UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,026
Published in 7 days
1,068
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,026 vulnerabilities
  1. Medium 6.8

    CVE-2013-7016 · FFmpeg

    The get_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the expected sample separation, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.

    Published 9 Dec 2013 · NVD
  2. Medium 6.8

    CVE-2013-7015 · FFmpeg

    The flashsv_decode_frame function in libavcodec/flashsv.c in FFmpeg before 2.1 does not properly validate a certain height value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Flash Screen Video data.

    Published 9 Dec 2013 · NVD
  3. Medium 6.8

    CVE-2013-7014 · FFmpeg

    Integer signedness error in the add_bytes_l2_c function in libavcodec/pngdsp.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted PNG data.

    Published 9 Dec 2013 · NVD
  4. Medium 6.8

    CVE-2013-7013 · FFmpeg

    The g2m_init_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 uses an incorrect ordering of arithmetic operations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Go2Webinar data.

    Published 9 Dec 2013 · NVD
  5. Medium 6.8

    CVE-2013-7012 · FFmpeg

    The get_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not prevent attempts to use non-zero image offsets, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.

    Published 9 Dec 2013 · NVD
  6. Medium 6.8

    CVE-2013-7011 · FFmpeg

    The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not prevent changes to global parameters, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted FFV1 data.

    Published 9 Dec 2013 · NVD
  7. Medium 6.8

    CVE-2013-7010 · FFmpeg

    Multiple integer signedness errors in libavcodec/dsputil.c in FFmpeg before 2.1 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data.

    Published 9 Dec 2013 · NVD
  8. Medium 6.8

    CVE-2013-7009 · FFmpeg

    The rpza_decode_stream function in libavcodec/rpza.c in FFmpeg before 2.1 does not properly maintain a pointer to pixel data, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Apple RPZA data.

    Published 9 Dec 2013 · NVD
  9. Medium 6.8

    CVE-2013-7008 · FFmpeg

    The decode_slice_header function in libavcodec/h264.c in FFmpeg before 2.1 incorrectly relies on a certain droppable field, which allows remote attackers to cause a denial of service (deadlock) or possibly have unspecified other impact via crafted H.264 data.

    Published 9 Dec 2013 · NVD
  10. Medium 5.8

    CVE-2013-6171 · Dovecot

    checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the response to the dovecot-auth server.

    Published 9 Dec 2013 · NVD
  11. High 7.5

    CVE-2011-4351 · FFmpeg

    Buffer overflow in FFmpeg before 0.5.6, 0.6.x before 0.6.4, 0.7.x before 0.7.8, and 0.8.x before 0.8.8 allows remote attackers to execute arbitrary code via unspecified vectors.

    Published 9 Dec 2013 · NVD
  12. Medium 6.8

    CVE-2011-3950 · FFmpeg

    The dirac_decode_data_unit function in libavcodec/diracdec.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via a crafted value in the reference pictures number.

    Published 9 Dec 2013 · NVD
  13. Medium 6.8

    CVE-2011-3949 · FFmpeg

    The dirac_unpack_idwt_params function in libavcodec/diracdec.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Dirac data.

    Published 9 Dec 2013 · NVD
  14. Medium 6.8

    CVE-2011-3946 · FFmpeg

    The ff_h264_decode_sei function in libavcodec/h264_sei.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Supplemental enhancement information (SEI) data, which triggers an infinite loop.

    Published 9 Dec 2013 · NVD
  15. Medium 6.8

    CVE-2011-3944 · FFmpeg

    The smacker_decode_header_tree function in libavcodec/smacker.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Smacker data.

    Published 9 Dec 2013 · NVD
  16. High 7.5

    CVE-2011-3941 · FFmpeg

    The decode_mb function in libavcodec/error_resilience.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via vectors related to an uninitialized block index, which triggers an out-of-bounds write.

    Published 9 Dec 2013 · NVD
  17. Medium 6.8

    CVE-2011-3935 · FFmpeg

    The codec_get_buffer function in ffmpeg.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via vectors related to a crafted image size.

    Published 9 Dec 2013 · NVD
  18. Medium 6.8

    CVE-2011-3934 · FFmpeg

    Double free vulnerability in the vp3_update_thread_context function in libavcodec/vp3.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted vp3 data.

    Published 9 Dec 2013 · NVD
  19. Medium 5.8

    CVE-2013-6389 · Drupal

    Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

    Published 7 Dec 2013 · NVD
  20. Medium 6.8

    CVE-2013-6386 · Drupal

    Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to generate random numbers, which uses predictable seeds and allows remote attackers to predict security strings and bypass intended restrictions via a brute force attack.

    Published 7 Dec 2013 · NVD
  21. Medium 5.1

    CVE-2013-6385 · Drupal

    The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger application-specific impacts such as arbitrary code execution via application-specific vectors.

    Published 7 Dec 2013 · NVD
  22. High 9.3

    CVE-2013-0859 · FFmpeg

    The add_doubles_metadata function in libavcodec/tiff.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a negative or zero count value in a TIFF image, which triggers an out-of-bounds array access.

    Published 7 Dec 2013 · NVD
  23. High 9.3

    CVE-2013-0858 · FFmpeg

    The atrac3_decode_init function in libavcodec/atrac3.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via ATRAC3 data with the joint stereo coding mode set and fewer than two channels.

    Published 7 Dec 2013 · NVD
  24. High 9.3

    CVE-2013-0857 · FFmpeg

    The decode_frame_ilbm function in libavcodec/iff.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted height value in IFF PBM/ILBM bitmap data.

    Published 7 Dec 2013 · NVD
  25. High 9.3

    CVE-2013-0856 · FFmpeg

    The lpc_prediction function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted Apple Lossless Audio Codec (ALAC) data, related to a large nb_samples value.

    Published 7 Dec 2013 · NVD
  26. High 9.3

    CVE-2013-0855 · FFmpeg

    Integer overflow in the alac_decode_close function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a large number of samples per frame in Apple Lossless Audio Codec (ALAC) data, which triggers an out-of-bounds array access.

    Published 7 Dec 2013 · NVD
  27. High 9.3

    CVE-2013-0854 · FFmpeg

    The mjpeg_decode_scan_progressive_ac function in libavcodec/mjpegdec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted MJPEG data.

    Published 7 Dec 2013 · NVD
  28. High 9.3

    CVE-2013-0853 · FFmpeg

    The wavpack_decode_frame function in libavcodec/wavpack.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted WavPack data, which triggers an out-of-bounds array access, possibly due to an off-by-one error.

    Published 7 Dec 2013 · NVD
  29. High 9.3

    CVE-2013-0852 · FFmpeg

    The parse_picture_segment function in libavcodec/pgssubdec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted RLE data, which triggers an out-of-bounds array access.

    Published 7 Dec 2013 · NVD
  30. High 9.3

    CVE-2013-0851 · FFmpeg

    The decode_frame function in libavcodec/eamad.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted Electronic Arts Madcow video data, which triggers an out-of-bounds array access.

    Published 7 Dec 2013 · NVD
  31. High 9.3

    CVE-2013-0850 · FFmpeg

    The decode_slice_header function in libavcodec/h264.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted H.264 data, which triggers an out-of-bounds array access.

    Published 7 Dec 2013 · NVD
  32. High 9.3

    CVE-2013-0849 · FFmpeg

    The roq_decode_init function in libavcodec/roqvideodec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted (1) width or (2) height dimension that is not a multiple of sixteen in id RoQ video data.

    Published 7 Dec 2013 · NVD
  33. High 9.3

    CVE-2013-0848 · FFmpeg

    The decode_init function in libavcodec/huffyuv.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted width in huffyuv data with the predictor set to median and the colorspace set to YUV422P, which triggers an out-of-bounds array access.

    Published 7 Dec 2013 · NVD
  34. High 9.3

    CVE-2013-0847 · FFmpeg

    The ff_id3v2_parse function in libavformat/id3v2.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via ID3v2 header data, which triggers an out-of-bounds array access.

    Published 7 Dec 2013 · NVD
  35. High 9.3

    CVE-2013-0846 · FFmpeg

    Array index error in the qdm2_decode_super_block function in libavcodec/qdm2.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted QDM2 data, which triggers an out-of-bounds array access.

    Published 7 Dec 2013 · NVD
  36. High 9.3

    CVE-2013-0845 · FFmpeg

    libavcodec/alsdec.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via a crafted block length, which triggers an out-of-bounds write.

    Published 7 Dec 2013 · NVD
  37. High 9.3

    CVE-2013-0844 · FFmpeg

    Off-by-one error in the adpcm_decode_frame function in libavcodec/adpcm.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via crafted DK4 data, which triggers an out-of-bounds array access.

    Published 7 Dec 2013 · NVD
  38. High 7.5

    CVE-2012-6612 · Apache Solr

    The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.

    Published 7 Dec 2013 · NVD
  39. Medium 6.4

    CVE-2013-6408 · Apache Solr

    The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.

    Published 7 Dec 2013 · NVD
  40. Medium 6.4

    CVE-2013-6407 · Apache Solr

    The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

    Published 7 Dec 2013 · NVD
  41. Medium 4.3

    CVE-2013-6397 · Apache Solr

    Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network…

    Published 7 Dec 2013 · NVD
  42. Medium 6.0

    CVE-2013-6787 · Chamilo LMS

    SQL injection vulnerability in the check_user_password function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the non-encrypted passwords mode set at installation, allows remote authenticated users to execute arbitrary SQL commands via the "password0" parameter.

    Published 5 Dec 2013 · NVD
  43. High 7.9

    CVE-2013-3519 · VMware ESXi

    lgtosync.sys in VMware Workstation 9.x before 9.0.3, VMware Player 5.x before 5.0.3, VMware Fusion 5.x before 5.0.4, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1, when a 32-bit Windows guest OS is used, allows guest OS users to gain guest OS privileges via an application that performs a crafted memory allocation.

    Published 4 Dec 2013 · NVD
  44. Low 3.6

    CVE-2012-6150 · Samba

    The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake.

    Published 3 Dec 2013 · Fixed in 3.6.22, 4.0.13, 4.1.3 · NVD
  45. Medium 5.8

    CVE-2014-0173 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 3 Dec 2013 · Fixed in 2.9.3 · NVD, WPVulnerability
  46. Medium 5.0

    CVE-2013-6712 · PHP

    The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.

    Published 28 Nov 2013 · Fixed in 5.3.29, 5.4.24, 5.5.8 · NVD
  47. High 7.5

    CVE-2013-6875 · Nagios XI

    SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php.

    Published 26 Nov 2013 · NVD
  48. Low 3.5

    CVE-2013-4525 · Moodle

    Cross-site scripting (XSS) vulnerability in mod/quiz/report/responses/responses_table.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via an answer to a text-based quiz question.

    Published 26 Nov 2013 · NVD
  49. Medium 6.8

    CVE-2013-4524 · Moodle

    Directory traversal vulnerability in repository/filesystem/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a path.

    Published 26 Nov 2013 · NVD
  50. Low 3.5

    CVE-2013-4523 · Moodle

    Cross-site scripting (XSS) vulnerability in message/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted message.

    Published 26 Nov 2013 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.