Vulnerability database · updated every hour
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 9,661
- Published in 7 days
- 211
- Critical in 30 days
- 35
- Actively exploited
- 47
Latest vulnerabilities
9,661 vulnerabilities- High 7.1
CVE-2026-82055 · MongoDB
A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an internal object in an invalid, partially initialized state. During subsequent index key generation, access to this…
Published 8 Sept 2026 · Fixed in 8.3.9 · NVD - High 7.1
CVE-2026-82054 · MongoDB
A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory…
Published 8 Sept 2026 · Fixed in 7.0.41, 8.0.30, 8.3.9 · NVD - High 7.6
CVE-2026-82053 · MongoDB
A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control…
Published 8 Sept 2026 · Fixed in 7.0.41, 8.0.30, 8.3.9 · NVD - High 7.1
CVE-2026-82052 · MongoDB
The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.
Published 8 Sept 2026 · Fixed in 7.0.41, 8.0.30, 8.3.9 · NVD - Critical 10.0Actively exploited
CVE-2026-75650 · Magento / Adobe Commerce
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Published 7 Sept 2026 · Fixed in 2.4.4, 2.4.6 · NVD - High 8.2
CVE-2026-82209 · curl
When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently,…
Published 6 Sept 2026 · Fixed in 8.22.0 · NVD - High 7.5
CVE-2026-82208 · curl
With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.
Published 6 Sept 2026 · Fixed in 8.22.0 · NVD - High 7.5
CVE-2026-80255 · curl
A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.
Published 6 Sept 2026 · Fixed in 8.22.0 · NVD - High 7.5
CVE-2026-80231 · curl
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.
Published 6 Sept 2026 · Fixed in 8.22.0 · NVD - High 7.5
CVE-2026-80230 · curl
When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed…
Published 6 Sept 2026 · Fixed in 8.22.0 · NVD - High 7.5
CVE-2026-80229 · curl
When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a…
Published 6 Sept 2026 · Fixed in 8.22.0 · NVD - Critical 9.8
CVE-2026-19931 · curl
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
Published 6 Sept 2026 · Fixed in 8.22.0 · NVD - Critical 9.1
CVE-2026-18924 · curl
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
Published 6 Sept 2026 · Fixed in 8.22.0 · NVD - High 7.4
CVE-2026-13608 · curl
A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.
Published 6 Sept 2026 · Fixed in 8.22.0 · NVD - High 7.2
CVE-2026-87920 · W3 Total Cache (WordPress plugin)
W3 Total Cache: Cross-site Scripting
Published 4 Sept 2026 · Fixed in 2.10.7 · WPVulnerability - High 7.6
CVE-2026-57777 · WooCommerce
WooCommerce: SQL Injection
Published 4 Sept 2026 · Fixed in 11.0 · WPVulnerability - High 7.5
CVE-2026-48888 · WooCommerce
WooCommerce: Allocation of Resources Without Limits or Throttling
Published 4 Sept 2026 · Fixed in 11.1.0 · WPVulnerability - Medium 5.1
CVE-2026-84967 · MongoDB
A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place…
Published 3 Sept 2026 · Fixed in 1.17.1 · NVD - Unrated
WPV-f0aec78f3042 · Jetpack
Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth
Published 3 Sept 2026 · Fixed in 16.1.3 · WPVulnerability - Medium 6.8
CVE-2026-82884 · All in One SEO
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting
Published 2 Sept 2026 · Fixed in 5.0.0.1 · WPVulnerability - Unrated
CVE-2026-77788 · SEO By Rank Math (WordPress plugin)
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Authorization Bypass Through User-Controlled Key
Published 2 Sept 2026 · Fixed in 1.0.277 · WPVulnerability - Unrated
CVE-2026-77787 · SEO By Rank Math (WordPress plugin)
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization
Published 2 Sept 2026 · Fixed in 1.0.277 · WPVulnerability - Unrated
CVE-2026-77785 · SEO By Rank Math (WordPress plugin)
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Authorization Bypass Through User-Controlled Key
Published 2 Sept 2026 · Fixed in 1.0.277 · WPVulnerability - Unrated
CVE-2026-77784 · SEO By Rank Math (WordPress plugin)
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Authorization Bypass Through User-Controlled Key
Published 2 Sept 2026 · Fixed in 1.0.277 · WPVulnerability - Unrated
CVE-2026-77783 · SEO By Rank Math (WordPress plugin)
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Authorization Bypass Through User-Controlled Key
Published 2 Sept 2026 · Fixed in 1.0.277 · WPVulnerability - Unrated
CVE-2026-77782 · SEO By Rank Math (WordPress plugin)
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Exposure of Sensitive Information to an Unauthorized Actor
Published 2 Sept 2026 · Fixed in 1.0.277.1 · WPVulnerability - Medium 4.7
CVE-2026-76579 · LiteSpeed Cache
LiteSpeed Cache: Cross-site Scripting
Published 2 Sept 2026 · Fixed in 7.9.1 · WPVulnerability - High 7.1
CVE-2026-78607 · Elasticsearch
Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.
Published 1 Sept 2026 · Fixed in 8.19.19, 9.3.8, 9.4.4 · NVD - Medium 5.9
CVE-2026-78605 · Elasticsearch
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.
Published 1 Sept 2026 · Fixed in 8.19.20, 9.4.5 · NVD - High 8.8
CVE-2026-72649 · Elasticsearch
Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and…
Published 1 Sept 2026 · Fixed in 8.19.20, 9.4.5 · NVD - Medium 4.9
CVE-2026-56143 · Elasticsearch
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted request that causes excessive memory consumption, which may render the affected node unavailable.
Published 1 Sept 2026 · Fixed in 8.19.20, 9.3.0 · NVD - Medium 6.1
CVE-2026-85492 · All in One SEO
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting
Published 1 Sept 2026 · Fixed in 5.0.2 · WPVulnerability - Unrated
WPV-a5c73b8e2e58 · WP Rocket (WordPress plugin)
Vulnerability in WP Rocket
Published 28 Aug 2026 · Fixed in 3.23.3.3 · WPVulnerability - High 7.2
CVE-2026-81757 · SEO By Rank Math (WordPress plugin)
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Deserialization of Untrusted Data
Published 28 Aug 2026 · Fixed in 1.0.277 · WPVulnerability - Critical 9.6
CVE-2026-75871 · GitLab
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an externally-controlled endpoint via a crafted inline flow configuration that overrides the HTTP Host header,…
Published 27 Aug 2026 · Fixed in 19.0.12, 19.1.7, 19.2.2 · NVD - Unrated
WPV-908926c3f5d2 · WP Rocket (WordPress plugin)
Vulnerability in WP Rocket
Published 27 Aug 2026 · Fixed in 3.23.3.3 · WPVulnerability - High 7.2
CVE-2026-84761 · LiteSpeed Cache
LiteSpeed Cache: Server-Side Request Forgery (SSRF)
Published 27 Aug 2026 · Fixed in 7.9.1 · WPVulnerability - Unrated
CVE-2026-82841 · UpdraftPlus
UpdraftPlus: WP Backup & Migration Plugin: Exposure of Sensitive Information to an Unauthorized Actor
Published 27 Aug 2026 · Fixed in 1.26.8 · WPVulnerability - Unrated
CVE-2026-77786 · SEO By Rank Math (WordPress plugin)
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Incorrect Authorization
Published 27 Aug 2026 · Fixed in 1.0.277 · WPVulnerability - Medium 6.4
CVE-2026-3129 · LiteSpeed Cache
LiteSpeed Cache: Cross-site Scripting
Published 27 Aug 2026 · Fixed in 7.8 · WPVulnerability - High 7.2
CVE-2026-18978 · LiteSpeed Cache
LiteSpeed Cache: Cross-site Scripting
Published 27 Aug 2026 · Fixed in 7.9 · WPVulnerability - Low 3.5
CVE-2026-7487 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.
Published 26 Aug 2026 · Fixed in 19.1.7, 19.2.5 · NVD - Medium 6.5
CVE-2026-77801 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing object count limits.
Published 26 Aug 2026 · Fixed in 19.1.7, 19.2.5 · NVD - Medium 5.5
CVE-2026-3035 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were not authorized to use due to improper authorization checks.
Published 26 Aug 2026 · Fixed in 19.1.7, 19.2.5 · NVD - High 8.1
CVE-2026-18252 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude agent processing configuration from a user-controlled source.
Published 26 Aug 2026 · Fixed in 19.1.7, 19.2.5 · NVD - Medium 4.3
CVE-2026-15387 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy enforcement jobs, due to improper handling of job dependencies.
Published 26 Aug 2026 · Fixed in 19.1.7, 19.2.5 · NVD - Medium 6.5
CVE-2025-10903 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the SCIM user provisioning feature.
Published 26 Aug 2026 · Fixed in 19.1.7, 19.2.5 · NVD - Medium 6.8
CVE-2026-73180 · Apache Tomcat
Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended. This issue affects Apache Tomcat: from 11.0.0-M1…
Published 25 Aug 2026 · Fixed in 9.0.121, 10.1.58, 11.0.25 · NVD - High 7.5
CVE-2026-68763 · Apache Tomcat
Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other…
Published 25 Aug 2026 · Fixed in 9.0.121, 10.1.58, 11.0.25 · NVD - High 8.1
CVE-2026-68569 · Apache Tomcat
Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created…
Published 25 Aug 2026 · Fixed in 9.0.121, 10.1.58, 11.0.25 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.