UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,159
Published in 7 days
1,156
Critical in 30 days
351
Actively exploited
423

Latest vulnerabilities

40,159 vulnerabilities
  1. Medium 5.0

    CVE-2001-0543 · Microsoft Exchange Server

    Memory leak in NNTP service in Windows NT 4.0 and Windows 2000 allows remote attackers to cause a denial of service (memory exhaustion) via a large number of malformed posts.

    Published 20 Sept 2001 · NVD
  2. Medium 5.0

    CVE-2001-0509 · Microsoft Exchange Server

    Vulnerabilities in RPC servers in (1) Microsoft Exchange Server 2000 and earlier, (2) Microsoft SQL Server 2000 and earlier, (3) Windows NT 4.0, and (4) Windows 2000 allow remote attackers to cause a denial of service via malformed inputs.

    Published 20 Sept 2001 · NVD
  3. Medium 5.0

    CVE-2001-0508 · Microsoft IIS

    Vulnerability in IIS 5.0 allows remote attackers to cause a denial of service (restart) via a long, invalid WebDAV request.

    Published 20 Sept 2001 · NVD
  4. High 7.2

    CVE-2001-0507 · Microsoft IIS

    IIS 5.0 uses relative paths to find system files that will run in-process, which allows local users to gain privileges via a Trojan horse file, aka the "System file listing privilege elevation" vulnerability.

    Published 20 Sept 2001 · NVD
  5. High 7.2

    CVE-2001-0506 · Microsoft IIS

    Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename, which triggers the overflow when the directory name is added, aka the "SSI privilege elevation" vulnerability.

    Published 20 Sept 2001 · NVD
  6. High 7.5

    CVE-2001-0962 · IBM WebSphere Application Server

    IBM WebSphere Application Server 3.02 through 3.53 uses predictable session IDs for cookies, which allows remote attackers to gain privileges of WebSphere users via brute force guessing.

    Published 19 Sept 2001 · NVD
  7. Medium 5.0

    CVE-2001-1072 · Apache HTTP Server

    Apache with mod_rewrite enabled on most UNIX systems allows remote attackers to bypass RewriteRules by inserting extra / (slash) characters into the requested path, which causes the regular expression in the RewriteRule to fail.

    Published 31 Aug 2001 · NVD
  8. Medium 4.6

    CVE-2000-1199 · PostgreSQL

    PostgreSQL stores usernames and passwords in plaintext in (1) pg_shadow and (2) pg_pwd, which allows attackers with sufficient privileges to gain access to databases.

    Published 31 Aug 2001 · NVD
  9. High 7.5

    CVE-2001-0572 · OpenSSH

    The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: (1) password lengths or ranges of lengths, which simplifies brute force password guessing, (2) whether RSA or DSA authentication is being used, (3) the number of authorized_keys in RSA authentication, or (4)…

    Published 22 Aug 2001 · NVD
  10. High 7.2

    CVE-2001-0529 · OpenSSH

    OpenSSH version 2.9 and earlier, with X forwarding enabled, allows a local attacker to delete any file named 'cookies' via a symlink attack.

    Published 14 Aug 2001 · NVD
  11. Medium 5.0

    CVE-2001-0590 · Apache Tomcat

    Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

    Published 2 Aug 2001 · NVD
  12. High 8.8

    CVE-2001-1471 · phpBB

    prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock in prefs.php or (2) $l_privnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.

    Published 31 Jul 2001 · NVD
  13. High 7.5

    CVE-2001-1060 · phpMyAdmin

    phpMyAdmin 2.2.0rc3 and earlier allows remote attackers to execute arbitrary commands by inserting them into (1) the strCopyTableOK argument in tbl_copy.php, or (2) the strRenameTableOK argument in tbl_rename.php.

    Published 31 Jul 2001 · NVD
  14. High 7.5

    CVE-2001-1021 · WS_FTP Server

    Buffer overflows in WS_FTP 2.02 allow remote attackers to execute arbitrary code via long arguments to (1) DELE, (2) MDTM, (3) MLST, (4) MKD, (5) RMD, (6) RNFR, (7) RNTO, (8) SIZE, (9) STAT, (10) XMKD, or (11) XRMD.

    Published 26 Jul 2001 · NVD
  15. High 7.8

    CVE-2001-0497 · BIND 9

    dnskeygen in BIND 8.2.4 and earlier, and dnssec-keygen in BIND 9.1.2 and earlier, set insecure permissions for a HMAC-MD5 shared secret key file used for DNS Transactional Signatures (TSIG), which allows attackers to obtain the keys and perform dynamic DNS updates.

    Published 21 Jul 2001 · NVD
  16. High 7.5

    CVE-2001-0340 · Microsoft Exchange Server

    An interaction between the Outlook Web Access (OWA) service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious script code against a user's mailbox via a message attachment that contains HTML code, which is executed automatically.

    Published 21 Jul 2001 · NVD
  17. Medium 5.0

    CVE-2001-1319 · Microsoft Exchange Server

    Microsoft Exchange 5.5 2000 allows remote attackers to cause a denial of service (hang) via exceptional BER encodings for the LDAP filter type field, as demonstrated by the PROTOS LDAPv3 test suite.

    Published 16 Jul 2001 · NVD
  18. Medium 5.0

    CVE-2001-1141 · OpenSSL

    The Pseudo-Random Number Generator (PRNG) in SSLeay and OpenSSL before 0.9.6b allows attackers to use the output of small PRNG requests to determine the internal state information, which could be used by attackers to predict future pseudo-random numbers.

    Published 10 Jul 2001 · NVD
  19. Medium 5.0

    CVE-2001-1243 · Microsoft IIS

    Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or (2) remotely injecting the device name into ASP programs that internally use Scripting.FileSystemObject.

    Published 4 Jul 2001 · NVD
  20. Low 2.1

    CVE-2001-0406 · Samba

    Samba before 2.2.0 allows local attackers to overwrite arbitrary files via a symlink attack using (1) a printer queue query, (2) the more command in smbclient, or (3) the mput command in smbclient.

    Published 2 Jul 2001 · NVD
  21. Medium 5.0

    CVE-2001-0390 · IBM WebSphere Application Server

    IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to cause a denial of service by directly calling the macro.d2w macro with a long string of %0a characters.

    Published 2 Jul 2001 · NVD
  22. Medium 5.0

    CVE-2001-0389 · IBM WebSphere Application Server

    IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to determine the real path of the server by directly calling the macro.d2w macro with a NOEXISTINGHTMLBLOCK argument.

    Published 2 Jul 2001 · NVD
  23. High 7.5

    CVE-2001-1246 · PHP

    PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.

    Published 30 Jun 2001 · NVD
  24. High 7.5

    CVE-2001-0478 · phpMyAdmin

    Directory traversal vulnerability in phpMyAdmin 2.2.0 and earlier versions allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script.

    Published 27 Jun 2001 · NVD
  25. Medium 4.6

    CVE-2001-0407 · MySQL

    Directory traversal vulnerability in MySQL before 3.23.36 allows local users to modify arbitrary files and gain privileges by creating a database whose name starts with .. (dot dot).

    Published 27 Jun 2001 · NVD
  26. Medium 4.0

    CVE-2001-0361 · OpenSSH

    Implementations of SSH version 1.5, including (1) OpenSSH up to version 2.3.0, (2) AppGate, and (3) ssh-1 up to version 1.2.31, in certain configurations, allow a remote attacker to decrypt and/or alter traffic via a "Bleichenbacher attack" on PKCS#1 version 1.5.

    Published 27 Jun 2001 · NVD
  27. High 10.0

    CVE-2001-1162 · Samba

    Directory traversal vulnerability in the %m macro in the smb.conf configuration file in Samba before 2.2.0a allows remote attackers to overwrite certain files via a .. in a NETBIOS name, which is used as the name for a .log file.

    Published 23 Jun 2001 · NVD
  28. High 7.5

    CVE-2001-1459 · OpenSSH

    OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module (PAM) session if commands are executed with no pty, which allows local users to bypass resource limits (rlimits) set in pam.d.

    Published 19 Jun 2001 · NVD
  29. Medium 5.0

    CVE-2001-0151 · Microsoft IIS

    IIS 5.0 allows remote attackers to cause a denial of service via a series of malformed WebDAV requests.

    Published 2 Jun 2001 · NVD
  30. Medium 5.0

    CVE-2001-0146 · Microsoft Exchange Server, Microsoft IIS

    IIS 5.0 and Microsoft Exchange 2000 allow remote attackers to cause a denial of service (memory allocation error) by repeatedly sending a series of specially formatted URL's.

    Published 2 Jun 2001 · NVD
  31. High 7.2

    CVE-2001-1074 · Webmin

    Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to all CGI programs and allows local users to gain privileges.

    Published 28 May 2001 · NVD
  32. Medium 5.0

    CVE-2001-1342 · Apache HTTP Server

    Apache before 1.3.20 on Windows and OS/2 systems allows remote attackers to cause a denial of service (GPF) via an HTTP request for a URI that contains a large number of / (slash) or other characters, which causes certain functions to dereference a null pointer.

    Published 12 May 2001 · NVD
  33. Low 1.2

    CVE-2001-0222 · Webmin

    webmin 0.84 and earlier allows local users to overwrite and create arbitrary files via a symlink attack.

    Published 26 Mar 2001 · NVD
  34. Medium 5.0

    CVE-2001-0122 · IBM WebSphere Application Server

    Kernel leak in AfpaCache module of the Fast Response Cache Accelerator (FRCA) component of IBM HTTP Server 1.3.x and Websphere 3.52 allows remote attackers to cause a denial of service via a series of malformed HTTP requests that generate a "bad request" error.

    Published 13 Mar 2001 · NVD
  35. Medium 5.0

    CVE-2001-0925 · Apache HTTP Server

    The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.

    Published 12 Mar 2001 · NVD
  36. High 10.0

    CVE-2001-0144 · OpenSSH

    CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to execute arbitrary commands on an SSH server or client via an integer overflow.

    Published 12 Mar 2001 · NVD
  37. Medium 5.0

    CVE-2001-0136 · ProFTPD

    Memory leak in ProFTPd 1.2.0rc2 allows remote attackers to cause a denial of service via a series of USER commands, and possibly SIZE commands if the server has been improperly installed.

    Published 12 Mar 2001 · NVD
  38. Low 3.3

    CVE-2001-0131 · Apache HTTP Server

    htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack.

    Published 12 Mar 2001 · NVD
  39. Medium 5.0

    CVE-2001-0108 · PHP

    PHP Apache module 4.0.4 and earlier allows remote attackers to bypass .htaccess access restrictions via a malformed HTTP request on an unrestricted page that causes PHP to use those access controls on the next page that is requested.

    Published 12 Mar 2001 · NVD
  40. Medium 5.0

    CVE-1999-0945 · Microsoft Exchange Server

    Buffer overflow in Internet Mail Service (IMS) for Microsoft Exchange 5.5 and 5.0 allows remote attackers to conduct a denial of service via AUTH or AUTHINFO commands.

    Published 12 Mar 2001 · NVD
  41. Medium 5.0

    CVE-2001-0042 · Apache HTTP Server

    PHP 3.x (PHP3) on Apache 1.3.6 allows remote attackers to read arbitrary files via a modified .. (dot dot) attack containing "%5c" (encoded backslash) sequences.

    Published 16 Feb 2001 · NVD
  42. Medium 5.0

    CVE-2001-0096 · Microsoft IIS

    FrontPage Server Extensions (FPSE) in IIS 4.0 and 5.0 allows remote attackers to cause a denial of service via a malformed form, aka the "Malformed Web Form Submission" vulnerability.

    Published 12 Feb 2001 · NVD
  43. High 10.0

    CVE-2001-0013 · BIND 9

    Format string vulnerability in nslookupComplain function in BIND 4 allows remote attackers to gain root privileges.

    Published 12 Feb 2001 · NVD
  44. Medium 5.0

    CVE-2001-0012 · BIND 9

    BIND 4 and BIND 8 allow remote attackers to access sensitive information such as environment variables.

    Published 12 Feb 2001 · NVD
  45. High 10.0

    CVE-2001-0011 · BIND 9

    Buffer overflow in nslookupComplain function in BIND 4 allows remote attackers to gain root privileges.

    Published 12 Feb 2001 · NVD
  46. High 10.0

    CVE-2001-0010 · BIND 9

    Buffer overflow in transaction signature (TSIG) handling code in BIND 8 allows remote attackers to gain root privileges.

    Published 12 Feb 2001 · NVD
  47. Medium 5.0

    CVE-2001-0004 · Microsoft IIS

    IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs by appending "%3F+.htr" to the requested URL, which causes the files to be parsed by the .HTR ISAPI extension, aka a variant of the "File Fragment Reading via .HTR" vulnerability.

    Published 12 Feb 2001 · NVD
  48. High 7.5

    CVE-2001-1454 · MySQL

    Buffer overflow in MySQL before 3.23.33 allows remote attackers to execute arbitrary code via a long drop database request.

    Published 9 Feb 2001 · NVD
  49. High 7.5

    CVE-2001-1453 · MySQL

    Buffer overflow in libmysqlclient.so in MySQL 3.23.33 and earlier allows remote attackers to execute arbitrary code via a long host parameter.

    Published 9 Feb 2001 · NVD
  50. High 7.5

    CVE-2001-1274 · MySQL

    Buffer overflow in MySQL before 3.23.31 allows attackers to cause a denial of service and possibly gain privileges.

    Published 23 Jan 2001 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.