Vulnerability database · updated every hour
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 9,661
- Published in 7 days
- 203
- Critical in 30 days
- 35
- Actively exploited
- 47
Latest vulnerabilities
9,661 vulnerabilities- Medium 5.9
CVE-2026-58025 · MediaWiki
Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Medium 5.1
CVE-2026-58024 · MediaWiki
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiUserrights.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Unrated
CVE-2026-13707 · MediaWiki
Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Unrated
CVE-2026-13706 · MediaWiki
Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php.
Published 1 Jul 2026 · Fixed in 1.43.9, 1.44.6, 1.45.4 · NVD - Unrated
CVE-2026-58035 · MediaWiki
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue.
Published 1 Jul 2026 · NVD - Unrated
CVE-2026-58034 · MediaWiki
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/blockConnectedTempAccountsField.Vue. This issue affects CheckUser: from 1.46.0-rc.0 before 1.46.0.
Published 1 Jul 2026 · NVD - Unrated
CVE-2026-58031 · MediaWiki
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.
Published 1 Jul 2026 · NVD - Medium 6.9
CVE-2026-58518 · MediaWiki
Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issue affects Mediawiki - RedirectManager Extension: from * before 1.3.3.
Published 1 Jul 2026 · Fixed in 1.3.3 · NVD - Low 2.0
CVE-2026-4360 · Python
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.
Published 30 Jun 2026 · Fixed in 3.1.5 · NVD - High 7.1
CVE-2026-57678 · Slider Revolution
Slider Revolution: Cross-site Scripting
Published 30 Jun 2026 · Fixed in 7.1.0 · WPVulnerability - Medium 5.3
CVE-2026-12127 · WPForms Lite
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: CRLF Injection
Published 30 Jun 2026 · Fixed in 1.10.2.1 · WPVulnerability - High 7.3
CVE-2026-55957 · Apache Tomcat
Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.…
Published 29 Jun 2026 · Fixed in 9.0.101, 10.1.37, 11.0.5 · NVD - Medium 6.5
CVE-2026-55956 · Apache Tomcat
Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions…
Published 29 Jun 2026 · Fixed in 9.0.119, 10.1.56, 11.0.23 · NVD - Medium 6.5
CVE-2026-55955 · Apache Tomcat
Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119,…
Published 29 Jun 2026 · Fixed in 9.0.119, 10.1.56, 11.0.23 · NVD - Critical 9.1
CVE-2026-55276 · Apache Tomcat
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support…
Published 29 Jun 2026 · Fixed in 9.0.119, 10.1.56, 11.0.23 · NVD - Critical 9.1
CVE-2026-53434 · Apache Tomcat
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.
Published 29 Jun 2026 · Fixed in 9.0.119, 10.1.56, 11.0.23 · NVD - High 7.3
CVE-2026-53404 · Apache Tomcat
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support…
Published 29 Jun 2026 · Fixed in 9.0.119, 10.1.56, 11.0.23 · NVD - Medium 6.1
CVE-2026-50229 · Apache Tomcat
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.…
Published 29 Jun 2026 · Fixed in 9.0.119, 10.1.56, 11.0.23 · NVD - Unrated
CVE-2026-8825 · Elementor
Elementor Website Builder – more than just a page builder: Exposure of Sensitive Information to an Unauthorized Actor
Published 29 Jun 2026 · Fixed in 4.1.4 · WPVulnerability - High 8.8
CVE-2026-62062 · Elementor
Elementor Website Builder – more than just a page builder: Cross-Site Request Forgery (CSRF)
Published 29 Jun 2026 · Fixed in 4.3.2 · WPVulnerability - Critical 9.0
CVE-2026-57623 · W3 Total Cache (WordPress plugin)
W3 Total Cache: Improper Validation of Specified Quantity in Input
Published 29 Jun 2026 · Fixed in 2.10.0 · WPVulnerability - Unrated
CVE-2026-10755 · All in One SEO
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Incorrect Authorization
Published 29 Jun 2026 · Fixed in 4.9.9 · WPVulnerability - Low 3.3
CVE-2026-48936 · Node.js
A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.
Published 26 Jun 2026 · NVD - Low 3.3
CVE-2026-48935 · Node.js
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Published 26 Jun 2026 · NVD - Medium 4.3
CVE-2026-48934 · Node.js
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Published 26 Jun 2026 · NVD - High 7.5
CVE-2026-48933 · Node.js
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Published 26 Jun 2026 · NVD - Critical 9.8
CVE-2026-48930 · Node.js
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Published 26 Jun 2026 · NVD - Medium 5.4
CVE-2026-48928 · Node.js
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Published 26 Jun 2026 · NVD - High 7.5
CVE-2026-48619 · Node.js
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Published 26 Jun 2026 · NVD - Medium 6.5
CVE-2026-48618 · Node.js
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js…
Published 26 Jun 2026 · NVD - High 7.5
CVE-2026-48615 · Node.js
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Published 26 Jun 2026 · NVD - Medium 4.4
CVE-2026-8330 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed sensitive information to be written to application logs due to insufficient filtering in a CI/CD API endpoint.
Published 25 Jun 2026 · Fixed in 18.11.6, 19.0.3 · NVD - Medium 4.3
CVE-2026-5952 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass package protection rules and overwrite protected Maven package metadata due to incorrect authorization checks.
Published 25 Jun 2026 · Fixed in 18.11.6, 19.0.3 · NVD - Medium 4.3
CVE-2026-5796 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with Reporter-level group permissions to view package metadata from projects with the Package Registry disabled due to incorrect authorization checks in the group packages feature.
Published 25 Jun 2026 · Fixed in 18.11.6, 19.0.3 · NVD - Medium 5.4
CVE-2026-5309 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to read or modify another group's virtual registry cleanup policy settings without authorization.
Published 25 Jun 2026 · Fixed in 18.11.6, 19.0.3 · NVD - Low 3.1
CVE-2026-3176 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with limited permissions to access project information due to insufficient authorization checks.
Published 25 Jun 2026 · Fixed in 18.11.6, 19.0.3 · NVD - Medium 5.3
CVE-2026-2238 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an unauthenticated user to view confidential issue references on public projects due to improper authorization checks.
Published 25 Jun 2026 · Fixed in 18.11.6, 19.0.3 · NVD - Medium 4.3
CVE-2026-1606 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.8 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to conceal content within a Snippet due to improper input validation.
Published 25 Jun 2026 · Fixed in 18.11.6, 19.0.3 · NVD - Low 3.1
CVE-2026-12635 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to make requests to internal network resources through mirror synchronization due to improper URL validation.
Published 25 Jun 2026 · Fixed in 18.11.6, 19.0.3 · NVD - High 7.5
CVE-2026-12053 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have allowed a user to access sensitive information that had already been committed to a project, due to insufficient output filtering in Duo Workflows.
Published 25 Jun 2026 · NVD - Medium 5.3
CVE-2026-11379 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 prior to 18.11.6, 19.0 prior to 19.0.3, and 19.1 prior to 19.1.1 in which incorrect authorization in DAST site profile management could allow a user with Developer role to exfiltrate DAST site profile secrets under certain conditions.
Published 25 Jun 2026 · Fixed in 18.11.6, 19.0.3 · NVD - Medium 6.1
CVE-2026-10712 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions.
Published 25 Jun 2026 · Fixed in 18.11.6, 19.0.3 · NVD - Medium 5.4
CVE-2026-10086 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code in the context of another user's session, due to improper sanitization of user-supplied input.
Published 25 Jun 2026 · Fixed in 18.11.6, 19.0.3 · NVD - Low 3.8
CVE-2026-0934 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with custom role permissions to view, create, or delete protected environment configurations despite CI/CD visibility being disabled for the project.
Published 25 Jun 2026 · Fixed in 18.11.6, 19.0.3 · NVD - Medium 4.3
CVE-2026-62139 · Google Site Kit (WordPress plugin)
Site Kit by Google – Analytics, Search Console, AdSense, Speed: Cross-Site Request Forgery (CSRF)
Published 25 Jun 2026 · Fixed in 1.187.0 · WPVulnerability - Medium 6.5
CVE-2026-57619 · Elementor
Elementor Website Builder – more than just a page builder: Missing Authorization
Published 25 Jun 2026 · Fixed in 4.1.4 · WPVulnerability - Unrated
CVE-2026-10753 · Google Site Kit (WordPress plugin)
Site Kit by Google – Analytics, Search Console, AdSense, Speed: Incorrect Authorization
Published 24 Jun 2026 · Fixed in 1.176.0 · WPVulnerability - Medium 4.1
CVE-2026-0864 · Python
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.
Published 23 Jun 2026 · Fixed in 3.12.14, 3.13.15, 3.14.7 · NVD - Low 3.7
CVE-2026-48931 · Node.js
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Published 22 Jun 2026 · NVD - Critical 9.3
CVE-2022-50972 · WooCommerce
Vulnerability in WooCommerce
Published 20 Jun 2026 · WPVulnerability
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.