UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,047
Published in 7 days
1,084
Critical in 30 days
353
Actively exploited
423

Latest vulnerabilities

40,047 vulnerabilities
  1. Low 3.5

    CVE-2012-5339 · phpMyAdmin

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger.

    Published 25 Oct 2012 · NVD
  2. High 10.0

    CVE-2012-3506 · Apache OFBiz

    Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors.

    Published 25 Oct 2012 · NVD
  3. Medium 4.3

    CVE-2012-5455 · Joomla!

    Cross-site scripting (XSS) vulnerability in the language search component in Joomla! before 3.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "typographical error."

    Published 22 Oct 2012 · NVD
  4. Unrated

    WPV-e9e05c7525f4 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 19 Oct 2012 · Fixed in 3.3.7 · WPVulnerability
  5. Unrated

    WPV-770fdeed1770 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 19 Oct 2012 · Fixed in 3.3.7 · WPVulnerability
  6. Unrated

    WPV-84aabc395e2b · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Published 18 Oct 2012 · Fixed in 3.3.6 · WPVulnerability
  7. Low 3.5

    CVE-2012-3197 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Replication.

    Published 17 Oct 2012 · Fixed in 5.1.66, 5.5.27 · NVD
  8. Medium 4.0

    CVE-2012-3180 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

    Published 17 Oct 2012 · Fixed in 5.1.66, 5.5.28 · NVD
  9. Medium 6.8

    CVE-2012-3177 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server.

    Published 17 Oct 2012 · Fixed in 5.1.66, 5.5.27 · NVD
  10. Medium 4.0

    CVE-2012-3173 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.63 and earlier, and 5.5.25 and earlier, allows remote authenticated users to affect availability via unknown vectors related to InnoDB Plugin.

    Published 17 Oct 2012 · Fixed in 5.1.66, 5.5.27 · NVD
  11. Low 3.5

    CVE-2012-3167 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.63 and earlier, and 5.5.25 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Full Text Search.

    Published 17 Oct 2012 · Fixed in 5.1.66, 5.5.27 · NVD
  12. Medium 4.0

    CVE-2012-3166 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.63 and earlier, and 5.5.25 and earlier, allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

    Published 17 Oct 2012 · Fixed in 5.1.66, 5.5.27 · NVD
  13. High 9.0

    CVE-2012-3163 · F5 BIG-IP, MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Information Schema.

    Published 17 Oct 2012 · Fixed in 5.1.66, 5.5.27 · NVD
  14. Low 2.1

    CVE-2012-3160 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows local users to affect confidentiality via unknown vectors related to Server Installation.

    Published 16 Oct 2012 · Fixed in 5.1.66, 5.5.28 · NVD
  15. High 7.5

    CVE-2012-3158 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Protocol.

    Published 16 Oct 2012 · Fixed in 5.1.66, 5.5.27 · NVD
  16. Low 3.5

    CVE-2012-3156 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server.

    Published 16 Oct 2012 · NVD
  17. Medium 4.0

    CVE-2012-3150 · MariaDB, MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

    Published 16 Oct 2012 · Fixed in 5.1.66, 5.5.27 · NVD
  18. Low 3.5

    CVE-2012-3149 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.26 and earlier allows remote authenticated users to affect confidentiality, related to MySQL Client.

    Published 16 Oct 2012 · NVD
  19. Medium 6.4

    CVE-2012-3147 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.26 and earlier allows remote attackers to affect integrity and availability, related to MySQL Client.

    Published 16 Oct 2012 · NVD
  20. Medium 4.0

    CVE-2012-3144 · MySQL

    Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server.

    Published 16 Oct 2012 · NVD
  21. High 7.6

    CVE-2012-5089 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JMX, a different vulnerability than CVE-2012-3143.

    Published 16 Oct 2012 · NVD
  22. High 10.0

    CVE-2012-5088 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

    Published 16 Oct 2012 · NVD
  23. High 10.0

    CVE-2012-5087 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans.

    Published 16 Oct 2012 · NVD
  24. High 10.0

    CVE-2012-5086 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans.

    Published 16 Oct 2012 · NVD
  25. Low

    CVE-2012-5085 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote authenticated users to have an unspecified impact via unknown vectors related to Networking. NOTE: the Oracle CPU states that this issue has a 0.0 CVSS score. If so, then this is not a…

    Published 16 Oct 2012 · NVD
  26. High 7.6

    CVE-2012-5084 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing.

    Published 16 Oct 2012 · NVD
  27. High 10.0

    CVE-2012-5083 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, 1.4.2_38 and earlier, and JavaFX 2.2 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

    Published 16 Oct 2012 · NVD
  28. Medium 5.0

    CVE-2012-5081 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect availability, related to JSSE.

    Published 16 Oct 2012 · NVD
  29. Medium 5.0

    CVE-2012-5079 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries, a different vulnerability than CVE-2012-5073.

    Published 16 Oct 2012 · NVD
  30. Low 2.6

    CVE-2012-5077 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Security.

    Published 16 Oct 2012 · NVD
  31. Critical 9.8Actively exploited

    CVE-2012-5076 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.

    Published 16 Oct 2012 · NVD
  32. Medium 5.0

    CVE-2012-5075 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, related to JMX.

    Published 16 Oct 2012 · NVD
  33. Medium 6.4

    CVE-2012-5074 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality and integrity, related to JAX-WS.

    Published 16 Oct 2012 · NVD
  34. Medium 5.0

    CVE-2012-5073 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries, a different vulnerability than CVE-2012-5079.

    Published 16 Oct 2012 · NVD
  35. Medium 5.0

    CVE-2012-5072 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality via unknown vectors related to Security.

    Published 16 Oct 2012 · NVD
  36. Medium 6.4

    CVE-2012-5071 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality and integrity, related to JMX.

    Published 16 Oct 2012 · NVD
  37. Medium 5.0

    CVE-2012-5070 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, related to JMX.

    Published 16 Oct 2012 · NVD
  38. Medium 5.8

    CVE-2012-5069 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Concurrency.

    Published 16 Oct 2012 · NVD
  39. High 7.5

    CVE-2012-5068 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

    Published 16 Oct 2012 · NVD
  40. Medium 5.0

    CVE-2012-5067 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Deployment.

    Published 16 Oct 2012 · NVD
  41. Medium 6.4

    CVE-2012-4416 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Hotspot.

    Published 16 Oct 2012 · NVD
  42. Low 2.6

    CVE-2012-3216 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

    Published 16 Oct 2012 · NVD
  43. High 7.5

    CVE-2012-3159 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-1533.

    Published 16 Oct 2012 · NVD
  44. High 10.0

    CVE-2012-3143 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JMX, a different vulnerability than CVE-2012-5089.

    Published 16 Oct 2012 · NVD
  45. High 10.0

    CVE-2012-1533 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-3159.

    Published 16 Oct 2012 · NVD
  46. High 10.0

    CVE-2012-1532 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier and 6 Update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 16 Oct 2012 · NVD
  47. High 10.0

    CVE-2012-1531 · Java

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier; and JavaFX 2.2 and earlier; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

    Published 16 Oct 2012 · NVD
  48. Medium 6.2

    CVE-2012-5383 · MySQL

    Untrusted search path vulnerability in the installation functionality in Oracle MySQL 5.5.28, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the "C:\MySQL\MySQL Server 5.5\bin" directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by…

    Published 11 Oct 2012 · NVD
  49. Medium 6.0

    CVE-2012-5381 · PHP

    Untrusted search path vulnerability in the installation functionality in PHP 5.3.17, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\PHP directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying…

    Published 11 Oct 2012 · NVD
  50. Medium 6.7

    CVE-2012-5380 · Ruby

    Untrusted search path vulnerability in the installation functionality in Ruby 1.9.3-p194, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\Ruby193\bin directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP…

    Published 11 Oct 2012 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.