UpHeron

Vulnerability blog · every day

New vulnerabilities, a day at a time.

Each morning, the previous day's new CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers websites run on, grouped so that similar ones don't repeat. A critical one gets its own article as soon as we find it.

RSS feed

  1. Daily summary

    Vulnerabilities of 29 October 2026: 172 new, 29 critical

    Remote code execution in WordPress plugins · PHP object injection in WordPress themes · PHP object injection in WordPress plugins

    • 29 critical
    • 54 high
    • 89 medium

  2. Daily summary

    Vulnerabilities of 28 October 2026: 82 new, 5 critical, 2 newly exploited

    PHP object injection in WordPress plugins · Arbitrary file upload in WordPress plugins · Authentication bypass in WordPress plugins

    • 5 critical
    • 26 high
    • 49 medium
    • 1 low
    • 1 unrated
    • 2 newly exploited

  3. Daily summary

    Vulnerabilities of 27 October 2026: 8 new, 1 critical, 2 newly exploited

    Cross-site request forgery in WordPress plugins · Cross-site scripting in WordPress plugins

    • 1 critical
    • 4 high
    • 2 medium
    • 1 low
    • 2 newly exploited

  4. Daily summary

    Vulnerabilities of 26 October 2026: 63 new, 3 high

    Cross-site request forgery in WordPress plugins · SQL injection in WordPress plugins · Cross-site scripting in WordPress plugins

    • 3 high
    • 40 medium
    • 1 low
    • 19 unrated

  5. Daily summary

    Vulnerabilities of 24 October 2026: 40 new, 7 critical

    PHP object injection in WordPress plugins · SQL injection in WordPress plugins · Privilege escalation in WordPress plugins

    • 7 critical
    • 15 high
    • 14 medium
    • 1 low
    • 3 unrated

  6. Daily summary

    Vulnerabilities of 23 October 2026: 99 new, 24 critical

    GitLab (12) · Arbitrary file upload in WordPress plugins · PHP object injection in WordPress themes

    • 24 critical
    • 32 high
    • 37 medium
    • 5 low
    • 1 unrated