Vulnerability database · updated every hour
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 9,652
- Published in 7 days
- 225
- Critical in 30 days
- 33
- Actively exploited
- 47
Latest vulnerabilities
9,652 vulnerabilities- High 8.8
CVE-2026-82814 · Duplicator (WordPress plugin)
Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection
Published 21 Oct 2026 · CVE Program - Critical 9.2
CVE-2016-20101 · Issuu Panel (WordPress plugin)
Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php
Published 20 Oct 2026 · Fixed in 1.6.6 · CVE Program - High 8.7
CVE-2016-20100 · Memphis Documents Library (WordPress plugin)
Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview
Published 20 Oct 2026 · Fixed in 3.1.6 · CVE Program - High 8.7
CVE-2015-20125 · Aspose PDF Exporter (WordPress plugin)
Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php
Published 20 Oct 2026 · Fixed in 2.0 · CVE Program - High 8.7
CVE-2015-20124 · Aspose Importer Exporter (WordPress plugin)
Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php
Published 20 Oct 2026 · Fixed in 3.0 · CVE Program - High 8.7
CVE-2015-20123 · Aspose Doc Exporter (WordPress plugin)
Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.php
Published 20 Oct 2026 · Fixed in 2.0 · CVE Program - Medium 5.1
CVE-2014-125132 · Blogroll Fun (WordPress plugin)
Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php
Published 20 Oct 2026 · Fixed in 0.8.5 · CVE Program - Medium 5.1
CVE-2012-20005 · Socialfit (WordPress plugin)
SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter
Published 20 Oct 2026 · CVE Program - Medium 5.1
CVE-2012-20004 · Knews (WordPress plugin)
K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter
Published 20 Oct 2026 · Fixed in 1.1.1 · CVE Program - Medium 5.1
CVE-2012-20003 · Custom Tables (WordPress plugin)
Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php
Published 20 Oct 2026 · Fixed in 3.4.6 · CVE Program - High 8.7
CVE-2012-20002 · Tinymce Thumbnail Gallery (WordPress plugin)
TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php
Published 20 Oct 2026 · Fixed in 1.1.0 · CVE Program - Unrated
CVE-2026-107929 · curl
local interface connection reuse mixup
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-107928 · curl
info leak uploading over WebSockets with GnuTLS
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-94266 · curl
password leak in CURLINFO_EFFECTIVE_URL
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-94265 · curl
Authorization: Negotiate sent to foreign origin
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-92391 · curl
curl_mime_free stack overflow by recursion
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-92390 · curl
-J no-clobber guarantee bypassed with 103 early hints
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-92389 · curl
TFTP direction confusion
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-92388 · curl
FTP wildcard write callback mixup
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-92387 · curl
never-ending loop via server response omission
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-92386 · curl
server-set cookie aborts cookie jar load
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-87866 · curl
wolfSSL public-key pinning bypass
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-87865 · curl
knownhost callback mismatches key as missing
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-87863 · curl
HSTS response erases persisted entries
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-87864 · curl
IMAP APPEND plus CRLF conversion command injection
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-87862 · curl
HSTS cache import drops longer-lived child
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-87861 · curl
cross-origin reuse of a Negotiate connection
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-86415 · curl
auto client cert connection reuse mixup
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-86414 · curl
leaking host credentials to HTTP proxy
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-86413 · curl
Negotiate credentials sent to redirected origin
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-86412 · curl
server-set cookie erases cookie jar
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-86411 · curl
FTP connection reuse inherits client-certificate
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-86410 · curl
redirect to SFTP or SCP bypasses host verification
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-86409 · curl
stale SigV4 headers sent unintended
Published 20 Oct 2026 · CVE Program - Low 3.7
CVE-2026-113657 · sanitize-html
ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
Published 20 Oct 2026 · Fixed in 2.18.0 · OSV.dev and GitHub - Medium 5.4
CVE-2026-113661 · sanitize-html
ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
Published 20 Oct 2026 · Fixed in 2.18.0 · OSV.dev and GitHub - Medium
CVE-2026-113654 · sanitize-html
ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
Published 20 Oct 2026 · Fixed in 2.18.0 · OSV.dev and GitHub - Medium 6.3
CVE-2026-112861 · Participants Database (WordPress plugin)
WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability
Published 20 Oct 2026 · CVE Program - Medium 4.3
CVE-2026-112823 · WP User Manager (WordPress plugin)
WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability
Published 20 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-112824 · Bus Ticket Booking With Seat Reservation (WordPress plugin)
WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability
Published 20 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-111843 · Rootblox (WordPress plugin)
WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability
Published 20 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-112829 · Booktics (WordPress plugin)
WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability
Published 20 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-112840 · Surecart (WordPress plugin)
WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability
Published 20 Oct 2026 · CVE Program - High 8.8
CVE-2026-112836 · Vikrentcar (WordPress plugin)
WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability
Published 20 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-109700 · Meta Box (WordPress plugin)
WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability
Published 20 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-112834 · Seriously Simple Podcasting (WordPress plugin)
WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Broken Access Control vulnerability
Published 20 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-112833 · Seriously Simple Podcasting (WordPress plugin)
WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-103119 · Apache Tomcat
Apache Tomcat: AJP response mix-up
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-101356 · Apache Tomcat
Apache Tomcat: HTTP/2 request/response mix-up after error during async processing
Published 20 Oct 2026 · CVE Program - Unrated
CVE-2026-101296 · Apache Tomcat
Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
Published 20 Oct 2026 · CVE Program
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.