UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,173
Published in 7 days
1,170
Critical in 30 days
351
Actively exploited
423

Latest vulnerabilities

40,173 vulnerabilities
  1. High 10.0

    CVE-1999-0385 · Microsoft Exchange Server

    The LDAP bind function in Exchange 5.5 has a buffer overflow that allows a remote attacker to conduct a denial of service or execute commands.

    Published 1 Dec 1998 · NVD
  2. Medium 4.6

    CVE-1999-1288 · Samba

    Samba 1.9.18 inadvertently includes a prototype application, wsmbconf, which is installed with incorrect permissions including the setgid bit, which allows local users to read and write files and possibly gain privileges via bugs in the program.

    Published 19 Nov 1998 · NVD
  3. Medium 4.6

    CVE-1999-1322 · Microsoft Exchange Server

    The installation of 1ArcServe Backup and Inoculan AV client modules for Exchange create a log file, exchverify.log, which contains usernames and passwords in plaintext.

    Published 12 Nov 1998 · NVD
  4. High 10.0

    CVE-1999-1199 · Apache HTTP Server

    Apache WWW server 1.3.1 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via a large number of MIME headers with the same name, aka the "sioux" vulnerability.

    Published 7 Aug 1998 · NVD
  5. Medium 5.0

    CVE-1999-0007 · Microsoft Exchange Server

    Information from SSL-encrypted sessions via PKCS #1.

    Published 26 Jun 1998 · NVD
  6. Low 2.1

    CVE-1999-1499 · BIND 9

    named in ISC BIND 4.9 and 8.1 allows local users to destroy files via a symlink attack on (1) named_dump.db when root kills the process with a SIGINT, or (2) named.stats when SIGIOT is used.

    Published 10 Apr 1998 · NVD
  7. Medium 5.4

    CVE-1999-0011 · BIND 9

    Denial of Service vulnerabilities in BIND 4.9 and BIND 8 Releases via CNAME record and zone transfer.

    Published 8 Apr 1998 · NVD
  8. Medium 5.0

    CVE-1999-0010 · BIND 9

    Denial of Service vulnerability in BIND 8 Releases via maliciously formatted DNS messages.

    Published 8 Apr 1998 · NVD
  9. High 10.0

    CVE-1999-0009 · BIND 9

    Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases.

    Published 8 Apr 1998 · NVD
  10. High 7.5

    CVE-1999-0284 · Microsoft Exchange Server

    Denial of service to NT mail servers including Ipswitch, Mdaemon, and Exchange through a buffer overflow in the SMTP HELO command.

    Published 1 Jan 1998 · NVD
  11. Medium 5.0

    CVE-1999-0107 · Apache HTTP Server

    Buffer overflow in Apache 1.2.5 and earlier allows a remote attacker to cause a denial of service with a large number of GET requests containing a large number of / characters.

    Published 30 Dec 1997 · NVD
  12. High 7.5

    CVE-1999-0068 · PHP

    CGI PHP mylog script allows an attacker to read any file on the target server.

    Published 19 Oct 1997 · NVD
  13. High 10.0

    CVE-1999-0182 · Samba

    Samba has a buffer overflow which allows a remote attacker to obtain root access by specifying a long password.

    Published 30 Sept 1997 · NVD
  14. High 7.5

    CVE-1999-0071 · Apache HTTP Server

    Apache httpd cookie buffer overflow for versions 1.1.1 and earlier.

    Published 1 Sept 1997 · NVD
  15. Medium 5.0

    CVE-1999-0024 · BIND 9

    DNS cache poisoning via BIND, by predictable query IDs.

    Published 13 Aug 1997 · NVD
  16. High 10.0

    CVE-1999-0238 · PHP

    php.cgi allows attackers to read any file on the system.

    Published 1 Aug 1997 · NVD
  17. Medium 6.4

    CVE-1999-0184 · BIND 9

    When compiled with the -DALLOW_UPDATES option, bind allows dynamic updates to the DNS server, allowing for malicious modification of DNS records.

    Published 1 Jul 1997 · NVD
  18. Medium 5.0

    CVE-1999-0281 · Microsoft IIS

    Denial of service in IIS using long URLs.

    Published 1 Jun 1997 · NVD
  19. High 7.5

    CVE-1999-0058 · PHP

    Buffer overflow in PHP cgi program, php.cgi allows shell access.

    Published 17 Apr 1997 · NVD
  20. High 7.5

    CVE-1999-0253 · Microsoft IIS

    IIS 3.0 with the iis-fix hotfix installed allows remote intruders to read source code for ASP programs by using a %2e instead of a . (dot) in the URL.

    Published 1 Jan 1997 · NVD
  21. High 7.5

    CVE-1999-0236 · Apache HTTP Server

    ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs.

    Published 1 Jan 1997 · Fixed in 1.0 · NVD
  22. High 7.5

    CVE-1999-0045 · Apache HTTP Server

    List of arbitrary files on Web host via nph-test-cgi script.

    Published 10 Dec 1996 · NVD
  23. Medium 5.0

    CVE-1999-0070 · Apache HTTP Server

    test-cgi program allows an attacker to list files on the server.

    Published 1 Apr 1996 · Fixed in 1.3.0 · NVD
  24. High 10.0

    CVE-1999-0067 · Apache HTTP Server

    phf CGI program allows remote command execution through shell metacharacters.

    Published 20 Mar 1996 · NVD
  25. High 10.0

    CVE-1999-0233 · Microsoft IIS

    IIS 1.0 allows users to execute arbitrary commands using .bat or .cmd files.

    Published 25 Feb 1996 · NVD
  26. Unrated

    WPV-fd300bc8c208 · WooCommerce

    Vulnerability in WooCommerce

    Fixed in 5.7.0 · WPVulnerability
  27. Unrated

    WPV-f4520a4e16a2 · WP Mail Smtp (WordPress plugin)

    Vulnerability in WP Mail SMTP by WPForms – Free SMTP Plugin with Gmail, Outlook, Amazon SES, SendGrid, Mailgun, Zoho & other SMTP

    Fixed in 1.4.0 · WPVulnerability
  28. Unrated

    WPV-f3bc308fbdd6 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Fixed in 13.2.1 · WPVulnerability
  29. Unrated

    WPV-ef4827fc1dd4 · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Fixed in 5.7.12 · WPVulnerability
  30. Unrated

    WPV-ed84aef478ce · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Fixed in 3.9.2 · WPVulnerability
  31. Unrated

    WPV-e8e804575098 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Fixed in 1.4.5 · WPVulnerability
  32. Unrated

    WPV-e68302ed9952 · Contact Form 7

    Vulnerability in Contact Form 7

    Fixed in 3.5.3 · WPVulnerability
  33. Unrated

    WPV-e60538ec6908 · WooCommerce

    Vulnerability in WooCommerce

    Fixed in 3.5.1 · WPVulnerability
  34. Unrated

    WPV-e3f968a33a0b · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Fixed in 2.3.7 · WPVulnerability
  35. Unrated

    WPV-e2c7ba50fbc5 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Fixed in 2.2.6.2 · WPVulnerability
  36. Unrated

    WPV-e159b06f2b05 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Fixed in 1.9 · WPVulnerability
  37. Unrated

    WPV-e0df9cafdfeb · Yith Woocommerce Wishlist (WordPress plugin)

    Vulnerability in YITH WooCommerce Wishlist

    Fixed in 2.2.0 · WPVulnerability
  38. Unrated

    WPV-e0a54980cf64 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Fixed in 5.2.4 · WPVulnerability
  39. Unrated

    WPV-ddca6e03fed8 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Fixed in 1.4.8 · WPVulnerability
  40. Unrated

    WPV-dc33e5193a37 · WooCommerce

    Vulnerability in WooCommerce

    Fixed in 7.9.0 · WPVulnerability
  41. Unrated

    WPV-dbf674a85dc2 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Fixed in 0.9.5 · WPVulnerability
  42. Unrated

    WPV-dade0fe406bd · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Fixed in 3.3.7 · WPVulnerability
  43. Unrated

    WPV-d955509b0e33 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Fixed in 0.9.4.1 · WPVulnerability
  44. Unrated

    WPV-d8ff0497dd82 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Fixed in 3.7.1 · WPVulnerability
  45. Unrated

    WPV-d868217e2ff4 · WooCommerce

    Vulnerability in WooCommerce

    Fixed in 5.7.0 · WPVulnerability
  46. Unrated

    WPV-d465b504323a · WooCommerce

    Vulnerability in WooCommerce

    Fixed in 8.4.0 · WPVulnerability
  47. Unrated

    WPV-d452967c6131 · WooCommerce

    Vulnerability in WooCommerce

    Fixed in 2.0.17 · WPVulnerability
  48. Unrated

    WPV-d27d9d61509c · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Fixed in 3.8.3 · WPVulnerability
  49. Unrated

    WPV-cfc72fc4793b · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Fixed in 1.4.5 · WPVulnerability
  50. Unrated

    WPV-cda821d92357 · Loco Translate (WordPress plugin)

    Vulnerability in Loco Translate

    Fixed in 2.2.2 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.