Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 40,054
- Published in 7 days
- 1,089
- Critical in 30 days
- 353
- Actively exploited
- 423
Latest vulnerabilities
40,054 vulnerabilities- High 7.8
CVE-2008-7095 · HPE ArubaOS
The SNMP daemon in ArubaOS 3.3.2.6 in Aruba Mobility Controller does not restrict SNMP access, which allows remote attackers to (1) read all SNMP community strings via SNMP-COMMUNITY-MIB::snmpCommunityName (1.3.6.1.6.3.18.1.1.1.2) or SNMP-VIEW-BASED-ACM-MIB::vacmGroupName (1.3.6.1.6.3.16.1.2.1.3) with knowledge of one community string, and (2) read SNMPv3 user names via SNMP-USER-BASED-SM-MIB or…
Published 27 Aug 2009 · NVD - High 7.8
CVE-2009-2698 · VMware vCenter Server, VMware ESXi
The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.
Published 27 Aug 2009 · NVD - Medium 6.8
CVE-2008-7082 · MyBB
MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header.
Published 25 Aug 2009 · NVD - Medium 6.4
CVE-2008-7068 · PHP
The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte. NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file.
Published 25 Aug 2009 · NVD - High 10.0
CVE-2008-7023 · HPE ArubaOS
Aruba Mobility Controller running ArubaOS 3.3.1.16, and possibly other versions, installs the same default X.509 certificate for all installations, which allows remote attackers to bypass authentication. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation.
Published 21 Aug 2009 · NVD - High 7.2
CVE-2008-7002 · PHP
PHP 5.2.5 does not enforce (a) open_basedir and (b) safe_mode_exec_dir restrictions for certain functions, which might allow local users to bypass intended access restrictions and call programs outside of the intended directory via the (1) exec, (2) system, (3) shell_exec, (4) passthru, or (5) popen functions, possibly involving pathnames such as "C:" drive notation.
Published 19 Aug 2009 · NVD - Medium 6.4
CVE-2008-6976 · MikroTik RouterOS
MikroTik RouterOS 3.x through 3.13 and 2.x through 2.9.51 allows remote attackers to modify Network Management System (NMS) settings via a crafted SNMP set request.
Published 19 Aug 2009 · NVD - Medium 5.8
CVE-2009-1878 · Adobe ColdFusion
Session fixation vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
Published 18 Aug 2009 · NVD - Medium 4.3
CVE-2009-1877 · Adobe ColdFusion
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1875.
Published 18 Aug 2009 · NVD - Medium 5.0
CVE-2009-1876 · Adobe ColdFusion
Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspecified vectors, related to a "double-encoded null character vulnerability."
Published 18 Aug 2009 · NVD - Medium 4.3
CVE-2009-1875 · Adobe ColdFusion
Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1877.
Published 18 Aug 2009 · NVD - Medium 4.3
CVE-2009-1872 · Adobe ColdFusion
Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to (2) wizards/common/_logintowizard.cfm, (3) wizards/common/_authenticatewizarduser.cfm, or (4) administrator/enter.cfm.
Published 18 Aug 2009 · NVD - Medium 5.0
CVE-2009-2855 · Squid
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.
Published 18 Aug 2009 · NVD - Medium 6.4
CVE-2009-2854 · WordPress
Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to (1) edit-comments.php, (2) edit-pages.php, (3) edit.php, (4) edit-category-form.php, (5) edit-link-category-form.php, (6) edit-tag-form.php, (7) export.php, (8) import.php, or (9) link-add.php in wp-admin/.
Published 18 Aug 2009 · NVD - High 10.0
CVE-2009-2853 · WordPress
Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-form-comment.php, (5) edit-link-category-form.php, (6) edit-link-form.php, (7) edit-page-form.php, and (8) edit-tag-form.php in wp-admin/.
Published 18 Aug 2009 · NVD - Medium 4.3
CVE-2009-2851 · WordPress
Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via a comment author URL.
Published 18 Aug 2009 · NVD - High 7.5
CVE-2009-2092 · IBM WebSphere Application Server
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 does not properly read the portletServingEnabled parameter in ibm-portlet-ext.xmi, which allows remote attackers to bypass intended access restrictions via unknown vectors.
Published 13 Aug 2009 · NVD - Medium 5.0
CVE-2009-2091 · IBM WebSphere Application Server
The System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 on z/OS uses weak file permissions for new applications, which allows remote attackers to obtain sensitive information via unspecified vectors.
Published 13 Aug 2009 · NVD - Medium 5.0
CVE-2009-2090 · IBM WebSphere Application Server
Unspecified vulnerability in wsadmin in the System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 allows remote attackers to bypass intended Java Management Extensions (JMX) Management Beans (aka MBeans) access restrictions, and cause a denial of service (daemon stop), via unknown vectors.
Published 13 Aug 2009 · NVD - Low 2.1
CVE-2009-2089 · IBM WebSphere Application Server
The Migration component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when tracing is enabled and a 6.1 to 7.0 migration has occurred, allows remote authenticated users to obtain sensitive information by reading a Migration Trace file.
Published 13 Aug 2009 · NVD - High 7.5
CVE-2009-2088 · IBM WebSphere Application Server
The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when SPNEGO Single Sign-on (SSO) and disableSecurityPreInvokeOnFilters are configured, allows remote attackers to bypass authentication via a request for a "secure URL," related to a certain invokefilterscompatibility property.
Published 13 Aug 2009 · NVD - Low 2.1
CVE-2009-2087 · IBM WebSphere Application Server
The Web Services functionality in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, in certain circumstances involving the ibm-webservicesclient-bind.xmi file and custom password encryption, uses weak password obfuscation, which allows local users to cause a denial of service (deployment failure) via unspecified vectors.
Published 13 Aug 2009 · NVD - High 7.5
CVE-2009-2085 · IBM WebSphere Application Server
The Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 does not properly handle use of Identity Assertion with CSIv2 Security, which allows remote attackers to bypass intended CSIv2 access restrictions via vectors involving Enterprise JavaBeans (EJB).
Published 13 Aug 2009 · NVD - Medium 6.5
CVE-2009-0906 · IBM WebSphere Application Server
The Service Component Architecture (SCA) feature pack for IBM WebSphere Application Server (WAS) SCA 1.0 before 1.0.0.3 allows remote authenticated users to bypass intended authentication.transport access restrictions and obtain unspecified access via unknown vectors.
Published 13 Aug 2009 · NVD - High 7.5
CVE-2009-2762 · WordPress
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
Published 13 Aug 2009 · NVD - Medium 6.5
CVE-2009-2416 · VMware vCenter Server, libxml2, VMware ESXi
Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.
Published 11 Aug 2009 · NVD - Medium 4.3
CVE-2009-2414 · libxml2
Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD, related to a function recursion, as demonstrated by the Codenomicon XML fuzzing framework.
Published 11 Aug 2009 · NVD - Medium 4.3
CVE-2008-6927 · cPanel & WHM
Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allow remote attackers to inject arbitrary web script or HTML via the (1) localapp, (2) updatedir, (3) scriptpath_show, (4) domain_show, (5) thispage, (6) thisapp, and (7) currentversion parameters in an Upgrade action.
Published 10 Aug 2009 · NVD - Medium 5.0
CVE-2009-2625 · Java
XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.
Published 6 Aug 2009 · NVD - Medium 4.3
CVE-2009-2687 · PHP
The exif_read_data function in the Exif module in PHP before 5.2.10 allows remote attackers to cause a denial of service (crash) via a malformed JPEG image with invalid offset fields, a different issue than CVE-2005-3353.
Published 5 Aug 2009 · Fixed in 5.2.10 · NVD - Medium 5.1
CVE-2009-2409 · OpenSSL
The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because…
Published 30 Jul 2009 · NVD - Medium 4.3
CVE-2009-0696 · BIND 9
The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted dynamic update message.
Published 29 Jul 2009 · NVD - Medium 5.0
CVE-2009-2622 · Squid
Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) "missing or mismatched protocol identifier," (2) missing or negative status value," (3) "missing version," or (4) "missing or invalid status number," related to (a) HttpMsg.cc and (b) HttpReply.cc.
Published 28 Jul 2009 · NVD - Medium 5.0
CVE-2009-2621 · Squid
Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 does not properly enforce "buffer limits and related bound checks," which allows remote attackers to cause a denial of service via (1) an incomplete request or (2) a request with a large header size, related to (a) HttpMsg.cc and (b) client_side.cc.
Published 28 Jul 2009 · NVD - Low 2.6
CVE-2009-2492 · Movable Type
Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in Six Apart Movable Type before 4.261 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-2480.
Published 17 Jul 2009 · NVD - Medium 5.8
CVE-2009-2481 · Movable Type
mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not initialized, allows remote attackers to bypass access restrictions and (1) send e-mail to arbitrary addresses or (2) obtain sensitive information via unspecified vectors.
Published 16 Jul 2009 · NVD - Medium 5.0
CVE-2009-0217 · IBM WebSphere Application Server
The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before…
Published 14 Jul 2009 · NVD - High 8.5
CVE-2009-2446 · MySQL
Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in a database name in a (1) COM_CREATE_DB or (2) COM_DROP_DB request. NOTE: some of these details are obtained…
Published 13 Jul 2009 · NVD - Medium 5.0
CVE-2009-2432 · WordPress
WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an error message.
Published 10 Jul 2009 · NVD - Medium 5.0
CVE-2009-2431 · WordPress
WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source.
Published 10 Jul 2009 · NVD - Medium 5.0
CVE-2009-2336 · WordPress
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
Published 10 Jul 2009 · Fixed in 2.8.1 · NVD - Medium 5.0
CVE-2009-2335 · WordPress
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
Published 10 Jul 2009 · Fixed in 2.8.1 · NVD - Medium 4.9
CVE-2009-2334 · WordPress
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3)…
Published 10 Jul 2009 · NVD - High 7.1
CVE-2009-1891 · Apache HTTP Server
The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
Published 10 Jul 2009 · Fixed in 2.0.64, 2.2.12 · NVD - Medium 4.3
CVE-2009-2374 · Drupal
Drupal 5.x before 5.19 and 6.x before 6.13 does not properly sanitize failed login attempts for pages that contain a sortable table, which includes the username and password in links that can be read from (1) the HTTP referer header of external web sites that are visited from those links or (2) when page caching is enabled, the Drupal page cache.
Published 8 Jul 2009 · Fixed in 5.19, 6.13 · NVD - Medium 4.3
CVE-2009-2373 · Drupal
Cross-site scripting (XSS) vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published 8 Jul 2009 · NVD - Medium 6.5
CVE-2009-2372 · Drupal
Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature.
Published 8 Jul 2009 · Fixed in 6.13 · NVD - High 7.5
CVE-2008-6852 · Joomla!
SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
Published 7 Jul 2009 · NVD - High 7.1
CVE-2009-1890 · Apache HTTP Server
The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
Published 5 Jul 2009 · Fixed in 2.2.12 · NVD - Medium 6.4
CVE-2009-0904 · IBM WebSphere Application Server
The IBM Stax XMLStreamWriter in the Web Services component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 does not properly process XML encoding, which allows remote attackers to bypass intended access restrictions and possibly modify data via "XML fuzzing attacks" sent through SOAP requests.
Published 5 Jul 2009 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.