Vulnerability database · updated every hour
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 9,661
- Published in 7 days
- 203
- Critical in 30 days
- 35
- Actively exploited
- 47
Latest vulnerabilities
9,661 vulnerabilities- Low 2.3
CVE-2026-18703 · MongoDB
An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow authentication through a method the administrator intended to disable.
Published 11 Aug 2026 · Fixed in 8.3.8 · NVD - Medium 5.3
CVE-2026-18702 · MongoDB
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring unauthorized activity, or degrade operational monitoring by causing excessive log volume.
Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD - High 7.1
CVE-2026-18701 · MongoDB
An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.
Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD - Medium 6.0
CVE-2026-18700 · MongoDB
An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service.
Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD - Medium 6.0
CVE-2026-18699 · MongoDB
An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connected clients and in-flight operations.
Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD - Medium 5.3
CVE-2026-18698 · MongoDB
An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations, unauthorized modification of system collection data.
Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD - High 8.7
CVE-2026-18697 · MongoDB
An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.
Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD - High 7.0
CVE-2026-18696 · MongoDB
An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined between the authorization check and the actual…
Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD - High 7.1
CVE-2026-18695 · MongoDB
An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service.
Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD - High 7.1
CVE-2026-18694 · MongoDB
An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memory outside its intended bounds. This could result in a server crash (denial of service) and may…
Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD - High 7.2
CVE-2026-18693 · MongoDB
An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service),…
Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD - High 7.7
CVE-2026-18692 · MongoDB
An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code.
Published 11 Aug 2026 · Fixed in 8.0.29, 8.3.8 · NVD - Critical 9.0
CVE-2026-18691 · MongoDB
An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If…
Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD - High 7.2
CVE-2026-18690 · MongoDB
An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.
Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD - High 7.1
CVE-2026-18688 · MongoDB
An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may potentially expose a limited amount of memory contents.
Published 11 Aug 2026 · Fixed in 7.0.40, 8.0.29, 8.3.8 · NVD - High 7.1
CVE-2026-18687 · MongoDB
MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of…
Published 11 Aug 2026 · Fixed in 8.0.29, 8.3.8 · NVD - Critical 9.1Actively exploited
CVE-2026-71362 · Magento / Adobe Commerce
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
Published 11 Aug 2026 · Fixed in 2.4.4 · NVD - High 7.5
CVE-2026-48416 · Magento / Adobe Commerce
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
Published 11 Aug 2026 · NVD - High 8.3
CVE-2026-48415 · Magento / Adobe Commerce
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.
Published 11 Aug 2026 · NVD - High 8.7
CVE-2026-48414 · Magento / Adobe Commerce
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session.…
Published 11 Aug 2026 · NVD - High 8.7
CVE-2026-48413 · Magento / Adobe Commerce
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope…
Published 11 Aug 2026 · NVD - High 7.2
CVE-2026-48412 · Magento / Adobe Commerce
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user interaction.
Published 11 Aug 2026 · NVD - Medium 4.9
CVE-2026-48411 · Magento / Adobe Commerce
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
Published 11 Aug 2026 · NVD - High 8.9
CVE-2026-64638 · WordPress
Pre-auth reflected XSS on login screen with potential to lead to PHP code execution
Published 6 Aug 2026 · Fixed in 6.8.7, 6.9.6, 7.0.3 · WordPress - Medium 6.1
CVE-2026-92554 · Woolentor Addons (WordPress plugin)
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting
Published 4 Aug 2026 · Fixed in 3.5.2 · WPVulnerability - High 7.2
CVE-2026-6020 · Woolentor Addons (WordPress plugin)
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Unsafe Reflection
Published 4 Aug 2026 · Fixed in 3.3.8 · WPVulnerability - High 7.1
CVE-2026-66702 · SEO By Rank Math (WordPress plugin)
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting
Published 31 Jul 2026 · Fixed in 1.0.275 · WPVulnerability - Medium 6.5
CVE-2026-66695 · W3 Total Cache (WordPress plugin)
W3 Total Cache: Path Traversal: '.../...//'
Published 31 Jul 2026 · Fixed in 2.10.3 · WPVulnerability - Medium 5.4
CVE-2026-7260 · PHP
Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
Published 30 Jul 2026 · Fixed in 8.3.33, 8.4.24, 8.5.9 · NVD - High 8.1
CVE-2026-17544 · PHP
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
Published 30 Jul 2026 · Fixed in 8.4.24, 8.5.9 · NVD - High 8.1
CVE-2026-17543 · PHP
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
Published 30 Jul 2026 · Fixed in 8.3.33, 8.4.24, 8.5.9 · NVD - High 8.4
CVE-2026-58043 · Node.js
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
Published 30 Jul 2026 · NVD - Medium 4.4
CVE-2026-56850 · Node.js
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Published 30 Jul 2026 · NVD - Medium 6.1
CVE-2026-56847 · Node.js
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Published 30 Jul 2026 · NVD - Medium 5.3
CVE-2026-6336 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check.
Published 29 Jul 2026 · Fixed in 19.0.5, 19.1.3 · NVD - Medium 5.3
CVE-2026-6267 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access controls on internal request handling.
Published 29 Jul 2026 · Fixed in 19.0.5, 19.1.3 · NVD - Medium 4.3
CVE-2026-4672 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to view due to improper access control enforcement.
Published 29 Jul 2026 · Fixed in 19.0.5, 19.1.3 · NVD - Medium 4.7
CVE-2026-3093 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper sanitization of user-controlled input.
Published 29 Jul 2026 · Fixed in 19.0.5, 19.1.3 · NVD - Medium 5.4
CVE-2026-16553 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in virtual registries.
Published 29 Jul 2026 · Fixed in 19.0.5, 19.1.3 · NVD - High 7.5
CVE-2026-15975 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing merge request discussions.
Published 29 Jul 2026 · Fixed in 19.0.5, 19.1.3 · NVD - Medium 4.3
CVE-2026-15831 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during token generation.
Published 29 Jul 2026 · Fixed in 19.1.3 · NVD - Medium 4.3
CVE-2026-15077 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed by the AI-assisted code review functionality.
Published 29 Jul 2026 · Fixed in 19.1.3 · NVD - Medium 4.3
CVE-2026-14351 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly accessible merge request due to improper authorization checks.
Published 29 Jul 2026 · Fixed in 19.0.5, 19.1.3 · NVD - Medium 4.9
CVE-2026-14341 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Maintainer role to modify protected branch configuration due to improper authorization in a projects API endpoint.
Published 29 Jul 2026 · Fixed in 19.0.5, 19.1.3 · NVD - Medium 5.3
CVE-2026-13113 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race condition in approval rule processing.
Published 29 Jul 2026 · Fixed in 19.0.5, 19.1.3 · NVD - High 8.4
CVE-2026-12436 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of user-supplied attributes when processing pipeline schedule inputs.
Published 29 Jul 2026 · Fixed in 19.0.5, 19.1.3 · NVD - Low 3.1
CVE-2025-14562 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes to a project after being removed as a member, due to improper authorization checks on merge request collaboration settings.
Published 29 Jul 2026 · Fixed in 19.0.5, 19.1.3 · NVD - Medium 5.3
CVE-2026-66299 · Apache Tomcat
Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. Users are recommended to remove the examples web application or…
Published 28 Jul 2026 · Fixed in 9.0.121, 10.1.58, 11.0.25 · NVD - High 8.7
CVE-2026-59251 · Erlang/OTP
Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in public_key:pkix_path_validation/3, the certificate policy tree maintained by pubkey_policy_tree grows without an upper bound. When…
Published 27 Jul 2026 · Fixed in 27.3.4.15, 28.5.0.4, 29.0.4 · NVD - High 8.7
CVE-2026-58227 · Erlang/OTP
The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the received chain is passed to ssl_certificate:build_certificate_chain/5, which walks issuer relationships via ssl_certificate:do_certificate_chain/7 with no cycle detection and no depth limit. When the peer…
Published 27 Jul 2026 · Fixed in 27.3.4.15, 28.5.0.4, 29.0.4 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.