Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 40,037
- Published in 7 days
- 1,076
- Critical in 30 days
- 352
- Actively exploited
- 423
Latest vulnerabilities
40,037 vulnerabilities- High 7.5
CVE-2013-4338 · WordPress
wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations.
Published 12 Sept 2013 · NVD - Medium 4.3
CVE-2013-4298 · ImageMagick
The ReadGIFImage function in coders/gif.c in ImageMagick before 6.7.8-8 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted comment in a GIF image.
Published 10 Sept 2013 · NVD - High 9.4
CVE-2013-3658 · VMware ESXi
Directory traversal vulnerability in VMware ESXi 4.0 through 5.0, and ESX 4.0 and 4.1, allows remote attackers to delete arbitrary host OS files via unspecified vectors.
Published 10 Sept 2013 · NVD - High 7.5
CVE-2013-3657 · VMware ESXi
Buffer overflow in VMware ESXi 4.0 through 5.0, and ESX 4.0 and 4.1, allows remote attackers to execute arbitrary code or cause a denial of service via unspecified vectors.
Published 10 Sept 2013 · NVD - Medium 4.3
CVE-2013-1661 · VMware ESXi
VMware ESXi 4.0 through 5.1, and ESX 4.0 and 4.1, does not properly implement the Network File Copy (NFC) protocol, which allows man-in-the-middle attackers to cause a denial of service (unhandled exception and application crash) by modifying the client-server data stream.
Published 4 Sept 2013 · NVD - Medium 4.3
CVE-2013-5664 · Palo Alto Networks PAN-OS
Cross-site scripting (XSS) vulnerability in the web-based device-management API browser in Palo Alto Networks PAN-OS before 4.1.13 and 5.0.x before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via crafted data, aka Ref ID 50908.
Published 31 Aug 2013 · NVD - Medium 4.3
CVE-2013-5663 · Palo Alto Networks PAN-OS
The App-ID cache feature in Palo Alto Networks PAN-OS before 4.0.14, 4.1.x before 4.1.11, and 5.0.x before 5.0.2 allows remote attackers to bypass intended security policies via crafted requests that trigger invalid caching, as demonstrated by incorrect identification of HTTP traffic as SIP traffic, aka Ref ID 47195.
Published 31 Aug 2013 · NVD - High 9.0
CVE-2012-6605 · Palo Alto Networks PAN-OS
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka Ref ID 34896.
Published 31 Aug 2013 · NVD - High 9.0
CVE-2012-6604 · Palo Alto Networks PAN-OS
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka Ref ID 35249.
Published 31 Aug 2013 · NVD - High 10.0
CVE-2012-6603 · Palo Alto Networks PAN-OS
The web management UI in Palo Alto Networks PAN-OS before 3.1.12, 4.0.x before 4.0.10, and 4.1.x before 4.1.4 allows remote attackers to bypass authentication and obtain administrator privileges via unspecified vectors, aka Ref ID 37034.
Published 31 Aug 2013 · NVD - High 9.0
CVE-2012-6602 · Palo Alto Networks PAN-OS
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.4 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 30122.
Published 31 Aug 2013 · NVD - High 10.0
CVE-2012-6601 · Palo Alto Networks PAN-OS
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.12, 4.0.x before 4.0.10, and 4.1.x before 4.1.4 allows remote attackers to execute arbitrary code via unspecified vectors, aka Ref ID 36983.
Published 31 Aug 2013 · NVD - High 9.0
CVE-2012-6600 · Palo Alto Networks PAN-OS
The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 34502.
Published 31 Aug 2013 · NVD - High 9.0
CVE-2012-6599 · Palo Alto Networks PAN-OS
The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 and 4.1.x before 4.1.1 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 33476.
Published 31 Aug 2013 · NVD - High 9.0
CVE-2012-6598 · Palo Alto Networks PAN-OS
The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 33080.
Published 31 Aug 2013 · NVD - Medium 6.3
CVE-2012-6597 · Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to cause a denial of service (management-server crash) by using the command-line interface for a crafted command, aka Ref ID 35254.
Published 31 Aug 2013 · NVD - Medium 5.0
CVE-2012-6596 · Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.3 stores cleartext LDAP bind passwords in authd.log, which allows context-dependent attackers to obtain sensitive information by reading this file, aka Ref ID 35493.
Published 31 Aug 2013 · NVD - High 9.0
CVE-2012-6595 · Palo Alto Networks PAN-OS
The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 34595.
Published 31 Aug 2013 · NVD - High 9.0
CVE-2012-6594 · Palo Alto Networks PAN-OS
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11, 4.0.x before 4.0.8, and 4.1.x before 4.1.1 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 34299.
Published 31 Aug 2013 · NVD - High 10.0
CVE-2012-6593 · Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.4 allows remote attackers to execute arbitrary commands via unspecified vectors, aka Ref ID 30088.
Published 31 Aug 2013 · NVD - High 10.0
CVE-2012-6592 · Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.5 allows remote attackers to execute arbitrary commands via unspecified vectors, aka Ref ID 31091.
Published 31 Aug 2013 · NVD - High 9.0
CVE-2012-6591 · Palo Alto Networks PAN-OS
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.5 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 31116.
Published 31 Aug 2013 · NVD - Medium 4.3
CVE-2012-6590 · Palo Alto Networks PAN-OS
The web-based management UI in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 allows remote attackers to obtain verbose error information via crafted input, aka Ref ID 33139.
Published 31 Aug 2013 · NVD - Low 3.5
CVE-2013-5646 · Roundcube
Cross-site scripting (XSS) vulnerability in Roundcube webmail 1.0-git allows remote authenticated users to inject arbitrary web script or HTML via the Name field of an addressbook group.
Published 29 Aug 2013 · NVD - Medium 4.3
CVE-2013-5645 · Roundcube
Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc.
Published 29 Aug 2013 · NVD - Medium 4.7
CVE-2013-3495 · Xen
The Intel VT-d Interrupt Remapping engine in Xen 3.3.x through 4.3.x allows local guests to cause a denial of service (kernel panic) via a malformed Message Signaled Interrupt (MSI) from a PCI device that is bus mastering capable that triggers a System Error Reporting (SERR) Non-Maskable Interrupt (NMI).
Published 28 Aug 2013 · NVD - Medium 5.7
CVE-2013-2212 · Xen
The vmx_set_uc_mode function in Xen 3.3 through 4.3, when disabling caches, allows local HVM guests with access to memory mapped I/O regions to cause a denial of service (CPU consumption and possibly hypervisor or guest kernel panic) via a crafted GFN range.
Published 28 Aug 2013 · NVD - High 7.4
CVE-2013-2211 · Xen
The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.
Published 28 Aug 2013 · NVD - Medium 5.2
CVE-2013-2077 · Xen
Xen 4.0.x, 4.1.x, and 4.2.x does not properly restrict the contents of a XRSTOR, which allows local PV guest users to cause a denial of service (unhandled exception and hypervisor crash) via unspecified vectors.
Published 28 Aug 2013 · NVD - Medium 4.3
CVE-2013-2076 · Xen
Xen 4.0.x, 4.1.x, and 4.2.x, when running on AMD64 processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one domain to determine portions of the state of floating point instructions of other domains, which can be leveraged to obtain sensitive information such as cryptographic keys, a similar vulnerability to CVE-2006-1056.…
Published 28 Aug 2013 · NVD - High 7.4
CVE-2013-2072 · Xen
Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap.
Published 28 Aug 2013 · NVD - High 7.4
CVE-2013-1432 · Xen
Xen 4.1.x and 4.2.x, when the XSA-45 patch is in place, does not properly maintain references on pages stored for deferred cleanup, which allows local PV guest kernels to cause a denial of service (premature page free and hypervisor crash) or possibly gain privileges via unspecified vectors.
Published 28 Aug 2013 · NVD - Medium 6.9
CVE-2013-2196 · Xen
Multiple unspecified vulnerabilities in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "other problems" that are not CVE-2013-2194 or CVE-2013-2195.
Published 23 Aug 2013 · NVD - Medium 6.9
CVE-2013-2195 · Xen
The Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "pointer dereferences" involving unexpected calculations.
Published 23 Aug 2013 · NVD - Medium 6.9
CVE-2013-2194 · Xen
Multiple integer overflows in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel.
Published 23 Aug 2013 · NVD - Low 3.5
CVE-2013-4005 · IBM WebSphere Application Server
Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified fields.
Published 21 Aug 2013 · NVD - Low 3.5
CVE-2013-4004 · IBM WebSphere Application Server
Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.7 and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Published 21 Aug 2013 · NVD - Medium 6.8
CVE-2013-3029 · IBM WebSphere Application Server
Cross-site request forgery (CSRF) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting (XSS) sequences.
Published 21 Aug 2013 · NVD - Low 1.9
CVE-2013-2976 · IBM WebSphere Application Server
The Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0 does not properly perform caching, which allows local users to obtain sensitive information via unspecified vectors.
Published 21 Aug 2013 · NVD - Medium 4.3
CVE-2013-2967 · IBM WebSphere Application Server
Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published 21 Aug 2013 · NVD - Low 3.5
CVE-2013-0597 · IBM WebSphere Application Server
Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0, when OAuth is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Published 21 Aug 2013 · NVD - Medium 4.3
CVE-2013-5319 · Jira
Cross-site scripting (XSS) vulnerability in secure/admin/user/views/deleteuserconfirm.jsp in the Admin Panel in Atlassian JIRA before 6.0.5 allows remote attackers to inject arbitrary web script or HTML via the name parameter to secure/admin/user/DeleteUser!default.jspa.
Published 20 Aug 2013 · NVD - Medium 4.3
CVE-2013-5029 · phpMyAdmin
phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php.
Published 19 Aug 2013 · NVD - Medium 5.0
CVE-2013-2175 · HAProxy
HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" functions with a negative occurrence count, allows remote attackers to cause a denial of service (negative array index usage and crash) via an HTTP header with a certain number of values, related to the MAX_HDR_HISTORY variable.
Published 19 Aug 2013 · NVD - Medium 4.3
CVE-2013-4248 · PHP
The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to…
Published 18 Aug 2013 · NVD - Medium 4.3
CVE-2013-4238 · Python
The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Published 18 Aug 2013 · NVD - Medium 6.8
CVE-2013-4073 · Ruby
The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate…
Published 18 Aug 2013 · NVD - Medium 4.3
CVE-2013-2132 · MongoDB
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
Published 15 Aug 2013 · NVD - High 10.0
CVE-2013-2250 · Apache OFBiz
Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language (UEL) functions via JUEL metacharacters in unspecified parameters, related to nested expressions.
Published 15 Aug 2013 · NVD - Medium 4.3
CVE-2013-2137 · Apache OFBiz
Cross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published 15 Aug 2013 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.