UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
9,661
Published in 7 days
203
Critical in 30 days
35
Actively exploited
47

Latest vulnerabilities

9,661 vulnerabilities
  1. High 8.8

    CVE-2026-15005 · Loco Translate (WordPress plugin)

    Loco Translate: Cross-Site Request Forgery (CSRF)

    Published 15 Jul 2026 · Fixed in 2.8.6 · WPVulnerability
  2. Medium 5.4

    CVE-2026-48371 · Magento / Adobe Commerce

    Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

    Published 14 Jul 2026 · NVD
  3. Critical 9.1

    CVE-2026-48358 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

    Published 14 Jul 2026 · NVD
  4. Critical 9.3

    CVE-2026-48356 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a…

    Published 14 Jul 2026 · NVD
  5. Low 3.7

    CVE-2026-48001 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

    Published 14 Jul 2026 · NVD
  6. Medium 6.1

    CVE-2026-48000 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Improper Redirect (Open Redirect) vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim must click on a malicious link. Scope is changed.

    Published 14 Jul 2026 · NVD
  7. Medium 4.8

    CVE-2026-47999 · Magento / Adobe Commerce

    Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

    Published 14 Jul 2026 · NVD
  8. Medium 5.9

    CVE-2026-47998 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

    Published 14 Jul 2026 · NVD
  9. Medium 5.9

    CVE-2026-47997 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

    Published 14 Jul 2026 · NVD
  10. Medium 6.8

    CVE-2026-47996 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could lead to arbitrary file system read. A high-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

    Published 14 Jul 2026 · NVD
  11. High 8.1

    CVE-2026-47995 · Magento / Adobe Commerce

    Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session.…

    Published 14 Jul 2026 · NVD
  12. High 8.7

    CVE-2026-47994 · Magento / Adobe Commerce

    Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope…

    Published 14 Jul 2026 · NVD
  13. High 7.2

    CVE-2026-47992 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to execute malicious SQL commands, potentially gaining elevated access or control over the victim's account or session.…

    Published 14 Jul 2026 · NVD
  14. High 8.6

    CVE-2026-47988 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.

    Published 14 Jul 2026 · NVD
  15. High 8.2

    CVE-2026-47984 · Magento / Adobe Commerce

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.

    Published 14 Jul 2026 · NVD
  16. Critical 9.1

    CVE-2026-59084 · Apache Tomcat

    Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support…

    Published 14 Jul 2026 · NVD
  17. Critical 9.1

    CVE-2026-59083 · Apache Tomcat

    Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are…

    Published 14 Jul 2026 · NVD
  18. High 7.5

    CVE-2026-55233 · OpenResty

    OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the stream proxy protocol v2 patch can write beyond the bounds of the allocated buffer, causing the worker…

    Published 10 Jul 2026 · Fixed in 1.29.2.5 · NVD
  19. High 7.5

    CVE-2026-9282 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Path Traversal

    Published 10 Jul 2026 · Fixed in 2.10.0 · WPVulnerability
  20. Medium 5.3

    CVE-2026-59828 · Discourse

    Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, post revisions that should be hidden from regular users could be leaked through visible diffs on adjacent revisions serialized by PostRevisionSerializer. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

    Published 9 Jul 2026 · Fixed in 2026.1.5, 2026.4.2, 2026.5.1 · NVD
  21. High 7.4

    CVE-2026-55424 · Discourse

    Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not sufficiently normalized and escaped before being rendered in the topic list, allowing a user who can set a featured link to inject JavaScript when default Content Security Policy protections were modified or disabled. This issue is fixed in versions 2026.6.0,…

    Published 9 Jul 2026 · Fixed in 2026.1.5, 2026.4.2, 2026.5.1 · NVD
  22. Critical 9.0

    CVE-2026-53963 · Discourse

    Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that account. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

    Published 9 Jul 2026 · Fixed in 2026.1.5, 2026.4.2, 2026.5.1 · NVD
  23. Medium 5.4

    CVE-2026-53962 · Discourse

    Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG sanitization in upload and user avatar handling could lead to cross-site scripting when a user visited specific URLs that are not normally part of community browsing. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

    Published 9 Jul 2026 · Fixed in 2026.1.5, 2026.4.2, 2026.5.1 · NVD
  24. Medium 6.5

    CVE-2026-53961 · Discourse

    Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish validly signed forged Bounce notifications that revoke a targeted user email. This issue is fixed in…

    Published 9 Jul 2026 · Fixed in 2026.1.5, 2026.4.2, 2026.5.1 · NVD
  25. Medium 6.3

    CVE-2026-49256 · Discourse

    Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable categories as allowed_tags, allowed_tag_groups, or required tag groups could leak to anonymous and unauthorized users through category and group endpoints. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

    Published 9 Jul 2026 · Fixed in 2026.1.5, 2026.4.2, 2026.5.1 · NVD
  26. Medium 6.5

    CVE-2026-46413 · Discourse

    Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

    Published 9 Jul 2026 · Fixed in 2026.1.5, 2026.4.2, 2026.5.1 · NVD
  27. Medium 6.3

    CVE-2026-45788 · Discourse

    Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, secure uploads could be exposed by pull_hotlinked_images when an attacker knew the secured upload URL and the secure_uploads site setting was enabled. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

    Published 9 Jul 2026 · Fixed in 2026.1.5, 2026.4.2, 2026.5.1 · NVD
  28. Medium 4.3

    CVE-2026-45780 · Discourse

    Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

    Published 9 Jul 2026 · Fixed in 2026.1.5, 2026.4.2, 2026.5.1 · NVD
  29. High 7.1

    CVE-2026-44787 · Discourse

    Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primary_group_id and gain whisper-group privileges without legitimate group membership on sites with whispers_allowed_groups configured. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

    Published 9 Jul 2026 · Fixed in 2026.1.5, 2026.4.2, 2026.5.1 · NVD
  30. High 8.1

    CVE-2026-55420 · Discourse

    Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to obtain RCE on the server. This issue is patched in 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

    Published 9 Jul 2026 · Fixed in 2026.1.5, 2026.4.2, 2026.5.1 · NVD
  31. High 8.7

    CVE-2026-15308 · Python

    The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

    Published 9 Jul 2026 · Fixed in 3.12.14, 3.13.15, 3.14.7 · NVD
  32. Medium 4.3

    CVE-2026-8472 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with minimal access permissions to read work item metadata from private projects due to missing authorization checks.

    Published 8 Jul 2026 · Fixed in 18.11.7, 19.0.4, 19.1.2 · NVD
  33. Medium 5.3

    CVE-2026-7492 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.1 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an unauthenticated user to determine the existence of a private project due to improper authorization controls on cross-project reference pages.

    Published 8 Jul 2026 · Fixed in 18.11.7, 19.0.4, 19.1.2 · NVD
  34. Medium 5.4

    CVE-2026-6896 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.

    Published 8 Jul 2026 · Fixed in 18.11.7, 19.0.4, 19.1.2 · NVD
  35. Low 2.7

    CVE-2026-6352 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with auditor-level access to modify compliance violation records due to improper authorization on certain GraphQL operations.

    Published 8 Jul 2026 · Fixed in 18.11.7, 19.0.4, 19.1.2 · NVD
  36. Medium 5.4

    CVE-2026-13320 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.

    Published 8 Jul 2026 · Fixed in 18.11.7, 19.0.4, 19.1.2 · NVD
  37. Medium 4.9

    CVE-2026-11827 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 9.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to obtain another user's stored credentials due to improper authorization controls.

    Published 8 Jul 2026 · Fixed in 18.11.7, 19.0.4, 19.1.2 · NVD
  38. Medium 4.3

    CVE-2025-12506 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed in the web interface differed from the content available for download, due to improper handling of Git reference name resolution.

    Published 8 Jul 2026 · Fixed in 18.11.7, 19.0.4, 19.1.2 · NVD
  39. Critical 9.4

    CVE-2026-60002 · OpenSSH

    ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)

    Published 8 Jul 2026 · Fixed in 10.4 · NVD
  40. Medium 6.5

    CVE-2026-60001 · OpenSSH

    sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.

    Published 8 Jul 2026 · Fixed in 10.4 · NVD
  41. High 7.5

    CVE-2026-60000 · OpenSSH

    sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.

    Published 8 Jul 2026 · Fixed in 10.4 · NVD
  42. High 7.5

    CVE-2026-59999 · OpenSSH

    In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.

    Published 8 Jul 2026 · Fixed in 10.4 · NVD
  43. Medium 6.5

    CVE-2026-59998 · OpenSSH

    sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.

    Published 8 Jul 2026 · Fixed in 10.4 · NVD
  44. Medium 5.4

    CVE-2026-59997 · OpenSSH

    internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.

    Published 8 Jul 2026 · Fixed in 10.4 · NVD
  45. Medium 5.4

    CVE-2026-59996 · OpenSSH

    scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.

    Published 8 Jul 2026 · Fixed in 10.4 · NVD
  46. Medium 5.4

    CVE-2026-59995 · OpenSSH

    sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.

    Published 8 Jul 2026 · Fixed in 10.4 · NVD
  47. Medium 6.4

    CVE-2026-48958 · Joomla!

    An improper access check allows unauthorized users to create custom fields via webservices endpoints.

    Published 7 Jul 2026 · Fixed in 5.4.7, 6.1.2 · NVD
  48. Medium 6.4

    CVE-2026-48957 · Joomla!

    An improper access check allows unauthorized users to access com_privacy datasets.

    Published 7 Jul 2026 · Fixed in 5.4.7, 6.1.2 · NVD
  49. Medium 6.4

    CVE-2026-48956 · Joomla!

    An improper access check allows users to display a list of modules in the frontend.

    Published 7 Jul 2026 · Fixed in 5.4.7, 6.1.2 · NVD
  50. Medium 6.4

    CVE-2026-48955 · Joomla!

    An improper access check allows unauthorized users to access workflow stage and transition information.

    Published 7 Jul 2026 · Fixed in 6.1.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.