UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,046
Published in 7 days
1,085
Critical in 30 days
352
Actively exploited
423

Latest vulnerabilities

40,046 vulnerabilities
  1. Low 3.5

    CVE-2013-1566 · MySQL

    Unspecified vulnerability in Oracle MySQL 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

    Published 17 Apr 2013 · NVD
  2. Medium 4.0

    CVE-2013-1555 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier, and 5.5.29 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Partition.

    Published 17 Apr 2013 · Fixed in 5.5.30, 10.0.2 · NVD
  3. Medium 6.5

    CVE-2013-1552 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.

    Published 17 Apr 2013 · Fixed in 5.5.30, 10.0.2 · NVD
  4. Low 3.5

    CVE-2013-1548 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.1.63 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Types.

    Published 17 Apr 2013 · Fixed in 5.1.66, 5.5.27 · NVD
  5. Medium 4.0

    CVE-2013-1544 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language.

    Published 17 Apr 2013 · Fixed in 5.5.31, 10.0.3 · NVD
  6. Medium 4.0

    CVE-2013-1532 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Information Schema.

    Published 17 Apr 2013 · Fixed in 5.5.31, 10.0.3 · NVD
  7. Medium 6.5

    CVE-2013-1531 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Server Privileges.

    Published 17 Apr 2013 · Fixed in 5.2.14, 5.3.12, 5.5.29 · NVD
  8. Medium 4.0

    CVE-2013-1526 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.29 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Replication.

    Published 17 Apr 2013 · Fixed in 5.5.30, 10.0.2 · NVD
  9. Medium 4.6

    CVE-2013-1523 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.29 and earlier and 5.6.10 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Server Optimizer.

    Published 17 Apr 2013 · Fixed in 5.5.30, 10.0.2 · NVD
  10. Medium 6.5

    CVE-2013-1521 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Server Locking.

    Published 17 Apr 2013 · Fixed in 5.5.30, 10.0.2 · NVD
  11. Medium 4.0

    CVE-2013-1512 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.29 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language.

    Published 17 Apr 2013 · Fixed in 5.5.30, 10.0.2 · NVD
  12. Low 3.5

    CVE-2013-1511 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.30 and earlier and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

    Published 17 Apr 2013 · Fixed in 5.5.31, 10.0.3 · NVD
  13. Low 2.8

    CVE-2013-1506 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier, 5.5.29 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Locking.

    Published 17 Apr 2013 · Fixed in 5.5.30, 10.0.2 · NVD
  14. Low 1.5

    CVE-2013-1502 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL 5.5.30 and earlier and 5.6.9 and earlier allows local users to affect availability via unknown vectors related to Server Partition.

    Published 17 Apr 2013 · Fixed in 5.5.31, 10.0.3 · NVD
  15. Medium 6.1

    CVE-2013-1937 · phpMyAdmin

    Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettings[width] or (2) visualizationSettings[height] parameter. NOTE: a third party reports that this is "not exploitable.

    Published 16 Apr 2013 · NVD
  16. Medium 4.4

    CVE-2013-1920 · Xen

    Xen 4.2.x, 4.1.x, and earlier, when the hypervisor is running "under memory pressure" and the Xen Security Module (XSM) is enabled, uses the wrong ordering of operations when extending the per-domain event channel tracking table, which causes a use-after-free and allows local guest kernels to inject arbitrary events and gain privileges via unspecified vectors.

    Published 12 Apr 2013 · NVD
  17. High 7.8

    CVE-2013-1152 · Cisco ASA and Firepower Threat Defense

    Cisco Adaptive Security Appliances (ASA) devices with software 9.0 before 9.0(1.2) allow remote attackers to cause a denial of service (device reload) via a crafted field in a DNS message, aka Bug ID CSCuc80080.

    Published 11 Apr 2013 · NVD
  18. High 7.1

    CVE-2013-1151 · Cisco ASA and Firepower Threat Defense

    Cisco Adaptive Security Appliances (ASA) devices with software 7.x before 7.2(5.10), 8.0 before 8.0(5.31), 8.1 and 8.2 before 8.2(5.38), 8.3 before 8.3(2.37), 8.4 before 8.4(5), 8.5 before 8.5(1.17), 8.6 before 8.6(1.10), and 8.7 before 8.7(1.3) allow remote attackers to cause a denial of service (device reload) via a crafted certificate, aka Bug ID CSCuc72408.

    Published 11 Apr 2013 · NVD
  19. High 7.8

    CVE-2013-1150 · Cisco ASA and Firepower Threat Defense

    The authentication-proxy implementation on Cisco Adaptive Security Appliances (ASA) devices with software 7.x before 7.2(5.10), 8.0 before 8.0(5.31), 8.1 and 8.2 before 8.2(5.38), 8.3 before 8.3(2.37), 8.4 before 8.4(5.3), 8.5 and 8.6 before 8.6(1.10), 8.7 before 8.7(1.4), 9.0 before 9.0(1.1), and 9.1 before 9.1(1.2) allows remote attackers to cause a denial of service (device reload) via a…

    Published 11 Apr 2013 · NVD
  20. High 7.8

    CVE-2013-1149 · Cisco ASA and Firepower Threat Defense

    Cisco Adaptive Security Appliances (ASA) devices with software 7.x before 7.2(5.10), 8.0 before 8.0(5.28), 8.1 and 8.2 before 8.2(5.35), 8.3 before 8.3(2.34), 8.4 before 8.4(4.11), 8.6 before 8.6(1.10), and 8.7 before 8.7(1.3), and Cisco Firewall Services Module (FWSM) software 3.1 and 3.2 before 3.2(24.1) and 4.0 and 4.1 before 4.1(11.1), allow remote attackers to cause a denial of service…

    Published 11 Apr 2013 · NVD
  21. Medium 4.3

    CVE-2013-2766 · Splunk Enterprise

    Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 4.3.0 through 4.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 10 Apr 2013 · NVD
  22. Medium 5.1

    CVE-2013-1912 · HAProxy

    Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.

    Published 10 Apr 2013 · NVD
  23. High 7.5

    CVE-2013-1388 · Adobe ColdFusion

    Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to obtain administrator-console access via unknown vectors.

    Published 10 Apr 2013 · NVD
  24. High 7.5

    CVE-2013-1387 · Adobe ColdFusion

    Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to impersonate users via unknown vectors.

    Published 10 Apr 2013 · NVD
  25. Medium 5.0

    CVE-2013-1821 · Ruby

    lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.

    Published 9 Apr 2013 · NVD
  26. High 10.0

    CVE-2013-1903 · PostgreSQL

    PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 incorrectly provides the superuser password to scripts related to "graphical installers for Linux and Mac OS X," which has unspecified impact and attack vectors.

    Published 4 Apr 2013 · NVD
  27. High 10.0

    CVE-2013-1902 · PostgreSQL

    PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 generates insecure temporary files with predictable filenames, which has unspecified impact and attack vectors related to "graphical installers for Linux and Mac OS X."

    Published 4 Apr 2013 · NVD
  28. Medium 4.0

    CVE-2013-1901 · PostgreSQL

    PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the (1) pg_start_backup or (2) pg_stop_backup functions.

    Published 4 Apr 2013 · NVD
  29. High 8.5

    CVE-2013-1900 · PostgreSQL

    PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to have an unspecified impact via vectors related to the "contrib/pgcrypto functions."

    Published 4 Apr 2013 · NVD
  30. Medium 6.5

    CVE-2013-1899 · PostgreSQL

    Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a "-" (hyphen).

    Published 4 Apr 2013 · NVD
  31. Medium 4.3

    CVE-2013-2290 · HPE ArubaOS

    Cross-site scripting (XSS) vulnerability in the dashboard of the ArubaOS Administration WebUI in Aruba Networks ArubaOS 6.2.x before 6.2.0.3, 6.1.3.x before 6.1.3.7, 6.1.x-FIPS before 6.1.4.3-FIPS, and 6.1.x-AirGroup before 6.1.3.6-AirGroup, as used by Mobility Controller, allows remote wireless access points to inject arbitrary web script or HTML via a crafted SSID.

    Published 28 Mar 2013 · NVD
  32. Medium 5.0

    CVE-2013-1861 · MariaDB, MySQL

    MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature,…

    Published 28 Mar 2013 · Fixed in 5.5.32, 10.0.4 · NVD
  33. High 7.5

    CVE-2013-1492 · MySQL

    Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.30, has unspecified impact and attack vectors, a different vulnerability than CVE-2012-0553.

    Published 28 Mar 2013 · NVD
  34. High 7.5

    CVE-2012-0553 · MySQL

    Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.28, has unspecified impact and attack vectors, a different vulnerability than CVE-2013-1492.

    Published 28 Mar 2013 · NVD
  35. High 7.8

    CVE-2013-2266 · BIND 9

    libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression, as demonstrated by a memory-exhaustion attack against a machine running a named process.

    Published 28 Mar 2013 · NVD
  36. Medium 5.0

    CVE-2013-0316 · Drupal

    The Image module in Drupal 7.x before 7.20 allows remote attackers to cause a denial of service (CPU and disk space consumption) via a large number of new derivative requests.

    Published 27 Mar 2013 · NVD
  37. Medium 4.0

    CVE-2013-0454 · Samba

    The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3)…

    Published 26 Mar 2013 · NVD
  38. Medium 6.5

    CVE-2013-1836 · Moodle

    Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not properly manage privileges for WebDAV repositories, which allows remote authenticated users to read, modify, or delete arbitrary site-wide repositories by leveraging certain read access.

    Published 25 Mar 2013 · NVD
  39. Low 3.5

    CVE-2013-1835 · Moodle

    Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated administrators to obtain sensitive information from the external repositories of arbitrary users by leveraging the login_as feature.

    Published 25 Mar 2013 · NVD
  40. Medium 4.0

    CVE-2013-1834 · Moodle

    notes/edit.php in Moodle 1.9.x through 1.9.19, 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated users to reassign notes via a modified (1) userid or (2) courseid field.

    Published 25 Mar 2013 · NVD
  41. Low 3.5

    CVE-2013-1833 · Moodle

    Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.

    Published 25 Mar 2013 · NVD
  42. Medium 4.0

    CVE-2013-1832 · Moodle

    repository/webdav/lib.php in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 includes the WebDAV password in the configuration form, which allows remote authenticated administrators to obtain sensitive information by configuring an instance.

    Published 25 Mar 2013 · NVD
  43. Medium 5.0

    CVE-2013-1831 · Moodle

    lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the absolute path in an exception message.

    Published 25 Mar 2013 · NVD
  44. Medium 5.0

    CVE-2013-1830 · Moodle

    user/view.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not enforce the forceloginforprofiles setting, which allows remote attackers to obtain sensitive course-profile information by leveraging the guest role, as demonstrated by a Google search.

    Published 25 Mar 2013 · NVD
  45. Medium 4.0

    CVE-2013-1829 · Moodle

    calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions, which allows remote authenticated users to obtain potentially sensitive information by leveraging the student role.

    Published 25 Mar 2013 · NVD
  46. Medium 5.0

    CVE-2013-2633 · Matomo

    Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to obtain sensitive information by leveraging the logging of parameters.

    Published 21 Mar 2013 · NVD
  47. Medium 4.3

    CVE-2013-1844 · Matomo

    Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 21 Mar 2013 · NVD
  48. Low 1.9

    CVE-2013-1427 · lighttpd

    The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.

    Published 21 Mar 2013 · NVD
  49. Medium 6.4

    CVE-2013-1843 · TYPO3

    Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

    Published 20 Mar 2013 · NVD
  50. High 7.5

    CVE-2013-1842 · TYPO3

    SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation values."

    Published 20 Mar 2013 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.