Vulnerability database · updated every hour
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 9,661
- Published in 7 days
- 204
- Critical in 30 days
- 35
- Actively exploited
- 47
Latest vulnerabilities
9,661 vulnerabilities- Critical 9.1
CVE-2026-68525 · Apache Tomcat
Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known…
Published 25 Aug 2026 · Fixed in 9.0.121, 10.1.58, 11.0.25 · NVD - High 8.1
CVE-2026-66422 · Apache Tomcat
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole(). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120. The following versions were EOL at the time the CVE was…
Published 25 Aug 2026 · Fixed in 9.0.121, 10.1.58, 11.0.25 · NVD - High 7.5
CVE-2026-65927 · Apache Tomcat
Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be…
Published 25 Aug 2026 · Fixed in 9.0.121, 10.1.58, 11.0.25 · NVD - Critical 9.8
CVE-2026-65905 · Apache Tomcat
Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window. This issue affects Apache Tomcat: from…
Published 25 Aug 2026 · Fixed in 9.0.121, 10.1.58, 11.0.25 · NVD - Critical 9.8
CVE-2026-65637 · Apache Tomcat
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
Published 25 Aug 2026 · Fixed in 9.0.121, 10.1.58, 11.0.25 · NVD - High 8.1
CVE-2026-65183 · Apache Tomcat
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the…
Published 25 Aug 2026 · Fixed in 9.0.121, 10.1.58, 11.0.25 · NVD - Critical 9.1
CVE-2026-65182 · Apache Tomcat
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0…
Published 25 Aug 2026 · Fixed in 9.0.121, 10.1.58, 11.0.25 · NVD - Critical 9.1
CVE-2026-75803 · OpenSSL
Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper…
Published 25 Aug 2026 · Fixed in 3.5.8, 3.6.4, 4.0.2 · NVD - High 7.5
CVE-2026-63076 · OpenSSL
Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP…
Published 25 Aug 2026 · Fixed in 3.5.8, 3.6.4, 4.0.2 · NVD - High 7.5
CVE-2026-63075 · OpenSSL
Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory…
Published 25 Aug 2026 · Fixed in 3.5.8, 3.6.4, 4.0.2 · NVD - Medium 5.9
CVE-2026-63074 · OpenSSL
Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing…
Published 25 Aug 2026 · Fixed in 3.5.8, 3.6.4, 4.0.2 · NVD - Critical 9.8
CVE-2026-63073 · OpenSSL
Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled…
Published 25 Aug 2026 · Fixed in 3.5.8, 3.6.4, 4.0.2 · NVD - High 7.5
CVE-2026-63072 · OpenSSL
Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim…
Published 25 Aug 2026 · Fixed in 3.5.8, 3.6.4, 4.0.2 · NVD - High 7.5
CVE-2026-54874 · OpenSSL
Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource…
Published 25 Aug 2026 · Fixed in 3.5.8, 3.6.4, 4.0.2 · NVD - High 7.5
CVE-2026-18798 · OpenSSL
Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly…
Published 25 Aug 2026 · Fixed in 3.5.8, 3.6.4, 4.0.2 · NVD - High 7.5
CVE-2026-14457 · OpenSSL
Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension. Impact summary: The impact is limited to a possible Denial of…
Published 25 Aug 2026 · Fixed in 3.5.8, 3.6.4, 4.0.2 · NVD - High 8.8
CVE-2026-10053 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package registry.
Published 23 Aug 2026 · Fixed in 19.0.6, 19.1.4, 19.2.2 · NVD - High 7.2
CVE-2026-78438 · W3 Total Cache (WordPress plugin)
W3 Total Cache: Cross-site Scripting
Published 21 Aug 2026 · Fixed in 2.10.6 · WPVulnerability - Unrated
CVE-2026-18051 · W3 Total Cache (WordPress plugin)
W3 Total Cache: Path Traversal
Published 19 Aug 2026 · Fixed in 2.10.5 · WPVulnerability - Medium 5.1
CVE-2026-73372 · Joomla!
Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets.
Published 18 Aug 2026 · Fixed in 5.4.8, 6.1.3 · NVD - Medium 5.1
CVE-2026-73336 · Joomla!
Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org markup outputs.
Published 18 Aug 2026 · Fixed in 5.4.8 · NVD - Medium 5.1
CVE-2026-72531 · Joomla!
Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create fields for inaccessible components.
Published 18 Aug 2026 · Fixed in 5.4.8, 6.1.3 · NVD - Medium 6.9
CVE-2026-71573 · Joomla!
Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests.
Published 18 Aug 2026 · Fixed in 5.4.8, 6.1.3 · NVD - Medium 4.8
CVE-2026-71572 · Joomla!
Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion.
Published 18 Aug 2026 · Fixed in 5.4.8 · NVD - High 8.9
CVE-2026-73373 · Joomla!
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.
Published 18 Aug 2026 · Fixed in 5.4.8, 6.1.3 · NVD - Medium 5.1
CVE-2026-73371 · Joomla!
Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items.
Published 18 Aug 2026 · NVD - High 8.2
CVE-2026-73337 · Joomla!
Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.
Published 18 Aug 2026 · Fixed in 5.4.8, 6.1.3 · NVD - Medium 5.1
CVE-2026-72532 · Joomla!
Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints.
Published 18 Aug 2026 · Fixed in 5.4.8, 6.1.3 · NVD - High 8.5
CVE-2026-71574 · Joomla!
Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.
Published 18 Aug 2026 · Fixed in 5.4.8, 6.1.3 · NVD - High 7.1
CVE-2026-19650 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.
Published 17 Aug 2026 · Fixed in 19.0.8, 19.1.6, 19.2.4 · NVD - Critical 9.1
CVE-2026-19478 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
Published 17 Aug 2026 · Fixed in 19.0.8, 19.1.6, 19.2.4 · NVD - Medium 6.4
CVE-2026-15066 · Loco Translate (WordPress plugin)
Loco Translate: Cross-site Scripting
Published 15 Aug 2026 · Fixed in 2.8.8 · WPVulnerability - Medium 6.5
CVE-2026-72687 · Elasticsearch
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the identifier drives an allocation that is neither capped nor accounted for by the available memory-usage…
Published 13 Aug 2026 · Fixed in 8.19.20, 9.4.5, 9.5.1 · NVD - Medium 6.5
CVE-2026-72686 · Elasticsearch
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation causes the thread to exhaust its stack. The resulting fatal error is not handled by the surrounding…
Published 13 Aug 2026 · Fixed in 8.19.20, 9.4.5, 9.5.1 · NVD - Medium 4.3
CVE-2026-72685 · Elasticsearch
A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the availability of indexing operations on the affected node.
Published 13 Aug 2026 · Fixed in 8.19.20, 9.4.5 · NVD - Medium 6.5
CVE-2026-72684 · Elasticsearch
A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that were intended to constrain it. The resulting…
Published 13 Aug 2026 · Fixed in 8.19.20, 9.4.5 · NVD - Medium 6.5
CVE-2026-72683 · Elasticsearch
A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate) to submit a request that causes a self-referential data structure to be created. When a specific internal component later processes that structure, the operation recurses without…
Published 13 Aug 2026 · Fixed in 8.19.19, 9.3.8, 9.4.4 · NVD - Medium 6.5
CVE-2026-72679 · Elasticsearch
Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and causing a denial of service for that node. An authenticated user holding only read-only privileges on a…
Published 13 Aug 2026 · Fixed in 8.19.20, 9.4.5 · NVD - Medium 6.5
CVE-2026-72678 · Elasticsearch
Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting memory exhaustion raises a fatal error that…
Published 13 Aug 2026 · Fixed in 8.19.20, 9.4.5, 9.5.1 · NVD - Medium 6.5
CVE-2026-72656 · Elasticsearch
Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amount of heap memory, exhausting the available heap on the receiving node and causing the node to…
Published 13 Aug 2026 · Fixed in 8.18.0 · NVD - Medium 6.5
CVE-2026-72647 · Elasticsearch
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node.
Published 13 Aug 2026 · Fixed in 8.19.20, 9.4.5 · NVD - Medium 6.5
CVE-2026-72645 · Elasticsearch
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memory allocation, exhausting the JVM heap and terminating the affected node.
Published 13 Aug 2026 · Fixed in 8.19.20, 9.4.5, 9.5.1 · NVD - High 8.8
CVE-2026-72642 · Elasticsearch
The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes…
Published 13 Aug 2026 · Fixed in 8.19.20, 9.4.5, 9.5.1 · NVD - Medium 6.5
CVE-2026-72639 · Elasticsearch
Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one small search request that causes the node to reserve an excessively large internal data structure.…
Published 13 Aug 2026 · Fixed in 8.19.20, 9.4.5, 9.5.1 · NVD - Medium 6.5
CVE-2026-72638 · Elasticsearch
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and…
Published 13 Aug 2026 · Fixed in 8.19.20, 9.4.5 · NVD - Medium 6.5
CVE-2026-72636 · Elasticsearch
Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of…
Published 13 Aug 2026 · Fixed in 8.19.20, 9.4.5 · NVD - High 7.2
CVE-2026-6471 · PostgreSQL
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD - Medium 4.3
CVE-2026-6470 · PostgreSQL
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD - Low 3.8
CVE-2026-6469 · PostgreSQL
Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the prior statistics object owner. DROP TABLE remains able to remove statistics objects, so this exploit…
Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD - High 8.1
CVE-2026-6464 · PostgreSQL
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. "COPY FROM" with a filename is unaffected. The server administrator has…
Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.