UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,159
Published in 7 days
1,158
Critical in 30 days
351
Actively exploited
423

Latest vulnerabilities

40,159 vulnerabilities
  1. Medium 6.4

    CVE-2003-0192 · Apache HTTP Server

    Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one," which could cause Apache to use the weak ciphersuite.

    Published 18 Aug 2003 · NVD
  2. Medium 4.3

    CVE-2003-0442 · PHP

    Cross-site scripting (XSS) vulnerability in the transparent SID support capability for PHP before 4.3.2 (session.use_trans_sid) allows remote attackers to insert arbitrary script via the PHPSESSID parameter.

    Published 24 Jul 2003 · NVD
  3. High 7.5

    CVE-2003-0386 · OpenSSH

    OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass "from=" and "user@host" address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address.

    Published 2 Jul 2003 · NVD
  4. Medium 5.0

    CVE-2003-0245 · Apache HTTP Server

    Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors.

    Published 9 Jun 2003 · NVD
  5. Medium 5.0

    CVE-2003-0226 · Microsoft IIS

    Microsoft Internet Information Services (IIS) 5.0 and 5.1 allows remote attackers to cause a denial of service via a long WebDAV request with a (1) PROPFIND or (2) SEARCH method, which generates an error condition that is not properly handled.

    Published 9 Jun 2003 · NVD
  6. Medium 5.0

    CVE-2003-0225 · Microsoft IIS

    The ASP function Response.AddHeader in Microsoft Internet Information Server (IIS) 4.0 and 5.0 does not limit memory requests when constructing headers, which allow remote attackers to generate a large header to cause a denial of service (memory consumption) with an ASP page.

    Published 9 Jun 2003 · NVD
  7. High 10.0

    CVE-2003-0224 · Microsoft IIS

    Buffer overflow in ssinc.dll for Microsoft Internet Information Services (IIS) 5.0 allows local users to execute arbitrary code via a web page with a Server Side Include (SSI) directive with a long filename, aka "Server Side Include Web Pages Buffer Overrun."

    Published 9 Jun 2003 · NVD
  8. Medium 6.8

    CVE-2003-0223 · Microsoft IIS

    Cross-site scripting vulnerability (XSS) in the ASP function responsible for redirection in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to embed a URL containing script in a redirection message.

    Published 9 Jun 2003 · NVD
  9. Medium 5.0

    CVE-2003-0189 · Apache HTTP Server

    The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.

    Published 9 Jun 2003 · NVD
  10. Medium 5.0

    CVE-2003-0190 · OpenSSH

    OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.

    Published 12 May 2003 · Fixed in 3.6.1 · NVD
  11. High 10.0

    CVE-2003-0201 · Samba

    Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.

    Published 5 May 2003 · NVD
  12. High 10.0

    CVE-2003-0196 · Samba

    Multiple buffer overflows in Samba before 2.2.8a may allow remote attackers to execute arbitrary code or cause a denial of service, as discovered by the Samba team and a different vulnerability than CVE-2003-0201.

    Published 5 May 2003 · NVD
  13. Medium 5.0

    CVE-2003-0134 · Apache HTTP Server

    Unknown vulnerability in filestat.c for Apache running on OS2, versions 2.0 through 2.0.45, allows unknown attackers to cause a denial of service via requests related to device names.

    Published 11 Apr 2003 · NVD
  14. Medium 5.0

    CVE-2003-0132 · Apache HTTP Server

    A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.

    Published 11 Apr 2003 · NVD
  15. High 7.5

    CVE-2003-0172 · PHP

    Buffer overflow in openlog function for PHP 4.3.1 on Windows operating system, and possibly other OSes, allows remote attackers to cause a crash and possibly execute arbitrary code via a long filename argument.

    Published 2 Apr 2003 · NVD
  16. High 7.5

    CVE-2003-0166 · PHP

    Integer signedness error in emalloc() function for PHP before 4.3.2 allow remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via negative arguments to functions such as (1) socket_recv, (2) socket_recvfrom, and possibly other functions.

    Published 2 Apr 2003 · NVD
  17. Medium 5.0

    CVE-2003-0083 · Apache HTTP Server

    Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CVE-2003-0020.

    Published 2 Apr 2003 · Fixed in 1.3.26, 2.0.46 · NVD
  18. Medium 5.0

    CVE-2003-0147 · OpenSSL

    OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal).

    Published 31 Mar 2003 · NVD
  19. Low 1.2

    CVE-2003-0086 · Samba

    The code for writing reg files in Samba before 2.2.8 allows local users to overwrite arbitrary files via a race condition involving chown.

    Published 31 Mar 2003 · NVD
  20. High 10.0

    CVE-2003-0085 · Samba

    Buffer overflow in the SMB/CIFS packet fragment re-assembly code for SMB daemon (smbd) in Samba before 2.2.8, and Samba-TNG before 0.3.1, allows remote attackers to execute arbitrary code.

    Published 31 Mar 2003 · NVD
  21. High 7.5

    CVE-2003-0028 · GNU C Library

    Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.

    Published 25 Mar 2003 · NVD
  22. High 9.0

    CVE-2003-0150 · MySQL

    MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator to overwrite a configuration file and cause mysql to run as root upon restart, as demonstrated by modifying my.cnf.

    Published 24 Mar 2003 · NVD
  23. High 7.5

    CVE-2003-0131 · OpenSSL

    The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the…

    Published 24 Mar 2003 · NVD
  24. Medium 5.0

    CVE-2003-0020 · Apache HTTP Server

    Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.

    Published 18 Mar 2003 · Fixed in 1.3.31, 2.0.49 · NVD
  25. High 10.0

    CVE-2003-0101 · Webmin

    miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges.

    Published 3 Mar 2003 · NVD
  26. High 7.5

    CVE-2003-0097 · PHP

    Unknown vulnerability in CGI module for PHP 4.3.0 allows attackers to access arbitrary files as the PHP user, and possibly execute PHP code, by bypassing the CGI force redirect settings (cgi.force_redirect or --enable-force-cgi-redirect).

    Published 3 Mar 2003 · NVD
  27. Medium 5.0

    CVE-2003-0078 · OpenSSL

    ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original…

    Published 3 Mar 2003 · Fixed in 0.9.6i · NVD
  28. Medium 5.0

    CVE-2003-0073 · MySQL

    Double-free vulnerability in mysqld for MySQL before 3.23.55 allows attackers with MySQL access to cause a denial of service (crash) via mysql_change_user.

    Published 19 Feb 2003 · NVD
  29. Medium 5.0

    CVE-2003-0045 · Apache Tomcat

    Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

    Published 7 Feb 2003 · NVD
  30. Medium 6.8

    CVE-2003-0044 · Apache Tomcat

    Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

    Published 7 Feb 2003 · NVD
  31. Medium 5.0

    CVE-2003-0043 · Apache Tomcat

    Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

    Published 7 Feb 2003 · NVD
  32. Medium 5.0

    CVE-2003-0042 · Apache Tomcat

    Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

    Published 7 Feb 2003 · NVD
  33. Medium 5.0

    CVE-2003-0017 · Apache HTTP Server

    Apache 2.0 before 2.0.44 on Windows platforms allows remote attackers to obtain certain files via an HTTP request that ends in certain illegal characters such as ">", which causes a different filename to be processed and served.

    Published 7 Feb 2003 · NVD
  34. High 7.5

    CVE-2003-0016 · Apache HTTP Server

    Apache before 2.0.44, when running on unpatched Windows 9x and Me operating systems, allows remote attackers to cause a denial of service or execute arbitrary code via an HTTP request containing MS-DOS device names.

    Published 7 Feb 2003 · NVD
  35. Medium 4.6

    CVE-2002-1402 · PostgreSQL

    Buffer overflows in the (1) TZ and (2) SET TIME ZONE enivronment variables for PostgreSQL 7.2.1 and earlier allow local users to cause a denial of service and possibly execute arbitrary code.

    Published 17 Jan 2003 · NVD
  36. Medium 6.5

    CVE-2002-1401 · PostgreSQL

    Buffer overflows in (1) circle_poly, (2) path_encode and (3) path_add (also incorrectly identified as path_addr) for PostgreSQL 7.2.3 and earlier allow attackers to cause a denial of service and possibly execute arbitrary code, possibly as a result of an integer overflow.

    Published 17 Jan 2003 · NVD
  37. High 7.5

    CVE-2002-1400 · PostgreSQL

    Heap-based buffer overflow in the repeat() function for PostgreSQL before 7.2.2 allows attackers to execute arbitrary code by causing repeat() to generate a large string.

    Published 17 Jan 2003 · NVD
  38. High 10.0

    CVE-2002-1399 · PostgreSQL

    Unknown vulnerability in cash_out and possibly other functions in PostgreSQL 7.2.1 and earlier, and possibly later versions before 7.2.3, with unknown impact, based on an invalid integer input which is processed as a different data type, as demonstrated using cash_out(2).

    Published 17 Jan 2003 · NVD
  39. Medium 4.6

    CVE-2002-1398 · PostgreSQL

    Buffer overflow in the date parser for PostgreSQL before 7.2.2 allows attackers to cause a denial of service and possibly execute arbitrary code via a long date string, aka a vulnerability "in handling long datetime input."

    Published 17 Jan 2003 · NVD
  40. High 7.5

    CVE-2002-1397 · PostgreSQL

    Vulnerability in the cash_words() function for PostgreSQL 7.2 and earlier allows local users to cause a denial of service and possibly execute arbitrary code via a large negative argument, possibly triggering an integer signedness error or buffer overflow.

    Published 17 Jan 2003 · NVD
  41. High 7.5

    CVE-2002-1396 · PHP

    Heap-based buffer overflow in the wordwrap function in PHP after 4.1.2 and before 4.3.0 may allow attackers to cause a denial of service or execute arbitrary code.

    Published 17 Jan 2003 · NVD
  42. High 7.5

    CVE-2002-1394 · Apache Tomcat

    Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.

    Published 17 Jan 2003 · NVD
  43. High 9.3

    CVE-2002-2360 · Webmin

    The RPC module in Webmin 0.21 through 0.99, when installed without root or admin privileges, allows remote attackers to read and write to arbitrary files and execute arbitrary commands via remote_foreign_require and remote_foreign_call requests.

    Published 31 Dec 2002 · NVD
  44. Medium 5.0

    CVE-2002-2346 · phpBB

    phpBB 2.0 through 2.0.3 generates names for uploaded avatar files with the hex-encoded IP address of the client system, which allows remote attackers to obtain client IP addresses.

    Published 31 Dec 2002 · NVD
  45. High 7.8

    CVE-2002-2309 · PHP

    php.exe in PHP 3.0 through 4.2.2, when running on Apache, does not terminate properly, which allows remote attackers to cause a denial of service via a direct request without arguments.

    Published 31 Dec 2002 · NVD
  46. High 7.8

    CVE-2002-2272 · Apache HTTP Server, Apache Tomcat

    Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.

    Published 31 Dec 2002 · NVD
  47. Medium 4.3

    CVE-2002-2255 · phpBB

    Cross-site scripting (XSS) vulnerability in search.php in phpBB 2.0.3 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via the search_username parameter in searchuser mode.

    Published 31 Dec 2002 · NVD
  48. Medium 5.0

    CVE-2002-2215 · PHP

    The imap_header function in the IMAP functionality for PHP before 4.3.0 allows remote attackers to cause a denial of service via an e-mail message with a large number of "To" addresses, which triggers an error in the rfc822_write_address function.

    Published 31 Dec 2002 · NVD
  49. Medium 5.0

    CVE-2002-2214 · PHP

    The php_if_imap_mime_header_decode function in the IMAP functionality in PHP before 4.2.2 allows remote attackers to cause a denial of service (crash) via an e-mail header with a long "To" header.

    Published 31 Dec 2002 · NVD
  50. Medium 5.0

    CVE-2002-2213 · BIND 9

    The DNS resolver in unspecified versions of Infoblox DNS One, when resolving recursive DNS queries for arbitrary hosts, allows remote attackers to conduct DNS cache poisoning via a birthday attack that uses a large number of open queries for the same resource record (RR) combined with spoofed responses, which increases the possibility of successfully spoofing a response in a way that is more…

    Published 31 Dec 2002 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.