UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,022
Published in 7 days
1,066
Critical in 30 days
385
Actively exploited
423

Latest vulnerabilities

40,022 vulnerabilities
  1. Medium 6.8

    CVE-2013-4581 · GitLab

    GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote attackers to execute arbitrary code via a crafted change using SSH.

    Published 12 May 2014 · NVD
  2. Medium 6.8

    CVE-2013-4580 · GitLab

    GitLab before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1, when using a MySQL backend, allows remote attackers to impersonate arbitrary users and bypass authentication via unspecified API calls.

    Published 12 May 2014 · NVD
  3. Medium 4.3

    CVE-2013-4574 · MediaWiki

    Cross-site scripting (XSS) vulnerability in the TimeMediaHandler extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to videos.

    Published 12 May 2014 · NVD
  4. High 7.5

    CVE-2013-4571 · MediaWiki

    Buffer overflow in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 has unspecified impact and remote vectors.

    Published 12 May 2014 · NVD
  5. Medium 5.0

    CVE-2013-4570 · MediaWiki

    The zend_inline_hash_func function in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to converting Lua data structures to PHP, as demonstrated by passing { [{}] = 1 } to a module function.

    Published 12 May 2014 · NVD
  6. Medium 5.0

    CVE-2014-3214 · BIND 9

    The prefetch implementation in named in ISC BIND 9.10.0, when a recursive nameserver is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a DNS query that triggers a response with unspecified attributes.

    Published 9 May 2014 · NVD
  7. Medium 6.8

    CVE-2014-3115 · Fortinet FortiWeb

    Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Fortinet FortiWeb before 5.2.0 allow remote attackers to hijack the authentication of administrators via system/config/adminadd and other unspecified vectors.

    Published 8 May 2014 · NVD
  8. Medium 5.5

    CVE-2014-1685 · Zabbix

    The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors.

    Published 8 May 2014 · NVD
  9. Medium 4.0

    CVE-2014-1682 · Zabbix

    The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.

    Published 8 May 2014 · NVD
  10. Low 2.1

    CVE-2013-0345 · Varnish Cache

    varnish 3.0.3 uses world-readable permissions for the /var/log/varnish/ directory and the log files in the directory, which allows local users to obtain sensitive information by reading the files. NOTE: some of these details are obtained from third party information.

    Published 8 May 2014 · NVD
  11. Medium 5.8

    CVE-2014-0116 · Apache Struts

    CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.

    Published 8 May 2014 · NVD
  12. Medium 6.7

    CVE-2014-3124 · Xen

    The HVMOP_set_mem_type control in Xen 4.1 through 4.4.x allows local guest HVM administrators to cause a denial of service (hypervisor crash) or possibly execute arbitrary code by leveraging a separate qemu-dm vulnerability to trigger invalid page table translations for unspecified memory page types.

    Published 7 May 2014 · NVD
  13. Medium 5.5Actively exploited

    CVE-2014-0196 · F5 BIG-IP

    The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.

    Published 7 May 2014 · NVD
  14. Medium 4.3

    CVE-2014-0198 · MariaDB, OpenSSL

    The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.

    Published 6 May 2014 · Fixed in 10.0.13 · NVD
  15. High 7.2

    CVE-2014-0185 · PHP

    sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.

    Published 6 May 2014 · Fixed in 5.3.28, 5.4.28, 5.5.12 · NVD
  16. Medium 6.2

    CVE-2014-3125 · Xen

    Xen 4.4.x, when running on an ARM system, does not properly context switch the CNTKCTL_EL1 register, which allows local guest users to modify the hardware timers and cause a denial of service (crash) via unspecified vectors.

    Published 2 May 2014 · NVD
  17. Medium 4.3

    CVE-2014-0896 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request.

    Published 1 May 2014 · NVD
  18. Medium 5.0

    CVE-2014-0859 · IBM WebSphere Application Server

    The web-server plugin in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, when POST retries are enabled, allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.

    Published 1 May 2014 · NVD
  19. Medium 4.0

    CVE-2014-0857 · IBM WebSphere Application Server

    The Administrative Console in IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote authenticated users to obtain sensitive information via a crafted request.

    Published 1 May 2014 · NVD
  20. Medium 4.3

    CVE-2014-0823 · IBM WebSphere Application Server

    IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote attackers to read arbitrary files via a crafted URL.

    Published 1 May 2014 · NVD
  21. Low 3.5

    CVE-2013-6323 · IBM WebSphere Application Server

    Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, and WebSphere Virtual Enterprise 7.x before 7.0.0.5, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

    Published 1 May 2014 · NVD
  22. Medium 4.3

    CVE-2014-3135 · vBulletin

    Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to privatemessage/new/, (2) the folderid parameter to a private message in privatemessage/view, (3) a fragment indicator to /help, or (4) the view parameter to a topic, as demonstrated by a request to…

    Published 30 Apr 2014 · NVD
  23. Medium 6.5

    CVE-2014-1957 · Fortinet FortiWeb

    FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors.

    Published 30 Apr 2014 · NVD
  24. Medium 5.0

    CVE-2014-1956 · Fortinet FortiWeb

    CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

    Published 30 Apr 2014 · NVD
  25. Medium 4.3

    CVE-2014-1955 · Fortinet FortiWeb

    Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 30 Apr 2014 · NVD
  26. High 7.5

    CVE-2014-0114 · Apache Struts

    Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass…

    Published 30 Apr 2014 · NVD
  27. Medium 4.3

    CVE-2014-2853 · MediaWiki

    Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.

    Published 29 Apr 2014 · NVD
  28. High 7.5

    CVE-2014-0088 · nginx

    The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request.

    Published 29 Apr 2014 · NVD
  29. High 7.5

    CVE-2014-0113 · Apache Struts

    CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

    Published 29 Apr 2014 · Fixed in 2.3.16.2 · NVD
  30. High 7.5

    CVE-2014-0112 · Apache Struts

    ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.

    Published 29 Apr 2014 · Fixed in 2.3.16.2 · NVD
  31. Medium 5.5

    CVE-2014-2986 · Xen

    The vgic_distr_mmio_write function in the virtual guest interrupt controller (GIC) distributor (arch/arm/vgic.c) in Xen 4.4.x, when running on an ARM system, allows local guest users to cause a denial of service (NULL pointer dereference and host crash) via unspecified vectors.

    Published 28 Apr 2014 · NVD
  32. Medium 5.8

    CVE-2014-2734 · Ruby

    The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. NOTE: this issue has been disputed by the Ruby OpenSSL team and third parties, who state that the…

    Published 24 Apr 2014 · NVD
  33. Medium 5.5

    CVE-2014-2915 · Xen

    Xen 4.4.x, when running on ARM systems, does not properly restrict access to hardware features, which allows local guest users to cause a denial of service (host or guest crash) via unspecified vectors, related to (1) cache control, (2) coprocessors, (3) debug registers, and (4) other unspecified registers.

    Published 24 Apr 2014 · NVD
  34. Medium 5.0

    CVE-2011-5279 · Microsoft IIS

    CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on Windows NT and Windows 2000 allows remote attackers to modify arbitrary uppercase environment variables via a \n (newline) character in an HTTP header.

    Published 23 Apr 2014 · NVD
  35. Medium 5.0

    CVE-2014-2983 · Drupal

    Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors.

    Published 23 Apr 2014 · Fixed in 6.31, 7.27 · NVD
  36. High 7.8

    CVE-2014-2855 · rsync

    The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a user name which does not exist in the secrets file.

    Published 23 Apr 2014 · NVD
  37. High 7.1

    CVE-2013-7338 · Python

    Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.

    Published 22 Apr 2014 · NVD
  38. Medium 6.4

    CVE-2014-2922 · Pimcore

    The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a Zend_Http_Response_Stream object.

    Published 21 Apr 2014 · NVD
  39. High 7.5

    CVE-2014-2921 · Pimcore

    The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character.

    Published 21 Apr 2014 · NVD
  40. Medium 4.0

    CVE-2014-2665 · MediaWiki

    includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the…

    Published 20 Apr 2014 · NVD
  41. Medium 4.0

    CVE-2014-2522 · curl

    curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid…

    Published 18 Apr 2014 · NVD
  42. Low 3.5

    CVE-2014-2451 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Privileges.

    Published 16 Apr 2014 · NVD
  43. Medium 4.0

    CVE-2014-2450 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

    Published 16 Apr 2014 · NVD
  44. Medium 6.5

    CVE-2014-2444 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to InnoDB.

    Published 16 Apr 2014 · NVD
  45. Medium 4.0

    CVE-2014-2442 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to MyISAM.

    Published 16 Apr 2014 · NVD
  46. Medium 5.1

    CVE-2014-2440 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Client component in Oracle MySQL 5.5.36 and earlier and 5.6.16 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

    Published 16 Apr 2014 · Fixed in 5.5.37, 10.0.11 · NVD
  47. Low 3.5

    CVE-2014-2438 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Replication.

    Published 16 Apr 2014 · Fixed in 5.5.36, 10.0.9 · NVD
  48. Medium 6.5

    CVE-2014-2436 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to RBR.

    Published 16 Apr 2014 · Fixed in 5.5.37, 10.0.11 · NVD
  49. Medium 4.0

    CVE-2014-2435 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.16 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

    Published 16 Apr 2014 · NVD
  50. Medium 4.0

    CVE-2014-2434 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 16 Apr 2014 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.