UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
9,654
Published in 7 days
227
Critical in 30 days
33
Actively exploited
47

Latest vulnerabilities

9,654 vulnerabilities
  1. Unrated

    CVE-2026-101356 · Apache Tomcat

    Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

    Published 20 Oct 2026 · CVE Program
  2. Unrated

    CVE-2026-101296 · Apache Tomcat

    Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

    Published 20 Oct 2026 · CVE Program
  3. Unrated

    CVE-2026-93446 · Apache Tomcat

    Apache Tomcat: Possible TLS 1.3 connection failures

    Published 20 Oct 2026 · CVE Program
  4. Unrated

    CVE-2026-88041 · Apache Tomcat

    Apache Tomcat: HTTP/2 trailer header cross-contamination

    Published 20 Oct 2026 · CVE Program
  5. Unrated

    CVE-2026-80353 · Apache Tomcat

    Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector

    Published 20 Oct 2026 · CVE Program
  6. Unrated

    CVE-2026-74049 · Apache Tomcat

    Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)

    Published 20 Oct 2026 · CVE Program
  7. Unrated

    CVE-2026-74048 · Apache Tomcat

    Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up

    Published 20 Oct 2026 · CVE Program
  8. Medium 5.3

    CVE-2026-113353 · Learnpress (WordPress plugin)

    LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers

    Published 20 Oct 2026 · Fixed in 4.4.10 · CVE Program
  9. Medium 6.5

    CVE-2026-111844 · Brizy (WordPress plugin)

    WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability

    Published 20 Oct 2026 · CVE Program
  10. Medium 4.3

    CVE-2026-111828 · Classified Listing (WordPress plugin)

    WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability

    Published 19 Oct 2026 · CVE Program
  11. Medium 5.4

    CVE-2026-112222 · Surferseo (WordPress plugin)

    WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability

    Published 19 Oct 2026 · CVE Program
  12. Medium 6.5

    CVE-2026-111829 · WP Mailster (WordPress plugin)

    WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability

    Published 19 Oct 2026 · CVE Program
  13. Medium 4.3

    CVE-2026-110902 · Event Tickets (WordPress plugin)

    WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability

    Published 19 Oct 2026 · CVE Program
  14. Medium 5.3

    CVE-2026-111845 · Yith Woocommerce Product Bundles (WordPress plugin)

    WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability

    Published 19 Oct 2026 · CVE Program
  15. Medium 5.3

    CVE-2026-111831 · Fluentform (WordPress plugin)

    WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability

    Published 19 Oct 2026 · CVE Program
  16. Medium 5.4

    CVE-2026-110363 · Learnpress (WordPress plugin)

    WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

    Published 19 Oct 2026 · CVE Program
  17. Medium 4.3

    CVE-2026-111836 · Fluent Community (WordPress plugin)

    WordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerability

    Published 19 Oct 2026 · CVE Program
  18. Medium 6.5

    CVE-2026-111414 · Jet Elements (WordPress plugin)

    WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability

    Published 19 Oct 2026 · CVE Program
  19. Medium 6.5

    CVE-2026-111410 · E2pdf (WordPress plugin)

    WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability

    Published 19 Oct 2026 · CVE Program
  20. Medium 5.3

    CVE-2026-111839 · Videowhisper Live Streaming Integration (WordPress plugin)

    WordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerability

    Published 19 Oct 2026 · CVE Program
  21. Critical 9.9

    CVE-2026-110887 · Hivepress (WordPress plugin)

    WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability

    Published 19 Oct 2026 · CVE Program
  22. High 7.7

    CVE-2026-111398 · Mapsvg Lite Interactive Vector Maps (WordPress plugin)

    WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability

    Published 19 Oct 2026 · CVE Program
  23. Medium 6.4

    CVE-2026-110898 · Essential Addons For Elementor Lite (WordPress plugin)

    WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability

    Published 19 Oct 2026 · CVE Program
  24. Medium 6.5

    CVE-2026-111407 · Tutor (WordPress plugin)

    WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

    Published 19 Oct 2026 · CVE Program
  25. High 8.8

    CVE-2026-111408 · Quiz Master Next (WordPress plugin)

    WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

    Published 19 Oct 2026 · CVE Program
  26. High 7.1

    CVE-2026-110379 · Quiz Maker (WordPress plugin)

    WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability

    Published 19 Oct 2026 · CVE Program
  27. Critical 9.9

    CVE-2026-111406 · Mapsvg Lite Interactive Vector Maps (WordPress plugin)

    WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability

    Published 19 Oct 2026 · CVE Program
  28. Medium 6.5

    CVE-2026-112199 · Yith Woocommerce Wishlist (WordPress plugin)

    Vulnerability in YITH WooCommerce Wishlist

    Published 19 Oct 2026 · Fixed in 4.19.0 · CVE Program, WPVulnerability
  29. Medium 5.1

    CVE-2026-112111 · Bootstrap Shortcodes (WordPress plugin)

    The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following…

    Published 18 Oct 2026 · Fixed in 3.4.6 · CVE Program
  30. High 8.5

    CVE-2026-110895 · Support Genix Lite (WordPress plugin)

    WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability

    Published 18 Oct 2026 · CVE Program
  31. High 8.8

    CVE-2026-107436 · Strong Testimonials (WordPress plugin)

    WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability

    Published 18 Oct 2026 · CVE Program
  32. High 8.1

    CVE-2026-110373 · Login With Phone Number (WordPress plugin)

    WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability

    Published 18 Oct 2026 · CVE Program
  33. Medium 6.5

    CVE-2026-110880 · Convertkit (WordPress plugin)

    WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability

    Published 18 Oct 2026 · CVE Program
  34. Critical 9.8

    CVE-2026-110886 · Conversational Forms (WordPress plugin)

    WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability

    Published 18 Oct 2026 · CVE Program
  35. High 7.1

    CVE-2026-109895 · Booktics (WordPress plugin)

    WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability

    Published 18 Oct 2026 · CVE Program
  36. Critical 9.3

    CVE-2026-109894 · Booktics (WordPress plugin)

    WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability

    Published 18 Oct 2026 · CVE Program
  37. Medium 6.5

    CVE-2026-110883 · Webcam 2way Videochat (WordPress plugin)

    WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability

    Published 18 Oct 2026 · CVE Program
  38. High 7.5

    CVE-2026-110383 · Signature Fluent Contract Forms Add On (WordPress plugin)

    WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability

    Published 18 Oct 2026 · CVE Program
  39. High 7.1

    CVE-2026-110897 · Powerpack Addon For Beaver Builder (WordPress plugin)

    WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

    Published 18 Oct 2026 · CVE Program
  40. Critical 9.8

    CVE-2026-110372 · Suretriggers (WordPress plugin)

    WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability

    Published 18 Oct 2026 · CVE Program
  41. High 7.1

    CVE-2026-110382 · Simply Schedule Appointments (WordPress plugin)

    WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability

    Published 18 Oct 2026 · CVE Program
  42. High 7.1

    CVE-2026-108485 · Estore (WordPress plugin), Estore (WordPress theme)

    WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability

    Published 18 Oct 2026 · CVE Program
  43. Medium 6.5

    CVE-2026-110885 · Hivepress (WordPress plugin)

    WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability

    Published 18 Oct 2026 · CVE Program
  44. Medium 6.5

    CVE-2026-110365 · File Manager Advanced (WordPress plugin)

    WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability

    Published 18 Oct 2026 · CVE Program
  45. Medium 4.3

    CVE-2026-110882 · SMS Alert (WordPress plugin)

    WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerability

    Published 17 Oct 2026 · CVE Program
  46. High 7.1

    CVE-2026-109701 · Paytpv For Woocommerce (WordPress plugin)

    WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability

    Published 17 Oct 2026 · CVE Program
  47. High 7.5

    CVE-2026-110889 · Gantry5 (WordPress plugin)

    WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability

    Published 17 Oct 2026 · CVE Program
  48. Medium 5.4

    CVE-2026-110253 · Weforms (WordPress plugin)

    weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter

    Published 17 Oct 2026 · CVE Program
  49. High 7.2

    CVE-2026-100316 · Woocommerce Eu Vat Compliance (WordPress plugin)

    European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header

    Published 17 Oct 2026 · CVE Program
  50. Medium 6.4

    CVE-2026-109983 · Ymc Smart Filter (WordPress plugin)

    YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter

    Published 17 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.