UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,159
Published in 7 days
1,158
Critical in 30 days
353
Actively exploited
423

Latest vulnerabilities

40,159 vulnerabilities
  1. Medium 5.0

    CVE-2005-0425 · IBM WebSphere Application Server

    Unknown vulnerability in IBM Websphere Application Server 5.0, 5.1, and 6.0 when running on Windows, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via a crafted URL that causes the page to be processed by the file serving servlet instead of the JSP engine.

    Published 2 May 2005 · NVD
  2. High 7.5

    CVE-2005-0397 · ImageMagick

    Format string vulnerability in the SetImageInfo function in image.c for ImageMagick before 6.0.2.5 may allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a filename argument to convert, which may be called by other web applications.

    Published 2 May 2005 · NVD
  3. Medium 6.5

    CVE-2005-0247 · PostgreSQL

    Multiple buffer overflows in gram.y for PostgreSQL 8.0.1 and earlier may allow attackers to execute arbitrary code via (1) a large number of variables in a SQL statement being handled by the read_sql_construct function, (2) a large number of INTO variables in a SELECT statement being handled by the make_select_stmt function, (3) a large number of arbitrary variables in a SELECT statement being…

    Published 2 May 2005 · NVD
  4. Medium 5.0

    CVE-2005-0246 · PostgreSQL

    The intagg contrib module for PostgreSQL 8.0.0 and earlier allows attackers to cause a denial of service (crash) via crafted arrays.

    Published 2 May 2005 · Fixed in 7.3.9, 7.4.7, 8.0.1 · NVD
  5. Medium 6.5

    CVE-2005-0244 · PostgreSQL

    PostgreSQL 8.0.0 and earlier allows local users to bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command.

    Published 2 May 2005 · NVD
  6. Medium 4.3

    CVE-2005-0227 · PostgreSQL

    PostgreSQL (pgsql) 7.4.x, 7.2.x, and other versions allows local users to load arbitrary shared libraries and execute code via the LOAD extension.

    Published 2 May 2005 · Fixed in 7.3.9, 7.4.7, 8.0.1 · NVD
  7. High 7.5

    CVE-2005-0211 · Squid

    Buffer overflow in wccp.c in Squid 2.5 before 2.5.STABLE7 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long WCCP packet, which is processed by a recvfrom function call that uses an incorrect length parameter.

    Published 2 May 2005 · NVD
  8. High 7.5

    CVE-2005-0089 · Python

    The SimpleXMLRPCServer library module in Python 2.2, 2.3 before 2.3.5, and 2.4, when used by XML-RPC servers that use the register_instance method to register an object without a _dispatch method, allows remote attackers to read or modify globals of the associated module, and possibly execute arbitrary code, via dotted attributes.

    Published 2 May 2005 · Fixed in 2.3.5 · NVD
  9. High 7.5

    CVE-2005-0044 · Microsoft Exchange Server

    The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability."

    Published 2 May 2005 · NVD
  10. Medium 4.3

    CVE-2005-0034 · BIND 9

    An "incorrect assumption" in the authvalidated validator function in BIND 9.3.0, when DNSSEC is enabled, allows remote attackers to cause a denial of service (named server exit) via crafted DNS packets that cause an internal consistency test (self-check) to fail.

    Published 2 May 2005 · NVD
  11. Medium 5.0

    CVE-2005-0033 · BIND 9

    Buffer overflow in the code for recursion and glue fetching in BIND 8.4.4 and 8.4.5 allows remote attackers to cause a denial of service (crash) via queries that trigger the overflow in the q_usedns array that tracks nameservers and addresses.

    Published 2 May 2005 · NVD
  12. High 7.5

    CVE-2005-0005 · ImageMagick

    Heap-based buffer overflow in psd.c for ImageMagick 6.1.0, 6.1.7, and possibly earlier versions allows remote attackers to execute arbitrary code via a .PSD image file with a large number of layers.

    Published 2 May 2005 · NVD
  13. Medium 5.8

    CVE-2005-0420 · Microsoft Exchange Server

    Microsoft Outlook Web Access (OWA), when used with Exchange, allows remote attackers to redirect users to arbitrary URLs for login via a link to the owalogon.asp application.

    Published 27 Apr 2005 · NVD
  14. Medium 5.0

    CVE-2005-1275 · ImageMagick

    Heap-based buffer overflow in the ReadPNMImage function in pnm.c for ImageMagick 6.2.1 and earlier allows remote attackers to cause a denial of service (application crash) via a PNM file with a small colors value.

    Published 25 Apr 2005 · NVD
  15. Medium 5.0

    CVE-2005-1043 · PHP

    exif.c in PHP before 4.3.11 allows remote attackers to cause a denial of service (memory consumption and crash) via an EXIF header with a large IFD nesting level, which causes significant stack recursion.

    Published 14 Apr 2005 · NVD
  16. Medium 4.6

    CVE-2005-0004 · MariaDB, MySQL

    The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack on temporary files.

    Published 14 Apr 2005 · Fixed in 4.1.10, 5.0.3, 5.5.66 · NVD
  17. Medium 5.0

    CVE-2005-0761 · ImageMagick

    Unknown vulnerability in ImageMagick before 6.1.8 allows remote attackers to cause a denial of service (application crash) via a crafted PSD file.

    Published 23 Mar 2005 · NVD
  18. Medium 5.0

    CVE-2005-0759 · ImageMagick

    ImageMagick before 6.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image with an invalid tag.

    Published 23 Mar 2005 · NVD
  19. Medium 5.0

    CVE-2005-0799 · MySQL

    MySQL 4.1.9, and possibly earlier versions, allows remote attackers with certain privileges to cause a denial of service (application crash) via a use command followed by an MS-DOS device name such as (1) LPT1 or (2) PRN.

    Published 15 Mar 2005 · NVD
  20. Medium 6.8

    CVE-2004-1055 · phpMyAdmin

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PmaAbsoluteUri parameter, (2) the zero_rows parameter in read_dump.php, (3) the confirm form, or (4) an error message generated by the internal phpMyAdmin parser.

    Published 1 Mar 2005 · NVD
  21. High 10.0

    CVE-2004-0989 · libxml2

    Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function, (2) a long proxy URL containing FTP data that is not properly handled by the xmlNanoFTPScanProxy function, and other overflows related to manipulation of DNS length…

    Published 1 Mar 2005 · NVD
  22. Medium 4.3

    CVE-2005-0543 · phpMyAdmin

    Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary HTML and web script via (1) the strServer, cfg[BgcolorOne], or strServerChoice parameters in select_server.lib.php, (2) the bg_color or row_no parameters in display_tbl_links.lib.php, the left_font_family parameter in theme_left.css.php, or the right_font_family parameter in…

    Published 24 Feb 2005 · NVD
  23. High 7.5

    CVE-2005-0535 · MediaWiki

    Cross-site request forgery (CSRF) vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to perform unauthorized actions as authenticated MediaWiki users.

    Published 22 Feb 2005 · NVD
  24. Medium 5.0

    CVE-2005-0453 · lighttpd

    The buffer_urldecode function in Lighttpd 1.3.7 and earlier does not properly handle control characters, which allows remote attackers to obtain the source code for CGI and FastCGI scripts via a URL with a %00 (null) character after the file extension.

    Published 16 Feb 2005 · NVD
  25. High 10.0

    CVE-2004-0981 · ImageMagick

    Buffer overflow in the EXIF parsing routine in ImageMagick before 6.1.0 allows remote attackers to execute arbitrary code via a certain image file.

    Published 9 Feb 2005 · NVD
  26. Low 2.1

    CVE-2004-0977 · PostgreSQL

    The make_oidjoins_check script in PostgreSQL 7.4.5 and earlier allows local users to overwrite files via a symlink attack on temporary files.

    Published 9 Feb 2005 · Fixed in 7.3.8, 7.4.6 · NVD
  27. Low 2.1

    CVE-2004-0975 · OpenSSL

    The der_chop script in the openssl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems allows local users to overwrite files via a symlink attack on temporary files.

    Published 9 Feb 2005 · NVD
  28. Low 2.1

    CVE-2004-0968 · GNU C Library

    The catchsegv script in glibc 2.3.2 and earlier allows local users to overwrite files via a symlink attack on temporary files.

    Published 9 Feb 2005 · NVD
  29. Medium 6.8

    CVE-2004-0957 · MySQL

    Unknown vulnerability in MySQL 3.23.58 and earlier, when a local user has privileges for a database whose name includes a "_" (underscore), grants privileges to other databases that have similar names, which can allow the user to conduct unauthorized activities.

    Published 9 Feb 2005 · NVD
  30. Medium 5.0

    CVE-2004-0942 · Apache HTTP Server

    Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines with a large number of space characters.

    Published 9 Feb 2005 · NVD
  31. High 7.8

    CVE-2004-0940 · Apache HTTP Server

    Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.

    Published 9 Feb 2005 · NVD
  32. High 7.5

    CVE-2005-0245 · PostgreSQL

    Buffer overflow in gram.y for PostgreSQL 8.0.0 and earlier may allow attackers to execute arbitrary code via a large number of arguments to a refcursor function (gram.y), which leads to a heap-based buffer overflow, a different vulnerability than CVE-2005-0247.

    Published 1 Feb 2005 · Fixed in 7.3.10, 7.4.7 · NVD
  33. Medium 5.0

    CVE-2004-0930 · Samba

    The ms_fnmatch function in Samba 3.0.4 and 3.0.7 and possibly other versions allows remote authenticated users to cause a denial of service (CPU consumption) via a SAMBA request that contains multiple * (wildcard) characters.

    Published 27 Jan 2005 · NVD
  34. High 10.0

    CVE-2004-0882 · Samba

    Buffer overflow in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7 may allow remote attackers to execute arbitrary code via a TRANSACT2_QFILEPATHINFO request with a small "maximum data bytes" value.

    Published 27 Jan 2005 · NVD
  35. High 10.0

    CVE-2004-1154 · Samba

    Integer overflow in the Samba daemon (smbd) in Samba 2.x and 3.0.x through 3.0.9 allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a Samba request with a large number of security descriptors that triggers a heap-based buffer overflow.

    Published 10 Jan 2005 · NVD
  36. Medium 5.0

    CVE-2004-1148 · phpMyAdmin

    phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sql_localfile parameter.

    Published 10 Jan 2005 · NVD
  37. High 10.0

    CVE-2004-1147 · phpMyAdmin

    phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters.

    Published 10 Jan 2005 · NVD
  38. Medium 5.0

    CVE-2004-1135 · WS_FTP Server

    Multiple buffer overflows in WS_FTP Server 5.03 2004.10.14 allow remote attackers to cause a denial of service (service crash) via long (1) SITE, (2) XMKD, (3) MKD, and (4) RNFR commands.

    Published 10 Jan 2005 · NVD
  39. High 10.0

    CVE-2004-1065 · PHP

    Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file.

    Published 10 Jan 2005 · NVD
  40. High 10.0

    CVE-2004-1064 · PHP

    The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.

    Published 10 Jan 2005 · NVD
  41. High 10.0

    CVE-2004-1063 · PHP

    PHP 4.x to 4.3.9, and PHP 5.x to 5.0.2, when running in safe mode on a multithreaded Unix webserver, allows local users to bypass safe_mode_exec_dir restrictions and execute commands outside of the intended safe_mode_exec_dir via shell metacharacters in the current directory name. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This…

    Published 10 Jan 2005 · NVD
  42. Medium 5.0

    CVE-2004-1020 · PHP

    The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the magic_quotes_gpc mechanism. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision…

    Published 10 Jan 2005 · NVD
  43. High 10.0

    CVE-2004-1019 · PHP

    The deserialization code in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to cause a denial of service and execute arbitrary code via untrusted data to the unserialize function that may trigger "information disclosure, double-free and negative reference index array underflow" results.

    Published 10 Jan 2005 · NVD
  44. High 10.0

    CVE-2004-1018 · PHP

    Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before…

    Published 10 Jan 2005 · Fixed in 4.3.10 · NVD
  45. Medium 5.0

    CVE-2004-0956 · MySQL

    MySQL before 4.0.20 allows remote attackers to cause a denial of service (application crash) via a MATCH AGAINST query with an opening double quote but no closing double quote.

    Published 10 Jan 2005 · NVD
  46. Medium 6.8

    CVE-2004-2760 · OpenSSH

    sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess the password by observing the connection state, a different vulnerability than CVE-2003-0190. NOTE: it could be argued…

    Published 31 Dec 2004 · NVD
  47. High 9.3

    CVE-2004-2687 · Samba

    distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.

    Published 31 Dec 2004 · NVD
  48. High 7.5

    CVE-2004-2632 · phpMyAdmin

    phpMyAdmin 2.5.1 up to 2.5.7 allows remote attackers to modify configuration settings and gain unauthorized access to MySQL servers via modified $cfg['Servers'] variables.

    Published 31 Dec 2004 · NVD
  49. High 7.5

    CVE-2004-2631 · phpMyAdmin

    Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name.

    Published 31 Dec 2004 · NVD
  50. High 7.5

    CVE-2004-2630 · phpMyAdmin

    The MIME transformation system (transformations/text_plain__external.inc.php) in phpMyAdmin 2.5.0 up to 2.6.0-pl1 allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.

    Published 31 Dec 2004 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.