Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 40,173
- Published in 7 days
- 1,170
- Critical in 30 days
- 351
- Actively exploited
- 423
Latest vulnerabilities
40,173 vulnerabilities- Medium 5.0
CVE-2000-0672 · Apache Tomcat
The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.
Published 20 Jul 2000 · NVD - Medium 5.0
CVE-2000-0630 · Microsoft IIS
IIS 4.0 and 5.0 allows remote attackers to obtain fragments of source code by appending a +.htr to the URL, a variant of the "File Fragment Reading via .HTR" vulnerability.
Published 17 Jul 2000 · NVD - Medium 5.0
CVE-2000-0631 · Microsoft IIS
An administrative script from IIS 3.0, later included in IIS 4.0 and 5.0, allows remote attackers to cause a denial of service by accessing the script without a particular argument, aka the "Absent Directory Browser Argument" vulnerability.
Published 14 Jul 2000 · NVD - Low 2.6
CVE-2000-0649 · Microsoft IIS
IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.
Published 13 Jul 2000 · NVD - High 7.6
CVE-1999-0812 · Samba
Race condition in Samba smbmnt allows local users to mount file systems in arbitrary locations.
Published 12 Jul 2000 · NVD - Medium 5.0
CVE-2000-0535 · OpenSSL
OpenSSL 0.9.4 and OpenSSH for FreeBSD do not properly check for the existence of the /dev/random or /dev/urandom devices, which are absent on FreeBSD Alpha systems, which causes them to produce weak keys which may be more easily broken.
Published 12 Jun 2000 · NVD - High 10.0
CVE-2000-0525 · OpenSSH
OpenSSH does not properly drop privileges when the UseLogin option is enabled, which allows local users to execute arbitrary commands by providing the command to the ssh daemon.
Published 8 Jun 2000 · NVD - High 7.5
CVE-2000-0497 · IBM WebSphere Application Server
IBM WebSphere server 3.0.2 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.
Published 8 Jun 2000 · NVD - Medium 5.0
CVE-2000-0524 · Microsoft Exchange Server
Microsoft Outlook and Outlook Express allow remote attackers to cause a denial of service by sending email messages with blank fields such as BCC, Reply-To, Return-Path, or From.
Published 5 Jun 2000 · NVD - Medium 5.0
CVE-2000-0505 · Apache HTTP Server
The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / characters.
Published 31 May 2000 · NVD - High 7.5
CVE-2000-0457 · Microsoft IIS
ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces (%20) and terminated with a .htr extension, aka the ".HTR File Fragment Reading" or "File Fragment Reading via .HTR" vulnerability.
Published 11 May 2000 · NVD - Medium 5.0
CVE-2000-0408 · Microsoft IIS
IIS 4.05 and 5.0 allow remote attackers to cause a denial of service via a long, complex URL that appears to contain a large number of file extensions, aka the "Malformed Extension Data in URL" vulnerability.
Published 11 May 2000 · NVD - Medium 5.0
CVE-2000-0304 · Microsoft IIS
Microsoft IIS 4.0 and 5.0 with the IISADMPWD virtual directory installed allows a remote attacker to cause a denial of service via a malformed request to the inetinfo.exe program, aka the "Undelimited .HTR Request" vulnerability.
Published 10 May 2000 · NVD - Medium 5.0
CVE-2000-0413 · Microsoft IIS
The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and SHTML files by requesting a file that does not exist, which generates an error message that reveals the path.
Published 6 May 2000 · NVD - High 7.5
CVE-2000-0335 · GNU C Library, BIND 9
The resolver in glibc 2.1.3 uses predictable IDs, which allows a local attacker to spoof DNS query results.
Published 3 May 2000 · NVD - High 7.5
CVE-2000-0258 · Microsoft IIS
IIS 4.0 and 5.0 allows remote attackers to cause a denial of service by sending many URLs with a large number of escaped characters, aka the "Myriad Escaped Characters" Vulnerability.
Published 12 Apr 2000 · NVD - Medium 5.0
CVE-2000-0246 · Microsoft IIS
IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the "Virtualized UNC Share" vulnerability.
Published 30 Mar 2000 · NVD - Medium 5.0
CVE-2000-0216 · Microsoft Exchange Server
Microsoft email clients in Outlook, Exchange, and Windows Messaging automatically respond to Read Receipt and Delivery Receipt tags, which could allow an attacker to flood a mail system with responses by forging a Read Receipt request that is redirected to a large distribution list.
Published 29 Feb 2000 · NVD - Medium 5.1
CVE-2000-0217 · OpenSSH
The default configuration of SSH allows X forwarding, which could allow a remote attacker to control a client's X sessions via a malicious xauth program.
Published 24 Feb 2000 · NVD - Medium 4.6
CVE-2000-0143 · OpenSSH
The SSH protocol server sshd allows local users without shell access to redirect a TCP connection through a service that uses the standard system password database for authentication, such as POP or FTP.
Published 11 Feb 2000 · NVD - High 7.5
CVE-2000-0148 · MySQL
MySQL 3.22 allows remote attackers to bypass password authentication and access a database via a short check string.
Published 8 Feb 2000 · NVD - Medium 4.3
CVE-2000-1205 · Apache HTTP Server
Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl), which does not encode its output, (2) pages generated by the ap_send_error_response function such as a default 404, which does not add an explicit charset, or (3) various messages that are generated by certain Apache…
Published 1 Feb 2000 · NVD - Medium 5.0
CVE-2000-0071 · Microsoft IIS
IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions.
Published 11 Jan 2000 · NVD - Medium 6.4
CVE-2000-0045 · MySQL
MySQL allows local users to modify passwords for arbitrary MySQL users via the GRANT privilege.
Published 11 Jan 2000 · NVD - High 10.0
CVE-2000-0059 · PHP
PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers to execute commands.
Published 4 Jan 2000 · NVD - High 10.0
CVE-1999-1293 · Apache HTTP Server
mod_proxy in Apache 1.2.5 and earlier allows remote attackers to cause a denial of service via malformed FTP commands, which causes Apache to dump core.
Published 31 Dec 1999 · NVD - High 7.5
CVE-1999-1074 · Webmin
Webmin before 0.5 does not restrict the number of invalid passwords that are entered for a valid username, which could allow remote attackers to gain privileges via brute force password cracking.
Published 31 Dec 1999 · NVD - Medium 5.0
CVE-1999-1043 · Microsoft Exchange Server
Microsoft Exchange Server 5.5 and 5.0 does not properly handle (1) malformed NNTP data, or (2) malformed SMTP data, which allows remote attackers to cause a denial of service (application error).
Published 31 Dec 1999 · NVD - Medium 5.0
CVE-1999-0154 · Microsoft IIS
IIS 2.0 and 3.0 allows remote attackers to read the source code for ASP pages by appending a . (dot) to the end of the URL.
Published 31 Dec 1999 · NVD - Low 2.1
CVE-1999-1010 · OpenSSH
An SSH 1.2.27 server allows a client to use the "none" cipher, even if it is not allowed by the server policy.
Published 14 Dec 1999 · NVD - High 7.5
CVE-1999-0993 · Microsoft Exchange Server
Modifications to ACLs (Access Control Lists) in Microsoft Exchange 5.5 do not take effect until the directory store cache is refreshed.
Published 13 Dec 1999 · NVD - Low 2.1
CVE-1999-0862 · PostgreSQL
Insecure directory permissions in RPM distribution for PostgreSQL allows local users to gain privileges by reading a plaintext password file.
Published 2 Dec 1999 · NVD - High 7.2
CVE-1999-0852 · IBM WebSphere Application Server
IBM WebSphere sets permissions that allow a local user to modify a deinstallation script or its data files stored in /usr/bin.
Published 2 Dec 1999 · NVD - Medium 5.0
CVE-1999-0849 · BIND 9
Denial of service in BIND named via maxdname.
Published 10 Nov 1999 · NVD - Medium 5.0
CVE-1999-0848 · BIND 9
Denial of service in BIND named via consuming more than "fdmax" file descriptors.
Published 10 Nov 1999 · NVD - High 10.0
CVE-1999-0837 · BIND 9
Denial of service in BIND by improperly closing TCP sessions via so_linger.
Published 10 Nov 1999 · NVD - High 7.5
CVE-1999-0833 · BIND 9
Buffer overflow in BIND 8.2 via NXT records.
Published 10 Nov 1999 · NVD - High 7.5
CVE-1999-1053 · Apache HTTP Server
guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".
Published 13 Sept 1999 · NVD - High 10.0
CVE-1999-0926 · Apache HTTP Server
Apache allows remote attackers to conduct a denial of service via a large number of MIME headers.
Published 3 Sept 1999 · NVD - Medium 5.0
CVE-2000-1206 · Apache HTTP Server
Vulnerability in Apache httpd before 1.3.11, when configured for mass virtual hosting using mod_rewrite, or mod_vhost_alias in Apache 1.3.9, allows remote attackers to retrieve arbitrary files.
Published 20 Aug 1999 · NVD - Medium 5.0
CVE-1999-0682 · Microsoft Exchange Server
Microsoft Exchange 5.5 allows a remote attacker to relay email (i.e. spam) using encapsulated SMTP addresses, even if the anti-relaying features are enabled.
Published 6 Aug 1999 · NVD - Medium 5.0
CVE-1999-0811 · Samba
Buffer overflow in Samba smbd program via a malformed message command.
Published 21 Jul 1999 · NVD - High 10.0
CVE-1999-0810 · Samba
Denial of service in Samba NETBIOS name service daemon (nmbd).
Published 21 Jul 1999 · NVD - High 7.5
CVE-1999-0428 · OpenSSL
OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls.
Published 22 Mar 1999 · Fixed in 0.9.2b · NVD - High 7.5
CVE-1999-0412 · Microsoft IIS
In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension.
Published 19 Feb 1999 · NVD - Medium 4.6
CVE-1999-1171 · WS_FTP Server
IPswitch WS_FTP allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920.
Published 2 Feb 1999 · NVD - Medium 5.0
CVE-1999-0362 · WS_FTP Server
WS_FTP server remote denial of service through cwd command.
Published 2 Feb 1999 · NVD - High 7.5
CVE-1999-0450 · Microsoft IIS
In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe).
Published 26 Jan 1999 · NVD - Medium 4.6
CVE-1999-1170 · WS_FTP Server
IPswitch IMail allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920.
Published 2 Jan 1999 · NVD - Medium 4.6
CVE-1999-1188 · MySQL
mysqld in MySQL 3.21 creates log files with world-readable permissions, which allows local users to obtain passwords for users who are added to the user database.
Published 27 Dec 1998 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.