UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
9,657
Published in 7 days
230
Critical in 30 days
33
Actively exploited
47

Latest vulnerabilities

9,657 vulnerabilities
  1. High 8.8

    CVE-2026-110369 · Gs Team Members (WordPress plugin)

    WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerability

    Published 21 Oct 2026 · CVE Program
  2. High 8.8

    CVE-2026-110370 · Gs Pinterest Portfolio (WordPress plugin)

    WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerability

    Published 21 Oct 2026 · CVE Program
  3. High 7.1

    CVE-2026-110884 · Live Summary For Gravity Forms (WordPress plugin)

    WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability

    Published 21 Oct 2026 · CVE Program
  4. High 7.1

    CVE-2026-110899 · Ninja Forms (WordPress plugin)

    WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability

    Published 21 Oct 2026 · CVE Program
  5. High 7.1

    CVE-2026-107435 · Strong Testimonials (WordPress plugin)

    WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability

    Published 21 Oct 2026 · CVE Program
  6. High 8.8

    CVE-2026-82814 · Duplicator (WordPress plugin)

    Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection

    Published 21 Oct 2026 · CVE Program
  7. Critical 9.2

    CVE-2016-20101 · Issuu Panel (WordPress plugin)

    Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php

    Published 20 Oct 2026 · Fixed in 1.6.6 · CVE Program
  8. High 8.7

    CVE-2016-20100 · Memphis Documents Library (WordPress plugin)

    Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview

    Published 20 Oct 2026 · Fixed in 3.1.6 · CVE Program
  9. High 8.7

    CVE-2015-20125 · Aspose PDF Exporter (WordPress plugin)

    Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php

    Published 20 Oct 2026 · Fixed in 2.0 · CVE Program
  10. High 8.7

    CVE-2015-20124 · Aspose Importer Exporter (WordPress plugin)

    Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php

    Published 20 Oct 2026 · Fixed in 3.0 · CVE Program
  11. High 8.7

    CVE-2015-20123 · Aspose Doc Exporter (WordPress plugin)

    Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.php

    Published 20 Oct 2026 · Fixed in 2.0 · CVE Program
  12. Medium 5.1

    CVE-2014-125132 · Blogroll Fun (WordPress plugin)

    Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php

    Published 20 Oct 2026 · Fixed in 0.8.5 · CVE Program
  13. Medium 5.1

    CVE-2012-20005 · Socialfit (WordPress plugin)

    SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter

    Published 20 Oct 2026 · CVE Program
  14. Medium 5.1

    CVE-2012-20004 · Knews (WordPress plugin)

    K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter

    Published 20 Oct 2026 · Fixed in 1.1.1 · CVE Program
  15. Medium 5.1

    CVE-2012-20003 · Custom Tables (WordPress plugin)

    Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php

    Published 20 Oct 2026 · Fixed in 3.4.6 · CVE Program
  16. High 8.7

    CVE-2012-20002 · Tinymce Thumbnail Gallery (WordPress plugin)

    TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php

    Published 20 Oct 2026 · Fixed in 1.1.0 · CVE Program
  17. Unrated

    CVE-2026-107929 · curl

    local interface connection reuse mixup

    Published 20 Oct 2026 · CVE Program
  18. Unrated

    CVE-2026-107928 · curl

    info leak uploading over WebSockets with GnuTLS

    Published 20 Oct 2026 · CVE Program
  19. Unrated

    CVE-2026-94266 · curl

    password leak in CURLINFO_EFFECTIVE_URL

    Published 20 Oct 2026 · CVE Program
  20. Unrated

    CVE-2026-94265 · curl

    Authorization: Negotiate sent to foreign origin

    Published 20 Oct 2026 · CVE Program
  21. Unrated

    CVE-2026-92391 · curl

    curl_mime_free stack overflow by recursion

    Published 20 Oct 2026 · CVE Program
  22. Unrated

    CVE-2026-92390 · curl

    -J no-clobber guarantee bypassed with 103 early hints

    Published 20 Oct 2026 · CVE Program
  23. Unrated

    CVE-2026-92389 · curl

    TFTP direction confusion

    Published 20 Oct 2026 · CVE Program
  24. Unrated

    CVE-2026-92388 · curl

    FTP wildcard write callback mixup

    Published 20 Oct 2026 · CVE Program
  25. Unrated

    CVE-2026-92387 · curl

    never-ending loop via server response omission

    Published 20 Oct 2026 · CVE Program
  26. Unrated

    CVE-2026-92386 · curl

    server-set cookie aborts cookie jar load

    Published 20 Oct 2026 · CVE Program
  27. Unrated

    CVE-2026-87866 · curl

    wolfSSL public-key pinning bypass

    Published 20 Oct 2026 · CVE Program
  28. Unrated

    CVE-2026-87865 · curl

    knownhost callback mismatches key as missing

    Published 20 Oct 2026 · CVE Program
  29. Unrated

    CVE-2026-87863 · curl

    HSTS response erases persisted entries

    Published 20 Oct 2026 · CVE Program
  30. Unrated

    CVE-2026-87864 · curl

    IMAP APPEND plus CRLF conversion command injection

    Published 20 Oct 2026 · CVE Program
  31. Unrated

    CVE-2026-87862 · curl

    HSTS cache import drops longer-lived child

    Published 20 Oct 2026 · CVE Program
  32. Unrated

    CVE-2026-87861 · curl

    cross-origin reuse of a Negotiate connection

    Published 20 Oct 2026 · CVE Program
  33. Unrated

    CVE-2026-86415 · curl

    auto client cert connection reuse mixup

    Published 20 Oct 2026 · CVE Program
  34. Unrated

    CVE-2026-86414 · curl

    leaking host credentials to HTTP proxy

    Published 20 Oct 2026 · CVE Program
  35. Unrated

    CVE-2026-86413 · curl

    Negotiate credentials sent to redirected origin

    Published 20 Oct 2026 · CVE Program
  36. Unrated

    CVE-2026-86412 · curl

    server-set cookie erases cookie jar

    Published 20 Oct 2026 · CVE Program
  37. Unrated

    CVE-2026-86411 · curl

    FTP connection reuse inherits client-certificate

    Published 20 Oct 2026 · CVE Program
  38. Unrated

    CVE-2026-86410 · curl

    redirect to SFTP or SCP bypasses host verification

    Published 20 Oct 2026 · CVE Program
  39. Unrated

    CVE-2026-86409 · curl

    stale SigV4 headers sent unintended

    Published 20 Oct 2026 · CVE Program
  40. Low 3.7

    CVE-2026-113657 · sanitize-html

    ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

    Published 20 Oct 2026 · Fixed in 2.18.0 · OSV.dev and GitHub
  41. Medium 5.4

    CVE-2026-113661 · sanitize-html

    ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

    Published 20 Oct 2026 · Fixed in 2.18.0 · OSV.dev and GitHub
  42. Medium

    CVE-2026-113654 · sanitize-html

    ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

    Published 20 Oct 2026 · Fixed in 2.18.0 · OSV.dev and GitHub
  43. Medium 6.3

    CVE-2026-112861 · Participants Database (WordPress plugin)

    WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability

    Published 20 Oct 2026 · CVE Program
  44. Medium 4.3

    CVE-2026-112823 · WP User Manager (WordPress plugin)

    WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability

    Published 20 Oct 2026 · CVE Program
  45. Medium 5.3

    CVE-2026-112824 · Bus Ticket Booking With Seat Reservation (WordPress plugin)

    WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability

    Published 20 Oct 2026 · CVE Program
  46. Medium 6.5

    CVE-2026-111843 · Rootblox (WordPress plugin)

    WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

    Published 20 Oct 2026 · CVE Program
  47. Medium 5.3

    CVE-2026-112829 · Booktics (WordPress plugin)

    WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability

    Published 20 Oct 2026 · CVE Program
  48. Medium 6.5

    CVE-2026-112840 · Surecart (WordPress plugin)

    WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability

    Published 20 Oct 2026 · CVE Program
  49. High 8.8

    CVE-2026-112836 · Vikrentcar (WordPress plugin)

    WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability

    Published 20 Oct 2026 · CVE Program
  50. Medium 6.5

    CVE-2026-109700 · Meta Box (WordPress plugin)

    WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability

    Published 20 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.