClientHello DTLS messages.

    Published 2 Feb 2015 · NVD
  20. Low 3.5

    CVE-2015-1451 · Fortinet FortiOS

    Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject arbitrary web script or HTML via the (1) WTP Name or (2) WTP Active Software Version field in a CAPWAP Join request.

    Published 2 Feb 2015 · NVD
  21. Low 3.3

    CVE-2015-1044 · VMware ESXi

    vmware-authd (aka the Authorization process) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allows attackers to cause a host OS denial of service via unspecified vectors.

    Published 29 Jan 2015 · NVD
  22. Medium 6.4

    CVE-2014-8370 · VMware ESXi

    VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allow host OS users to gain host OS privileges or cause a denial of service (arbitrary write to a file) by modifying a configuration file.

    Published 29 Jan 2015 · NVD
  23. Unrated

    CVE-2015-2069 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 29 Jan 2015 · Fixed in 2.2.11 · WPVulnerability
  24. High 10.0

    CVE-2015-0235 · GNU C Library, PHP

    Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

    Published 28 Jan 2015 · Fixed in 5.4.38, 5.5.22, 5.6.6 · NVD
  25. Medium 5.0

    CVE-2015-1419 · vsftpd

    Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.

    Published 28 Jan 2015 · NVD
  26. Medium 6.8

    CVE-2015-0232 · PHP

    The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image.

    Published 27 Jan 2015 · NVD
  27. High 7.5

    CVE-2015-0231 · PHP

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of…

    Published 27 Jan 2015 · NVD
  28. Medium 5.0

    CVE-2014-9650 · RabbitMQ

    CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.

    Published 27 Jan 2015 · NVD
  29. Medium 4.3

    CVE-2014-9649 · RabbitMQ

    Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.

    Published 27 Jan 2015 · NVD
  30. High 7.5

    CVE-2014-7937 · FFmpeg

    Multiple off-by-one errors in libavcodec/vorbisdec.c in FFmpeg before 2.4.2, as used in Google Chrome before 40.0.2214.91, allow remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted Vorbis I data.

    Published 22 Jan 2015 · NVD
  31. High 7.5

    CVE-2014-7933 · FFmpeg

    Use-after-free vulnerability in the matroska_read_seek function in libavformat/matroskadec.c in FFmpeg before 2.5.1, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Matroska file that triggers improper maintenance of tracks data.

    Published 22 Jan 2015 · NVD
  32. Medium 4.3

    CVE-2015-1175 · PrestaShop

    Cross-site scripting (XSS) vulnerability in blocklayered-ajax.php in the blocklayered module in PrestaShop 1.6.0.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the layered_price_slider parameter.

    Published 22 Jan 2015 · NVD
  33. High 9.3

    CVE-2015-0437 · Java

    Unspecified vulnerability in Oracle Java SE 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 21 Jan 2015 · NVD
  34. Medium 4.0

    CVE-2015-0432 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign Key.

    Published 21 Jan 2015 · Fixed in 5.5.41, 10.0.16 · NVD
  35. Medium 6.9

    CVE-2015-0421 · Java

    Unspecified vulnerability in Oracle Java SE 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the installation process.

    Published 21 Jan 2015 · NVD
  36. Low 1.9

    CVE-2015-0413 · Java

    Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect integrity via unknown vectors related to Serviceability.

    Published 21 Jan 2015 · NVD
  37. High 7.2

    CVE-2015-0412 · Java

    Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS.

    Published 21 Jan 2015 · NVD
  38. High 7.5

    CVE-2015-0411 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Server : Security : Encryption.

    Published 21 Jan 2015 · Fixed in 5.5.41, 10.0.16 · NVD
  39. Medium 5.0

    CVE-2015-0410 · Java

    Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security.

    Published 21 Jan 2015 · NVD
  40. Medium 4.0

    CVE-2015-0409 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

    Published 21 Jan 2015 · NVD
  41. High 10.0

    CVE-2015-0408 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI.

    Published 21 Jan 2015 · NVD
  42. Medium 5.0

    CVE-2015-0407 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing.

    Published 21 Jan 2015 · NVD
  43. Medium 5.8

    CVE-2015-0406 · Java

    Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment.

    Published 21 Jan 2015 · NVD
  44. Medium 6.9

    CVE-2015-0403 · Java

    Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 21 Jan 2015 · NVD
  45. Medium 5.0

    CVE-2015-0400 · Java

    Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

    Published 21 Jan 2015 · NVD
  46. High 9.3

    CVE-2015-0395 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

    Published 21 Jan 2015 · NVD
  47. Medium 4.0

    CVE-2015-0391 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

    Published 21 Jan 2015 · Fixed in 5.5.39, 10.0.13 · NVD
  48. Low 3.5

    CVE-2015-0385 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Pluggable Auth.

    Published 21 Jan 2015 · NVD
  49. Medium 5.4

    CVE-2015-0383 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related to Hotspot.

    Published 21 Jan 2015 · NVD
  50. Medium 4.3

    CVE-2015-0382 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0381.

    Published 21 Jan 2015 · Fixed in 5.5.41, 10.0.16 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.