UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
9,661
Published in 7 days
215
Critical in 30 days
35
Actively exploited
47

Latest vulnerabilities

9,661 vulnerabilities
  1. Medium 4.3

    CVE-2026-8030 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation of group URL slugs during namespace transfers.

    Published 16 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  2. Medium 4.3

    CVE-2026-7514 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that an authenticated user with developer-role permissions could substitute package file content and hide packages from their owners due to improper authorization checks in the Generic Package Registry.

    Published 16 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  3. High 8.5

    CVE-2026-79708 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their group and access protected CI/CD variables restricted to higher-privileged roles, due to insufficient…

    Published 16 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  4. Medium 6.1

    CVE-2026-78252 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper sanitization of user-controlled data in the Markdown JSON table renderer.

    Published 16 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  5. Medium 6.8

    CVE-2026-3855 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with project-level permissions to access restricted file contents on the server or cause denial of service due to improper validation of parameters in the Terraform state upload…

    Published 16 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  6. High 7.5

    CVE-2026-1168 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

    Published 16 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  7. Medium 4.7

    CVE-2026-19619 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to improper sanitization of pasted HTML content in the Content Editor.

    Published 16 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  8. Medium 4.3

    CVE-2026-16794 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected variables within group projects due to improper authorization controls on compliance framework management.

    Published 16 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  9. High 7.5

    CVE-2025-14871 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

    Published 16 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  10. Medium 6.4

    CVE-2024-11222 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race condition issue in pipeline creation.

    Published 16 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  11. High 8.5

    CVE-2026-88765 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicode conversion buffer used in Advanced Search indexing.

    Published 15 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  12. Medium 4.3

    CVE-2026-82837 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to improper authorization checks on internal data emission endpoints.

    Published 15 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  13. High 7.7

    CVE-2026-13210 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input validation in the environment scope pattern matcher.

    Published 15 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  14. Medium 5.4

    CVE-2026-12910 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing authentication enforcement checks.

    Published 15 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  15. Critical 9.9

    CVE-2026-87719 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to…

    Published 12 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  16. Critical 10.0Actively exploited

    CVE-2026-85706 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

    Published 12 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD
  17. High 7.7

    CVE-2026-89099 · MongoDB

    A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in server termination and potential corruption of…

    Published 11 Sept 2026 · Fixed in 7.0.43, 8.0.32, 8.3.11 · NVD
  18. Medium 4.8

    CVE-2026-86604 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Injection

    Published 9 Sept 2026 · Fixed in 5.0.1 · WPVulnerability
  19. High

    GHSA-rgj7-g3m4-5g8c · sharp

    sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

    Published 8 Sept 2026 · Fixed in 0.35.4 · OSV.dev and GitHub
  20. Critical

    GHSA-2xp9-vwfh-vxw4 · Next.js

    Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

    Published 8 Sept 2026 · Fixed in 15.5.24, 16.3.3 · OSV.dev and GitHub
  21. Critical 9.0

    CVE-2026-75604 · Next.js

    Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

    Published 8 Sept 2026 · Fixed in 15.5.24, 16.3.3 · OSV.dev and GitHub
  22. Critical 10.0

    CVE-2026-85061 · maplibre-gl

    MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

    Published 8 Sept 2026 · Fixed in 6.4.1 · OSV.dev and GitHub
  23. High 8.6

    CVE-2026-77774 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.

    Published 8 Sept 2026 · Fixed in 2.4.4 · NVD
  24. High 8.7

    CVE-2026-77111 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction. Scope is changed.

    Published 8 Sept 2026 · Fixed in 2.4.4 · NVD
  25. High 7.6

    CVE-2026-77110 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions, causing a limited disruption to availability. Exploitation of this issue does…

    Published 8 Sept 2026 · Fixed in 2.4.4 · NVD
  26. High 8.6

    CVE-2026-77109 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user interaction. Scope is changed.

    Published 8 Sept 2026 · Fixed in 2.4.4 · NVD
  27. High 7.5

    CVE-2026-77108 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction.

    Published 8 Sept 2026 · Fixed in 2.4.4 · NVD
  28. High 8.2

    CVE-2026-76202 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction.

    Published 8 Sept 2026 · Fixed in 2.4.4 · NVD
  29. Critical 9.3

    CVE-2026-76201 · Magento / Adobe Commerce

    Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

    Published 8 Sept 2026 · Fixed in 2.4.4 · NVD
  30. Critical 9.3

    CVE-2026-76200 · Magento / Adobe Commerce

    Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

    Published 8 Sept 2026 · Fixed in 2.4.4 · NVD
  31. High 7.1

    CVE-2026-82076 · MongoDB

    An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server process. This may result in a denial of…

    Published 8 Sept 2026 · Fixed in 8.0.30, 8.2.13, 8.3.9 · NVD
  32. High 8.7

    CVE-2026-82075 · MongoDB

    An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to legitimate clients. No authentication,…

    Published 8 Sept 2026 · Fixed in 7.0.41, 8.0.30, 8.3.9 · NVD
  33. High 7.1

    CVE-2026-82074 · MongoDB

    MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database.

    Published 8 Sept 2026 · Fixed in 7.0.41, 8.0.30 · NVD
  34. High 7.1

    CVE-2026-82073 · MongoDB

    A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an internal command parameter that can be set by external clients, causing a security check to be…

    Published 8 Sept 2026 · Fixed in 8.3.9 · NVD
  35. High 7.2

    CVE-2026-82071 · MongoDB

    Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary…

    Published 8 Sept 2026 · Fixed in 8.3.9 · NVD
  36. High 7.1

    CVE-2026-82070 · MongoDB

    A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session…

    Published 8 Sept 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD
  37. Medium 5.1

    CVE-2026-82069 · MongoDB

    A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query…

    Published 8 Sept 2026 · Fixed in 8.3.9 · NVD
  38. High 7.1

    CVE-2026-82068 · MongoDB

    A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentially propagating to additional nodes in a sharded cluster. Manual intervention is required to restore…

    Published 8 Sept 2026 · Fixed in 7.0.41, 8.0.30, 8.3.9 · NVD
  39. Critical 9.2

    CVE-2026-82067 · MongoDB

    Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and…

    Published 8 Sept 2026 · Fixed in 7.0.41, 8.0.30, 8.3.9 · NVD
  40. Medium 5.3

    CVE-2026-82066 · MongoDB

    A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The revealed memory contents may be partially observable through diagnostic query statistics output.

    Published 8 Sept 2026 · Fixed in 7.0.41, 8.0.30, 8.3.9 · NVD
  41. High 7.1

    CVE-2026-82065 · MongoDB

    A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable metadata, trigger a fatal assertion failure when the metadata is subsequently read by diagnostic…

    Published 8 Sept 2026 · Fixed in 7.0.41, 8.0.30, 8.3.9 · NVD
  42. High 8.7

    CVE-2026-82064 · MongoDB

    A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's assumptions about internal state do not hold for all member configurations, causing the server process to terminate.

    Published 8 Sept 2026 · Fixed in 7.0.41, 8.0.30, 8.3.9 · NVD
  43. Medium 6.0

    CVE-2026-82063 · MongoDB

    A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently dereferenced during cursor cleanup, leading to a server process crash.

    Published 8 Sept 2026 · Fixed in 7.0.41, 8.0.30, 8.3.9 · NVD
  44. High 7.0

    CVE-2026-82062 · MongoDB

    A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine…

    Published 8 Sept 2026 · Fixed in 8.3.9 · NVD
  45. High 7.2

    CVE-2026-82061 · MongoDB

    A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required.

    Published 8 Sept 2026 · Fixed in 8.3.9 · NVD
  46. Low 2.3

    CVE-2026-82060 · MongoDB

    In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries…

    Published 8 Sept 2026 · Fixed in 7.0.41, 8.0.30, 8.3.9 · NVD
  47. Medium 6.0

    CVE-2026-82059 · MongoDB

    An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges could trigger an assertion failure in the index key generation code path. In certain build…

    Published 8 Sept 2026 · Fixed in 7.0.41, 8.0.30, 8.3.9 · NVD
  48. High 7.1

    CVE-2026-82058 · MongoDB

    A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path performs unsafe numeric conversion on the user-controlled field name without proper exception handling,…

    Published 8 Sept 2026 · Fixed in 7.0.41, 8.0.30, 8.3.9 · NVD
  49. High 7.1

    CVE-2026-82057 · MongoDB

    A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the storage engine layer. When documents were subsequently read from the misconfigured collection, the…

    Published 8 Sept 2026 · Fixed in 8.3.9 · NVD
  50. Medium 6.0

    CVE-2026-82056 · MongoDB

    A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been freed, leading to a server crash. An authenticated user with readWrite privileges can trigger this…

    Published 8 Sept 2026 · Fixed in 7.0.41, 8.0.30, 8.3.9 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.