UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
9,661
Published in 7 days
203
Critical in 30 days
35
Actively exploited
47

Latest vulnerabilities

9,661 vulnerabilities
  1. High 8.8

    CVE-2026-19385 · PostgreSQL

    Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  2. High 8.8

    CVE-2026-18408 · PostgreSQL

    Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient…

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  3. Medium 4.3

    CVE-2026-18024 · PostgreSQL

    Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  4. Low 3.8

    CVE-2026-16241 · PostgreSQL

    Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This typically yields a simple SIGSEGV, but rare cases might achieve client-specific integrity impact via the…

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  5. High 8.8

    CVE-2026-16239 · PostgreSQL

    Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  6. High 8.8

    CVE-2026-16238 · PostgreSQL

    Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  7. High 8.8

    CVE-2026-15742 · PostgreSQL

    Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  8. High 8.8

    CVE-2026-15741 · PostgreSQL

    SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  9. Medium 4.2

    CVE-2026-14681 · PostgreSQL

    Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser…

    Published 13 Aug 2026 · Fixed in 17.11, 18.5 · NVD
  10. High 8.8

    CVE-2026-14680 · PostgreSQL

    Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps.…

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  11. High 8.2

    CVE-2026-14679 · PostgreSQL

    Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  12. Medium 4.3

    CVE-2026-14678 · PostgreSQL

    Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  13. High 8.8

    CVE-2026-14677 · PostgreSQL

    Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  14. High 8.8

    CVE-2026-14676 · PostgreSQL

    Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

    Published 13 Aug 2026 · Fixed in 18.5 · NVD
  15. Low 3.8

    CVE-2026-14673 · PostgreSQL

    Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.6, 16.15, 15.19, and 14.24 are affected. PostgreSQL…

    Published 13 Aug 2026 · Fixed in 15.19, 16.15, 18.5 · NVD
  16. Medium 5.3

    CVE-2026-14672 · PostgreSQL

    Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before…

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  17. High 8.8

    CVE-2026-14671 · PostgreSQL

    Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  18. High 8.8

    CVE-2026-14670 · PostgreSQL

    Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  19. High 8.8

    CVE-2026-14669 · PostgreSQL

    Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  20. High 8.1

    CVE-2026-14668 · PostgreSQL

    Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  21. Medium 4.2

    CVE-2026-14666 · PostgreSQL

    Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and…

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  22. High 8.8

    CVE-2026-14664 · PostgreSQL

    Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  23. Medium 6.5

    CVE-2026-14663 · PostgreSQL

    Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection…

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  24. High 8.8

    CVE-2026-14662 · PostgreSQL

    Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence,…

    Published 13 Aug 2026 · Fixed in 16.15, 17.11, 18.5 · NVD
  25. High 7.2

    CVE-2026-18109 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-site Scripting

    Published 13 Aug 2026 · Fixed in 2.10.4 · WPVulnerability
  26. Medium 4.3

    CVE-2026-6821 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.

    Published 12 Aug 2026 · Fixed in 19.0.6, 19.1.4, 19.2.2 · NVD
  27. Medium 4.3

    CVE-2026-4879 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint.

    Published 12 Aug 2026 · Fixed in 19.0.6, 19.1.4, 19.2.2 · NVD
  28. High 8.5

    CVE-2026-19228 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.

    Published 12 Aug 2026 · Fixed in 19.1.4, 19.2.2 · NVD
  29. Medium 4.3

    CVE-2026-18433 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query.

    Published 12 Aug 2026 · Fixed in 19.1.4, 19.2.2 · NVD
  30. High 7.1

    CVE-2026-16494 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.

    Published 12 Aug 2026 · Fixed in 19.1.4, 19.2.2 · NVD
  31. High 8.7

    CVE-2026-15217 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component.

    Published 12 Aug 2026 · Fixed in 19.0.6, 19.1.4, 19.2.2 · NVD
  32. High 8.7

    CVE-2026-15216 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.

    Published 12 Aug 2026 · Fixed in 19.0.6, 19.1.4, 19.2.2 · NVD
  33. Low 3.3

    CVE-2025-9486 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state.

    Published 12 Aug 2026 · Fixed in 19.0.6, 19.1.4, 19.2.2 · NVD
  34. Medium 4.3

    CVE-2026-8667 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required maintainer-level permissions due to improper authorization checks.

    Published 12 Aug 2026 · Fixed in 19.0.6, 19.1.4, 19.2.2 · NVD
  35. High 7.5

    CVE-2026-7427 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation.

    Published 12 Aug 2026 · Fixed in 19.0.6, 19.1.4, 19.2.2 · NVD
  36. Medium 4.3

    CVE-2026-18244 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page.

    Published 12 Aug 2026 · Fixed in 19.0.6, 19.1.4, 19.2.2 · NVD
  37. Critical 9.0

    CVE-2026-16627 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.

    Published 12 Aug 2026 · Fixed in 19.2.2 · NVD
  38. High 8.5

    CVE-2026-15423 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.

    Published 12 Aug 2026 · Fixed in 19.0.6, 19.1.4, 19.2.2 · NVD
  39. High 8.8

    CVE-2026-65640 · WordPress

    Remote code execution vulnerability via malicious file upload by an Author level user or higher

    Published 12 Aug 2026 · Fixed in 6.8.8, 6.9.7, 7.0.4 · WordPress
  40. Low 2.5

    CVE-2026-73283 · OpenSSH

    In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

    Published 11 Aug 2026 · Fixed in 10.5 · NVD
  41. Medium 4.8

    CVE-2026-73282 · OpenSSH

    In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

    Published 11 Aug 2026 · Fixed in 10.5 · NVD
  42. Low 3.5

    CVE-2026-73281 · OpenSSH

    In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension.

    Published 11 Aug 2026 · Fixed in 10.5 · NVD
  43. High 7.2

    CVE-2026-18712 · MongoDB

    An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.

    Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD
  44. High 7.1

    CVE-2026-18711 · MongoDB

    An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server crash or disclosure of freed memory contents within query results.

    Published 11 Aug 2026 · Fixed in 8.0.29, 8.3.8 · NVD
  45. Medium 5.9

    CVE-2026-18709 · MongoDB

    An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.

    Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD
  46. Medium 5.3

    CVE-2026-18708 · MongoDB

    An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their…

    Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD
  47. Medium 5.3

    CVE-2026-18707 · MongoDB

    An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.

    Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD
  48. High 7.5

    CVE-2026-18706 · MongoDB

    An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.

    Published 11 Aug 2026 · Fixed in 8.3.8 · NVD
  49. High 7.1

    CVE-2026-18705 · MongoDB

    An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.

    Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD
  50. High 7.1

    CVE-2026-18704 · MongoDB

    An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations.

    Published 11 Aug 2026 · Fixed in 8.3.8 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.