UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,022
Published in 7 days
1,069
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,022 vulnerabilities
  1. Unrated

    WPV-6db3665fc02c · WooCommerce

    Vulnerability in WooCommerce

    Published 17 Sept 2014 · Fixed in 2.2.3 · WPVulnerability
  2. Medium 4.0

    CVE-2014-3617 · Moodle

    The forum_print_latest_discussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, and discover an author's username, by leveraging the student role and visiting a Q&A forum.

    Published 15 Sept 2014 · NVD
  3. Unrated

    WPV-efc6f73c236e · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 14 Sept 2014 · Fixed in 5.2.4 · WPVulnerability
  4. Unrated

    WPV-17ae3c8f844e · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 14 Sept 2014 · Fixed in 5.2.4 · WPVulnerability
  5. Unrated

    WPV-1582a518b430 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 14 Sept 2014 · WPVulnerability
  6. Medium 6.8

    CVE-2014-6270 · Squid

    Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted UDP SNMP request, which triggers a heap-based buffer overflow.

    Published 12 Sept 2014 · NVD
  7. Medium 6.8

    CVE-2013-4444 · Apache Tomcat

    Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

    Published 12 Sept 2014 · NVD
  8. Medium 5.0

    CVE-2014-3609 · Squid

    HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values."

    Published 11 Sept 2014 · NVD
  9. Unrated

    CVE-2014-6313 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 11 Sept 2014 · Fixed in 2.2.3 · WPVulnerability
  10. Medium 5.4

    CVE-2014-0351 · Fortinet FortiOS

    The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.x before 5.0.8 on FortiGate devices does not prevent use of anonymous ciphersuites, which makes it easier for man-in-the-middle attackers to obtain sensitive information or interfere with communications by modifying the client-server data stream.

    Published 10 Sept 2014 · NVD
  11. Unrated

    WPV-f7cb5238e39a · Tinymce Advanced (WordPress plugin)

    Vulnerability in Advanced Editor Tools

    Published 8 Sept 2014 · Fixed in 4.2.3 · WPVulnerability
  12. Unrated

    WPV-e5cf784f120b · Tinymce Advanced (WordPress plugin)

    Vulnerability in Advanced Editor Tools

    Published 8 Sept 2014 · Fixed in 4.2.3 · WPVulnerability
  13. Unrated

    WPV-6bcef03e168a · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 8 Sept 2014 · Fixed in 0.9.4.1 · WPVulnerability
  14. Unrated

    WPV-15a602cc6df2 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 8 Sept 2014 · Fixed in 5.2.3 · WPVulnerability
  15. Unrated

    CVE-2014-9414 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-Site Request Forgery (CSRF)

    Published 8 Sept 2014 · Fixed in 0.9.4.1 · WPVulnerability
  16. Medium 4.6

    CVE-2014-2972 · Exim

    expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value.

    Published 4 Sept 2014 · NVD
  17. Medium 6.8

    CVE-2014-2957 · Exim

    The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.

    Published 4 Sept 2014 · NVD
  18. Medium 4.0

    CVE-2014-4758 · IBM WebSphere Application Server

    IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.x allow remote authenticated users to bypass intended access restrictions and send requests to internal services via a callService URL.

    Published 4 Sept 2014 · NVD
  19. Low 3.5

    CVE-2014-3075 · IBM WebSphere Application Server

    Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 8.5.5 and WebSphere Lombardi Edition 7.2.0.x allows remote authenticated users to inject arbitrary web script or HTML via an uploaded file.

    Published 4 Sept 2014 · NVD
  20. Medium 4.3

    CVE-2014-5147 · Xen

    Xen 4.4.x, when running a 64-bit kernel on an ARM system, does not properly handle traps from the guest domain that use a different address width, which allows local guest users to cause a denial of service (host crash) via a crafted 32-bit process.

    Published 29 Aug 2014 · NVD
  21. High 7.5

    CVE-2014-5119 · GNU C Library

    Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.

    Published 29 Aug 2014 · Fixed in 2.20 · NVD
  22. Medium 4.3

    CVE-2012-1503 · Movable Type

    Cross-site scripting (XSS) vulnerability in Six Apart (formerly Six Apart KK) Movable Type (MT) Pro 5.13 allows remote attackers to inject arbitrary web script or HTML via the comment section.

    Published 29 Aug 2014 · NVD
  23. Medium 5.3

    CVE-2014-5455 · OpenVPN

    Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMDRIVE% folder.

    Published 25 Aug 2014 · NVD
  24. High 7.5

    CVE-2014-2216 · Fortinet FortiOS

    The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.0.0 before 5.0.8 on FortiGate devices allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted request.

    Published 25 Aug 2014 · NVD
  25. Medium 6.4

    CVE-2014-5120 · PHP

    gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.

    Published 23 Aug 2014 · NVD
  26. Medium 6.8

    CVE-2014-3597 · PHP

    Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049.

    Published 23 Aug 2014 · NVD
  27. Medium 4.3

    CVE-2014-3587 · PHP

    Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.

    Published 23 Aug 2014 · NVD
  28. Medium 4.3

    CVE-2014-5243 · MediaWiki

    MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

    Published 22 Aug 2014 · NVD
  29. Medium 4.3

    CVE-2014-5242 · MediaWiki

    Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value.

    Published 22 Aug 2014 · NVD
  30. Medium 6.8

    CVE-2014-5241 · MediaWiki

    The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF…

    Published 22 Aug 2014 · NVD
  31. Medium 4.7

    CVE-2014-5149 · Xen

    Certain MMU virtualization operations in Xen 4.2.x through 4.4.x, when using shadow pagetables, are not preemptible, which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations, which process every page assigned to a guest, a different vulnerability than CVE-2014-5146.

    Published 22 Aug 2014 · NVD
  32. Medium 4.7

    CVE-2014-5146 · Xen

    Certain MMU virtualization operations in Xen 4.2.x through 4.4.x before the xsa97-hap patch, when using Hardware Assisted Paging (HAP), are not preemptible, which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations, which process every page assigned to a guest, a different vulnerability than CVE-2014-5149.

    Published 22 Aug 2014 · NVD
  33. High 10.0

    CVE-2014-3525 · Apache Traffic Server

    Unspecified vulnerability in Apache Traffic Server 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

    Published 22 Aug 2014 · NVD
  34. Medium 4.3

    CVE-2014-0232 · Apache OFBiz

    Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1) result or (2) error message.

    Published 22 Aug 2014 · NVD
  35. Low 3.5

    CVE-2014-5274 · phpMyAdmin

    Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js.

    Published 22 Aug 2014 · NVD
  36. Low 3.5

    CVE-2014-5273 · phpMyAdmin

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page,…

    Published 22 Aug 2014 · NVD
  37. Medium 6.5

    CVE-2014-4767 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.3 does not properly use the Liberty Repository for feature installation, which allows remote authenticated users to execute arbitrary code via unspecified vectors.

    Published 22 Aug 2014 · NVD
  38. High 7.1

    CVE-2014-4764 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3, when Load Balancer for IPv4 Dispatcher is enabled, allows remote attackers to cause a denial of service (Load Balancer crash) via unspecified vectors.

    Published 22 Aug 2014 · NVD
  39. Medium 5.0

    CVE-2014-3083 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.35, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.3 does not properly restrict resource access, which allows remote attackers to obtain sensitive information via unspecified vectors.

    Published 22 Aug 2014 · NVD
  40. Medium 5.0

    CVE-2014-3070 · IBM WebSphere Application Server

    The addFileRegistryAccount Virtual Member Manager (VMM) SPI Admin Task in IBM WebSphere Application Server (WAS) 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3 does not properly create accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors.

    Published 22 Aug 2014 · NVD
  41. Medium 4.3

    CVE-2014-3022 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted URL that triggers an error condition.

    Published 22 Aug 2014 · NVD
  42. Medium 4.3

    CVE-2014-0965 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted SOAP response.

    Published 22 Aug 2014 · NVD
  43. Medium 5.0

    CVE-2014-5266 · Drupal, WordPress

    The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.

    Published 18 Aug 2014 · NVD
  44. Medium 5.0

    CVE-2014-5265 · Drupal, WordPress

    The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to…

    Published 18 Aug 2014 · NVD
  45. Low 2.1

    CVE-2014-5240 · WordPress

    Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL.

    Published 18 Aug 2014 · NVD
  46. Medium 6.8

    CVE-2014-5205 · WordPress

    wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.

    Published 18 Aug 2014 · NVD
  47. Medium 6.8

    CVE-2014-5204 · WordPress

    wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.

    Published 18 Aug 2014 · NVD
  48. High 7.5

    CVE-2014-5203 · WordPress

    wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted serialized data.

    Published 18 Aug 2014 · NVD
  49. Medium 4.0

    CVE-2014-3087 · IBM WebSphere Application Server

    callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

    Published 17 Aug 2014 · NVD
  50. Medium 4.3

    CVE-2014-5248 · MyBB

    Cross-site scripting (XSS) vulnerability in MyBB before 1.6.15 allows remote attackers to inject arbitrary web script or HTML via vectors related to video MyCode.

    Published 14 Aug 2014 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.