UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
9,661
Published in 7 days
203
Critical in 30 days
35
Actively exploited
47

Latest vulnerabilities

9,661 vulnerabilities
  1. Critical 9.1

    CVE-2026-55953 · Erlang/OTP

    The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to…

    Published 27 Jul 2026 · Fixed in 27.3.4.15, 28.5.0.4, 29.0.4 · NVD
  2. Medium 5.1

    CVE-2026-55737 · Erlang/OTP

    Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field…

    Published 27 Jul 2026 · Fixed in 27.3.4.15, 28.5.0.4, 29.0.4 · NVD
  3. High 8.2

    CVE-2026-54890 · Erlang/OTP

    Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both…

    Published 27 Jul 2026 · Fixed in 27.3.4.15, 28.5.0.4, 29.0.4 · NVD
  4. Medium 6.3

    CVE-2026-42792 · Erlang/OTP

    Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file…

    Published 27 Jul 2026 · Fixed in 27.3.4, 28.5.0.4, 29.0.4 · NVD
  5. Medium 4.9

    CVE-2026-16811 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: SQL Injection

    Published 27 Jul 2026 · Fixed in 3.4.6 · WPVulnerability
  6. Medium 4.3

    CVE-2026-16797 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Authorization Bypass Through User-Controlled Key

    Published 27 Jul 2026 · Fixed in 3.4.6 · WPVulnerability
  7. High 7.5

    CVE-2026-44907 · react-server-dom-parcel, react-server-dom-turbopack, React

    react-server-dom: Denial of Service in Server Functions

    Published 24 Jul 2026 · Fixed in 19.0.8, 19.1.9, 19.2.8 · OSV.dev and GitHub
  8. High 7.2

    CVE-2026-18409 · WPForms

    WPForms Pro: Cross-site Scripting

    Published 24 Jul 2026 · Fixed in 2.0.0.3 · WPVulnerability
  9. Unrated

    CVE-2026-15425 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 24 Jul 2026 · Fixed in 28.1 · WPVulnerability
  10. High

    CVE-2026-64649 · Next.js

    Next.js: Server-Side Request Forgery in Server Actions on custom servers

    Published 22 Jul 2026 · Fixed in 15.5.21, 16.2.11 · OSV.dev and GitHub
  11. Medium

    CVE-2026-64648 · Next.js

    Next.js: Cache confusion of response bodies for requests with bodies

    Published 22 Jul 2026 · Fixed in 15.5.21, 16.2.11 · OSV.dev and GitHub
  12. Medium

    CVE-2026-64647 · Next.js

    Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

    Published 22 Jul 2026 · Fixed in 15.5.21, 16.2.11 · OSV.dev and GitHub
  13. Medium

    CVE-2026-64646 · Next.js

    Next.js: Unbounded Server Action payload in Edge runtime

    Published 22 Jul 2026 · Fixed in 15.5.21, 16.2.11 · OSV.dev and GitHub
  14. High

    CVE-2026-64645 · Next.js

    Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

    Published 22 Jul 2026 · Fixed in 15.5.21, 16.2.11 · OSV.dev and GitHub
  15. Medium

    CVE-2026-64644 · Next.js

    Next.js: Denial of Service in the Image Optimization API using SVGs

    Published 22 Jul 2026 · Fixed in 15.5.21, 16.2.11 · OSV.dev and GitHub
  16. Medium

    CVE-2026-64643 · Next.js

    Next.js: Unauthenticated disclosure of internal Server Function endpoints

    Published 22 Jul 2026 · Fixed in 15.5.21, 16.2.11 · OSV.dev and GitHub
  17. High

    CVE-2026-64642 · Next.js

    Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

    Published 22 Jul 2026 · Fixed in 16.2.11 · OSV.dev and GitHub
  18. High

    CVE-2026-64641 · Next.js

    Next.js: Denial of Service in App Router using Server Actions

    Published 22 Jul 2026 · Fixed in 15.5.21, 16.2.11 · OSV.dev and GitHub
  19. High 7.1

    CVE-2026-9737 · MongoDB

    During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.

    Published 22 Jul 2026 · Fixed in 7.0.39, 8.0.28, 8.3.7 · NVD
  20. Medium 6.3

    CVE-2026-13078 · MongoDB

    A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB…

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  21. High 7.1

    CVE-2026-13077 · MongoDB

    A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is…

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  22. High 7.1

    CVE-2026-13076 · MongoDB

    An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and requires both write access to the database and the ability to run aggregation queries.

    Published 22 Jul 2026 · Fixed in 8.3.7 · NVD
  23. High 7.1

    CVE-2026-13075 · MongoDB

    An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.

    Published 22 Jul 2026 · Fixed in 8.2.12, 8.3.7 · NVD
  24. Medium 6.9

    CVE-2026-13074 · MongoDB

    An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability.

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  25. Medium 5.3

    CVE-2026-13073 · MongoDB

    An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency triggered by a specific combination of aggregation options.

    Published 22 Jul 2026 · Fixed in 8.0.28 · NVD
  26. Critical 9.2

    CVE-2026-13072 · MongoDB

    When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  27. High 7.1

    CVE-2026-13071 · MongoDB

    An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  28. Medium 6.0

    CVE-2026-13070 · MongoDB

    A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a certificate issued by the cluster's trusted certificate authority, or for the connection to traverse…

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  29. High 7.1

    CVE-2026-13069 · MongoDB

    An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  30. Low 2.3

    CVE-2026-13068 · MongoDB

    An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges to the appropriate namespace.

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  31. High 7.2

    CVE-2026-13067 · MongoDB

    When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate…

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.3.7 · NVD
  32. High 7.1

    CVE-2026-13066 · MongoDB

    Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  33. High 7.1

    CVE-2026-13065 · MongoDB

    A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  34. High 7.1

    CVE-2026-13064 · MongoDB

    Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  35. Medium 5.3

    CVE-2026-13063 · MongoDB

    An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively large memory allocation.

    Published 22 Jul 2026 · Fixed in 8.2.12, 8.3.7 · NVD
  36. High 7.1

    CVE-2026-13062 · MongoDB

    An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  37. Medium 5.3

    CVE-2026-13061 · MongoDB

    An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.

    Published 22 Jul 2026 · Fixed in 7.0.39, 8.0.28, 8.3.7 · NVD
  38. High 7.1

    CVE-2026-13060 · MongoDB

    An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  39. High 8.6

    CVE-2026-13059 · MongoDB

    An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  40. High 7.1

    CVE-2026-13058 · MongoDB

    An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure and denial of service.

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  41. Medium 6.0

    CVE-2026-13057 · MongoDB

    An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due to insufficient input validation, an authenticated client can supply these fields directly.

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  42. High 7.1

    CVE-2026-13056 · MongoDB

    Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.3.7 · NVD
  43. High 7.1

    CVE-2026-13055 · MongoDB

    The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

    Published 22 Jul 2026 · Fixed in 8.0.28, 8.2.12, 8.3.7 · NVD
  44. Medium 6.5

    CVE-2026-63263 · Elasticsearch

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource exhaustion persists beyond query completion, repeated requests can fully exhaust the available…

    Published 22 Jul 2026 · Fixed in 8.19.19, 9.3.8, 9.4.4 · NVD
  45. Medium 6.5

    CVE-2026-63144 · Elasticsearch

    Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node…

    Published 21 Jul 2026 · Fixed in 8.19.19, 9.3.8, 9.4.4 · NVD
  46. Medium 4.9

    CVE-2026-61144 · MySQL

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can…

    Published 21 Jul 2026 · NVD
  47. Medium 4.9

    CVE-2026-61128 · MySQL

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can…

    Published 21 Jul 2026 · NVD
  48. Medium 6.5

    CVE-2026-61109 · MySQL

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.…

    Published 21 Jul 2026 · NVD
  49. Medium 6.5

    CVE-2026-61108 · MySQL

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result…

    Published 21 Jul 2026 · NVD
  50. Low 2.9

    CVE-2026-61096 · MySQL

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to…

    Published 21 Jul 2026 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.