UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,046
Published in 7 days
1,085
Critical in 30 days
352
Actively exploited
423

Latest vulnerabilities

40,046 vulnerabilities
  1. Medium 4.0

    CVE-2013-3808 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 allows remote authenticated users to affect availability via unknown vectors related to Server Options.

    Published 17 Jul 2013 · Fixed in 5.5.31, 10.0.3 · NVD
  2. Medium 4.0

    CVE-2013-3807 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.11 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Server Privileges.

    Published 17 Jul 2013 · NVD
  3. Medium 4.0

    CVE-2013-3806 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2013-3811.

    Published 17 Jul 2013 · NVD
  4. Medium 4.0

    CVE-2013-3805 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.30 and earlier and 5.6.10 allows remote authenticated users to affect availability via unknown vectors related to Prepared Statements.

    Published 17 Jul 2013 · Fixed in 5.5.31, 10.0.3 · NVD
  5. Medium 4.0

    CVE-2013-3804 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

    Published 17 Jul 2013 · Fixed in 5.5.32, 10.0.4 · NVD
  6. Medium 4.0

    CVE-2013-3802 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Full Text Search.

    Published 17 Jul 2013 · Fixed in 5.5.32, 10.0.4 · NVD
  7. Medium 5.0

    CVE-2013-3801 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.30 and earlier and 5.6.10 allows remote authenticated users to affect availability via unknown vectors related to Server Options.

    Published 17 Jul 2013 · Fixed in 5.5.31, 10.0.3 · NVD
  8. Medium 5.8

    CVE-2013-3798 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.11 and earlier allows remote attackers to affect integrity and availability via unknown vectors related to MemCached.

    Published 17 Jul 2013 · NVD
  9. Medium 4.0

    CVE-2013-3796 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

    Published 17 Jul 2013 · NVD
  10. Medium 4.0

    CVE-2013-3795 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language.

    Published 17 Jul 2013 · NVD
  11. Medium 4.0

    CVE-2013-3794 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.30 and earlier and 5.6.10 allows remote authenticated users to affect availability via unknown vectors related to Server Partition.

    Published 17 Jul 2013 · Fixed in 5.5.31, 10.0.3 · NVD
  12. Medium 4.0

    CVE-2013-3793 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language.

    Published 17 Jul 2013 · Fixed in 5.5.32, 10.0.4 · NVD
  13. Medium 4.0

    CVE-2013-3783 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Parser.

    Published 17 Jul 2013 · Fixed in 5.5.32, 10.0.4 · NVD
  14. High 9.3

    CVE-2013-2135 · Apache Struts

    Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.

    Published 16 Jul 2013 · Fixed in 2.3.14.3 · NVD
  15. High 9.3

    CVE-2013-2134 · Apache Struts

    Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.

    Published 16 Jul 2013 · Fixed in 2.3.14.3 · NVD
  16. Medium 4.3

    CVE-2013-0246 · Drupal

    The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors.

    Published 16 Jul 2013 · NVD
  17. Low 2.1

    CVE-2013-0245 · Drupal

    The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not properly restrict access to node that are part of a book outline, which allows remote authenticated users with the "access printer-friendly version" permission to read node titles and possibly node content via unspecified vectors.

    Published 16 Jul 2013 · NVD
  18. Medium 5.0

    CVE-2013-2765 · ModSecurity

    The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.

    Published 15 Jul 2013 · Fixed in 2.7.4 · NVD
  19. Medium 6.8

    CVE-2013-4113 · PHP

    ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function.

    Published 13 Jul 2013 · Fixed in 5.3.27, 5.4.18 · NVD
  20. High 10.0

    CVE-2013-1777 · IBM WebSphere Application Server

    The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.

    Published 11 Jul 2013 · NVD
  21. Medium 4.3

    CVE-2013-1896 · Apache HTTP Server

    mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.

    Published 10 Jul 2013 · Fixed in 2.2.25, 2.4.6 · NVD
  22. High 8.1

    CVE-2013-2115 · Apache Struts

    Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.

    Published 10 Jul 2013 · NVD
  23. High 9.3

    CVE-2013-1966 · Apache Struts

    Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.

    Published 10 Jul 2013 · Fixed in 2.3.14.1 · NVD
  24. High 9.3

    CVE-2013-1965 · Apache Struts

    Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

    Published 10 Jul 2013 · Fixed in 2.3.14.1 · NVD
  25. High 10.0

    CVE-2013-3350 · Adobe ColdFusion

    Adobe ColdFusion 10 before Update 11 allows remote attackers to call ColdFusion Components (CFC) public methods via WebSockets.

    Published 10 Jul 2013 · NVD
  26. Medium 5.0

    CVE-2013-3349 · Adobe ColdFusion

    Unspecified vulnerability in Adobe ColdFusion 9.0 through 9.0.2, when the JRun application server is used, allows remote attackers to cause a denial of service via unknown vectors.

    Published 10 Jul 2013 · NVD
  27. Medium 5.0

    CVE-2013-2877 · libxml2

    parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.

    Published 10 Jul 2013 · NVD
  28. High 7.5

    CVE-2013-2118 · SPIP

    SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "take editorial control" via vectors related to ecrire/inc/filtres.php.

    Published 9 Jul 2013 · NVD
  29. Medium 4.3

    CVE-2013-2205 · WordPress

    The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site.

    Published 8 Jul 2013 · NVD
  30. Medium 4.3

    CVE-2013-2204 · WordPress

    moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRING, which allows remote attackers to pass arbitrary parameters to a Flash application, and conduct content-spoofing attacks, via a crafted string after a ? (question mark)…

    Published 8 Jul 2013 · NVD
  31. Medium 4.3

    CVE-2013-2203 · WordPress

    WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message.

    Published 8 Jul 2013 · NVD
  32. Medium 4.3

    CVE-2013-2202 · WordPress

    WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

    Published 8 Jul 2013 · NVD
  33. Medium 4.3

    CVE-2013-2201 · WordPress

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files, (2) editing of media files, (3) installation of plugins, (4) updates to plugins, (5) installation of themes, or (6) updates to themes.

    Published 8 Jul 2013 · NVD
  34. Medium 4.0

    CVE-2013-2200 · WordPress

    WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing and authorship reassignment via unspecified vectors.

    Published 8 Jul 2013 · NVD
  35. Medium 4.3

    CVE-2013-2199 · WordPress

    The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery (SSRF) issue, a similar vulnerability to CVE-2013-0235.

    Published 8 Jul 2013 · NVD
  36. Medium 4.3

    CVE-2013-0237 · WordPress

    Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.

    Published 8 Jul 2013 · NVD
  37. Medium 4.3

    CVE-2013-0236 · WordPress

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery shortcodes or (2) the content of a post.

    Published 8 Jul 2013 · NVD
  38. Medium 6.4

    CVE-2013-0235 · WordPress

    The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.

    Published 8 Jul 2013 · NVD
  39. Medium 5.1

    CVE-2013-1414 · Fortinet FortiOS

    Multiple cross-site request forgery (CSRF) vulnerabilities in Fortinet FortiOS on FortiGate firewall devices before 4.3.13 and 5.x before 5.0.2 allow remote attackers to hijack the authentication of administrators for requests that modify (1) settings or (2) policies, or (3) restart the device via a rebootme action to system/maintenance/shutdown.

    Published 8 Jul 2013 · NVD
  40. Medium 5.5

    CVE-2013-4729 · phpMyAdmin

    import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request.

    Published 4 Jul 2013 · NVD
  41. Medium 6.5

    CVE-2013-4650 · MongoDB

    MongoDB 2.4.x before 2.4.5 and 2.5.x before 2.5.1 allows remote authenticated users to obtain internal system privileges by leveraging a username of __system in an arbitrary database.

    Published 4 Jul 2013 · NVD
  42. Low 3.5

    CVE-2013-3742 · phpMyAdmin

    Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message.

    Published 4 Jul 2013 · NVD
  43. Low 3.5

    CVE-2012-6148 · TYPO3

    Cross-site scripting (XSS) vulnerability in the function menu API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

    Published 1 Jul 2013 · NVD
  44. Low 3.5

    CVE-2012-6147 · TYPO3

    Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

    Published 1 Jul 2013 · NVD
  45. Low 3.5

    CVE-2012-6145 · TYPO3

    Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

    Published 1 Jul 2013 · NVD
  46. Medium 6.5

    CVE-2012-6144 · TYPO3

    SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to execute arbitrary SQL commands via unspecified vectors.

    Published 1 Jul 2013 · NVD
  47. Medium 6.5

    CVE-2013-4604 · Fortinet FortiOS

    Fortinet FortiOS before 5.0.3 on FortiGate devices does not properly restrict Guest capabilities, which allows remote authenticated users to read, modify, or delete the records of arbitrary users by leveraging the Guest role.

    Published 25 Jun 2013 · NVD
  48. Medium 4.3

    CVE-2013-4636 · PHP

    The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via an MP3 file that triggers incorrect MIME type detection during access to an finfo object.

    Published 21 Jun 2013 · NVD
  49. Medium 5.0

    CVE-2013-4635 · PHP

    Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.

    Published 21 Jun 2013 · NVD
  50. Medium 5.0

    CVE-2013-2110 · PHP

    Heap-based buffer overflow in the php_quot_print_encode function in ext/standard/quot_print.c in PHP before 5.3.26 and 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted argument to the quoted_printable_encode function.

    Published 21 Jun 2013 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.