UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,022
Published in 7 days
1,069
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,022 vulnerabilities
  1. Low 3.3

    CVE-2014-6463 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:REPLICATION ROW FORMAT BINARY LOG DML.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  2. Medium 6.9

    CVE-2014-6458 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 15 Oct 2014 · NVD
  3. Medium 4.0

    CVE-2014-6457 · Java

    Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.

    Published 15 Oct 2014 · NVD
  4. High 9.3

    CVE-2014-6456 · Java

    Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

    Published 15 Oct 2014 · NVD
  5. High 7.6

    CVE-2014-4288 · Java

    Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532.

    Published 15 Oct 2014 · NVD
  6. Medium 4.0

    CVE-2014-4287 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:CHARACTER SETS.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  7. Medium 4.1

    CVE-2014-4274 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to SERVER:MyISAM.

    Published 15 Oct 2014 · Fixed in 5.5.39, 10.0.13 · NVD
  8. Medium 4.3

    CVE-2014-3681 · Jenkins

    Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 15 Oct 2014 · Fixed in 1.565.3, 1.583 · NVD
  9. Medium 4.0

    CVE-2014-3664 · Jenkins

    Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors.

    Published 15 Oct 2014 · NVD
  10. High 9.3

    CVE-2014-2927 · F5 BIG-IP

    The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and Enterprise Manager 3.x before 3.1.1 HF2, when configured in failover mode, does not require authentication, which allows remote attackers to read or write to arbitrary files via a cmi request to the ConfigSync IP address.

    Published 15 Oct 2014 · NVD
  11. High 7.1

    CVE-2014-2022 · vBulletin

    SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the conceptid argument in an xmlrpc API request.

    Published 15 Oct 2014 · NVD
  12. Medium 4.6

    CVE-2014-0572 · Adobe ColdFusion

    Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows local users to bypass intended IP-based access restrictions via unspecified vectors.

    Published 15 Oct 2014 · NVD
  13. Medium 4.3

    CVE-2014-0571 · Adobe ColdFusion

    Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 15 Oct 2014 · NVD
  14. Medium 6.8

    CVE-2014-0570 · Adobe ColdFusion

    Cross-site request forgery (CSRF) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

    Published 15 Oct 2014 · NVD
  15. Low 3.4

    CVE-2014-3566 · OpenSSL

    The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

    Published 15 Oct 2014 · NVD
  16. Medium 5.0

    CVE-2014-3581 · Apache HTTP Server

    The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header.

    Published 10 Oct 2014 · NVD
  17. Medium 5.0

    CVE-2014-3394 · Cisco ASA and Firepower Threat Defense

    The Smart Call Home (SCH) implementation in Cisco ASA Software 8.2 before 8.2(5.50), 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1) allows remote attackers to bypass certificate validation via an arbitrary VeriSign certificate, aka Bug ID CSCun10916.

    Published 10 Oct 2014 · NVD
  18. Medium 4.3

    CVE-2014-3393 · Cisco ASA and Firepower Threat Defense

    The Clientless SSL VPN portal customization framework in Cisco ASA Software 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23), 8.6 before 8.6(1.14), 9.0 before 9.0(4.24), 9.1 before 9.1(5.12), and 9.2 before 9.2(2.4) does not properly implement authentication, which allows remote attackers to modify RAMFS customization objects via unspecified vectors, as demonstrated by inserting…

    Published 10 Oct 2014 · NVD
  19. High 8.3

    CVE-2014-3392 · Cisco ASA and Firepower Threat Defense

    The Clientless SSL VPN portal in Cisco ASA Software 8.2 before 8.2(5.51), 8.3 before 8.3(2.42), 8.4 before 8.4(7.23), 8.6 before 8.6(1.15), 9.0 before 9.0(4.24), 9.1 before 9.1(5.12), 9.2 before 9.2(2.8), and 9.3 before 9.3(1.1) allows remote attackers to obtain sensitive information from process memory or modify memory contents via crafted parameters, aka Bug ID CSCuq29136.

    Published 10 Oct 2014 · NVD
  20. Medium 6.8

    CVE-2014-3391 · Cisco ASA and Firepower Threat Defense

    Untrusted search path vulnerability in Cisco ASA Software 8.x before 8.4(3), 8.5, and 8.7 before 8.7(1.13) allows local users to gain privileges by placing a Trojan horse library file in external memory, leading to library use after device reload because of an incorrect LD_LIBRARY_PATH value, aka Bug ID CSCtq52661.

    Published 10 Oct 2014 · NVD
  21. Medium 6.8

    CVE-2014-3390 · Cisco ASA and Firepower Threat Defense

    The Virtual Network Management Center (VNMC) policy implementation in Cisco ASA Software 8.7 before 8.7(1.14), 9.2 before 9.2(2.8), and 9.3 before 9.3(1.1) allows local users to obtain Linux root access by leveraging administrative privileges and executing a crafted script, aka Bug IDs CSCuq41510 and CSCuq47574.

    Published 10 Oct 2014 · NVD
  22. Low 3.5

    CVE-2014-3147 · Splunk Enterprise

    Cross-site scripting (XSS) vulnerability in the auto-complete feature in Splunk Enterprise before 6.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a CSV file.

    Published 10 Oct 2014 · NVD
  23. High 7.5

    CVE-2014-7984 · Joomla!

    Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication.

    Published 8 Oct 2014 · NVD
  24. Medium 4.3

    CVE-2014-7983 · Joomla!

    Cross-site scripting (XSS) vulnerability in com_contact in Joomla! CMS 3.1.2 through 3.2.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 8 Oct 2014 · NVD
  25. Medium 4.3

    CVE-2014-7982 · Joomla!

    Cross-site scripting (XSS) vulnerability in Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 8 Oct 2014 · NVD
  26. High 7.5

    CVE-2014-7981 · Joomla!

    SQL injection vulnerability in Joomla! CMS 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

    Published 8 Oct 2014 · NVD
  27. Medium 5.0

    CVE-2014-7229 · Joomla!

    Unspecified vulnerability in Joomla! before 2.5.4 before 2.5.26, 3.x before 3.2.6, and 3.3.x before 3.3.5 allows attackers to cause a denial of service via unspecified vectors.

    Published 8 Oct 2014 · NVD
  28. High 7.5

    CVE-2014-6632 · Joomla!

    Joomla! 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allows remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication.

    Published 8 Oct 2014 · NVD
  29. Medium 4.3

    CVE-2014-6631 · Joomla!

    Cross-site scripting (XSS) vulnerability in com_media in Joomla! 3.2.x before 3.2.5 and 3.3.x before 3.3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 8 Oct 2014 · NVD
  30. Medium 6.4

    CVE-2014-7185 · Python

    Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function.

    Published 8 Oct 2014 · NVD
  31. High 7.5

    CVE-2014-7299 · HPE ArubaOS

    Unspecified vulnerability in administrative interfaces in ArubaOS 6.3.1.11, 6.3.1.11-FIPS, 6.4.2.1, and 6.4.2.1-FIPS on Aruba controllers allows remote attackers to bypass authentication, and obtain potentially sensitive information or add guest accounts, via an SSH session.

    Published 8 Oct 2014 · NVD
  32. Low 3.5

    CVE-2014-7295 · MediaWiki

    The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to conduct cross-site scripting (XSS) attacks or have unspecified other impact via crafted CSS, as demonstrated by modifying MediaWiki:Common.css.

    Published 7 Oct 2014 · NVD
  33. High 7.5

    CVE-2014-4043 · GNU C Library

    The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.

    Published 6 Oct 2014 · NVD
  34. Low 3.5

    CVE-2014-7217 · phpMyAdmin

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the (1) table search or (2) table structure page, related to libraries/TableSearch.class.php and…

    Published 3 Oct 2014 · NVD
  35. High 8.3

    CVE-2014-7188 · Xen

    The hvm_msr_read_intercept function in arch/x86/hvm/hvm.c in Xen 4.1 through 4.4.x uses an improper MSR range for x2APIC emulation, which allows local HVM guests to cause a denial of service (host crash) or read data from the hypervisor or other guests via unspecified vectors.

    Published 2 Oct 2014 · NVD
  36. Low 3.3

    CVE-2014-7156 · Xen

    The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 3.3.x through 4.4.x does not check the supervisor mode permissions for instructions that generate software interrupts, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors.

    Published 2 Oct 2014 · NVD
  37. Medium 5.8

    CVE-2014-7155 · Xen

    The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 4.4.x and earlier does not properly check supervisor mode permissions, which allows local HVM users to cause a denial of service (guest crash) or gain guest kernel mode privileges via vectors involving an (1) HLT, (2) LGDT, (3) LIDT, or (4) LMSW instruction.

    Published 2 Oct 2014 · NVD
  38. Medium 6.1

    CVE-2014-7154 · Xen

    Race condition in HVMOP_track_dirty_vram in Xen 4.0.0 through 4.4.x does not ensure possession of the guarding lock for dirty video RAM tracking, which allows certain local guest domains to cause a denial of service via unspecified vectors.

    Published 2 Oct 2014 · NVD
  39. Medium 6.5

    CVE-2012-0811 · Postfix

    Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files generated by backup.php.

    Published 1 Oct 2014 · NVD
  40. High 7.5

    CVE-2003-1598 · WordPress

    SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.

    Published 1 Oct 2014 · NVD
  41. Medium 4.3

    CVE-2014-7199 · MediaWiki

    Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.

    Published 30 Sept 2014 · NVD
  42. Medium 5.0

    CVE-2014-6269 · HAProxy

    Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attackers to cause a denial of service (crash) via a large stream of data, which triggers a buffer overflow and an out-of-bounds read.

    Published 30 Sept 2014 · NVD
  43. Medium 6.8

    CVE-2014-5267 · Drupal

    modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document.

    Published 30 Sept 2014 · NVD
  44. Low 3.6

    CVE-2014-5459 · PHP

    The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions.

    Published 27 Sept 2014 · NVD
  45. Unrated

    WPV-a42708036391 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 27 Sept 2014 · Fixed in 5.2.4 · WPVulnerability
  46. Medium 4.3

    CVE-2014-5315 · Adobe ColdFusion

    Cross-site scripting (XSS) vulnerability in the Help page in Adobe Acrobat 9.5.2 and earlier and ColdFusion 8.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 26 Sept 2014 · NVD
  47. Critical 9.8Actively exploited

    CVE-2014-7169 · F5 BIG-IP

    GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server,…

    Published 25 Sept 2014 · NVD
  48. Critical 9.8Actively exploited

    CVE-2014-6271 · F5 BIG-IP

    GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other…

    Published 24 Sept 2014 · NVD
  49. Medium 6.0

    CVE-2014-4816 · IBM WebSphere Application Server

    Cross-site request forgery (CSRF) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.x through 6.1.0.47, 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

    Published 23 Sept 2014 · NVD
  50. Low 3.5

    CVE-2014-4770 · IBM WebSphere Application Server

    Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 6.x through 6.1.0.47, 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 allows remote authenticated administrators to inject arbitrary web script or HTML via a crafted URL.

    Published 23 Sept 2014 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.