Vulnerability database · updated every hour
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 9,661
- Published in 7 days
- 203
- Critical in 30 days
- 35
- Actively exploited
- 47
Latest vulnerabilities
9,661 vulnerabilities- Medium 5.9
CVE-2026-48954 · Joomla!
Improper validation leads to a generic XSS vector in the language override feature.
Published 7 Jul 2026 · Fixed in 5.4.7, 6.1.2 · NVD - Medium 5.9
CVE-2026-48953 · Joomla!
Lack of escaping leads to an XSS vulnerability in the generic image output layout.
Published 7 Jul 2026 · Fixed in 5.4.7, 6.1.2 · NVD - Medium 5.9
CVE-2026-48952 · Joomla!
Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.
Published 7 Jul 2026 · Fixed in 5.4.7, 6.1.2 · NVD - Medium 5.9
CVE-2026-48951 · Joomla!
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.
Published 7 Jul 2026 · Fixed in 5.4.7, 6.1.2 · NVD - Medium 5.9
CVE-2026-48950 · Joomla!
Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.
Published 7 Jul 2026 · Fixed in 5.4.7, 6.1.2 · NVD - Medium 5.9
CVE-2026-48949 · Joomla!
Lack of validation leads to an XSS vulnerability in the MFA management views.
Published 7 Jul 2026 · Fixed in 5.4.7, 6.1.2 · NVD - Medium 6.4
CVE-2026-48948 · Joomla!
An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.
Published 7 Jul 2026 · Fixed in 5.4.7, 6.1.2 · NVD - Medium 6.4
CVE-2026-48947 · Joomla!
An improper access check allows privileged users to overwrite media files without editing permissions.
Published 7 Jul 2026 · Fixed in 5.4.7, 6.1.2 · NVD - Medium 5.3
CVE-2026-14355 · PHP
In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory,…
Published 3 Jul 2026 · Fixed in 8.3.32, 8.4.23, 8.5.8 · NVD - High 7.4
CVE-2026-9547 · curl
When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism…
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - High 7.5
CVE-2026-9546 · curl
A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended…
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - High 7.5
CVE-2026-9545 · curl
In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the…
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - High 7.3
CVE-2026-9080 · curl
Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - Critical 9.8
CVE-2026-9079 · curl
libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - High 7.5
CVE-2026-8932 · curl
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them…
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - Critical 9.1
CVE-2026-8927 · curl
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - Critical 9.1
CVE-2026-8926 · curl
When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://[email protected]/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - Critical 9.8
CVE-2026-8925 · curl
The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - Critical 9.1
CVE-2026-8924 · curl
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - Medium 6.5
CVE-2026-8458 · curl
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that…
Published 3 Jul 2026 · Fixed in 8.20.0 · NVD - High 8.1
CVE-2026-8286 · curl
A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - High 7.5
CVE-2026-12064 · curl
When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully…
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - Critical 9.8
CVE-2026-11856 · curl
Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - High 7.5
CVE-2026-11586 · curl
By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - Critical 9.1
CVE-2026-11564 · curl
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - High 7.5
CVE-2026-11352 · curl
An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - Critical 9.8
CVE-2026-10536 · curl
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed…
Published 3 Jul 2026 · Fixed in 8.21.0 · NVD - High 8.2
CVE-2026-55952 · Erlang/OTP
The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. In tls_handshake_1_3:handle_pre_shared_key/3, an OfferedPreSharedKeys record with a mismatched number of identities and binders is forwarded directly to…
Published 2 Jul 2026 · Fixed in 27.3.4.14, 28.5.0.3, 29.0.3 · NVD - High 8.7
CVE-2026-55950 · Erlang/OTP
Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener. A DTLS server listener uses a single shared dtls_packet_demux gen_server process to route incoming UDP datagrams to the correct connection handler. When a DTLS client reconnects rapidly from the…
Published 2 Jul 2026 · Fixed in 27.3.4.14, 28.5.0.3, 29.0.3 · NVD - Medium 6.3
CVE-2026-54891 · Erlang/OTP
Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data. The function tls_gen_connection:handle_protocol_record/3 rejects APPLICATION_DATA records that arrive…
Published 2 Jul 2026 · Fixed in 27.3.4.14, 28.5.0.3, 29.0.3 · NVD - Medium 6.3
CVE-2026-54887 · Erlang/OTP
Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary (<<>>) instead of a random value. Because HMAC with an empty key is deterministic,…
Published 2 Jul 2026 · Fixed in 27.3.4.14, 28.5.0.3, 29.0.3 · NVD - Medium 5.3
CVE-2026-54886 · Erlang/OTP
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive. The handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty…
Published 2 Jul 2026 · Fixed in 27.3.4.14, 28.5.0.3, 29.0.3 · NVD - Low 2.3
CVE-2026-53422 · Erlang/OTP
Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls relate_file_name/3 with Canonicalize=false, unlike every other SFTP operation handler. This allows .. components in the requested path to…
Published 2 Jul 2026 · Fixed in 27.3.4.14, 28.5.0.3, 29.0.3 · NVD - Medium 6.9
CVE-2026-58517 · MediaWiki
Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Medium 6.9
CVE-2026-14358 · MediaWiki
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Charts Extension: from * before 1.43.9,1.44.6,1.45.4.
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Medium 6.9
CVE-2026-58520 · MediaWiki
URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4.
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Medium 6.5
CVE-2026-49090 · Elasticsearch
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request that causes sustained high CPU consumption, which can render the affected node unable to process requests.
Published 1 Jul 2026 · Fixed in 7.17.24, 8.15.0 · NVD - Medium 4.9
CVE-2026-56149 · Elasticsearch
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted machine learning request that causes excessive memory consumption, which may render the affected node unavailable.
Published 1 Jul 2026 · Fixed in 8.19.17, 9.3.6, 9.4.3 · NVD - Medium 6.5
CVE-2026-56148 · Elasticsearch
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excessive resource consumption while the request is processed, which may render the affected node unavailable.
Published 1 Jul 2026 · Fixed in 8.19.17, 9.3.6, 9.4.3 · NVD - Unrated
CVE-2026-8857 · MediaWiki
A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Unrated
CVE-2026-58038 · MediaWiki
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files includes/Timeline.Php, scripts/EasyTimeline.Pl. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Unrated
CVE-2026-58037 · MediaWiki
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/PatrolLogFormatter.Php, includes/Logging/RenameuserLogFormatter.Php,…
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Low 2.1
CVE-2026-58036 · MediaWiki
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php.
Published 1 Jul 2026 · NVD - Medium 5.3
CVE-2026-58033 · MediaWiki
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/InfoAction.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Medium 5.3
CVE-2026-58032 · MediaWiki
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Api/index.Js. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Medium 5.3
CVE-2026-58030 · MediaWiki
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This vulnerability is associated with program files includes/SyntaxHighlight.Php. This issue affects SyntaxHighlight_GeSHi: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Medium 5.3
CVE-2026-58029 · MediaWiki
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUnlinkAccounts.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Unrated
CVE-2026-58028 · MediaWiki
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php,…
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Medium 5.3
CVE-2026-58027 · MediaWiki
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php. This issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Unrated
CVE-2026-58026 · MediaWiki
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Parser/Parser.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.