UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
9,661
Published in 7 days
203
Critical in 30 days
35
Actively exploited
47

Latest vulnerabilities

9,661 vulnerabilities
  1. High 8.1

    CVE-2026-10795 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Improper Verification of Cryptographic Signature

    Published 10 Jun 2026 · Fixed in 1.26.5 · WPVulnerability
  2. High 7.1

    CVE-2026-9754 · MongoDB

    An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command

    Published 9 Jun 2026 · Fixed in 8.2.10, 8.3.3 · NVD
  3. High 7.2

    CVE-2026-9753 · MongoDB

    The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.

    Published 9 Jun 2026 · Fixed in 8.0.24, 8.2.10, 8.3.3 · NVD
  4. High 7.1

    CVE-2026-9752 · MongoDB

    An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-winding polygons are intentionally unsupported for indexing, but the guard that rejects them does not inspect members of a GeometryCollection, allowing the unsafe path to be reached which ends with an…

    Published 9 Jun 2026 · Fixed in 8.0.24, 8.2.10, 8.3.3 · NVD
  5. Medium 6.8

    CVE-2026-9751 · MongoDB

    The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.

    Published 9 Jun 2026 · Fixed in 8.0.24, 8.2.10, 8.3.3 · NVD
  6. High 7.1

    CVE-2026-9750 · MongoDB

    An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled document fields and internal metadata in certain execution paths.

    Published 9 Jun 2026 · Fixed in 8.0.24, 8.2.10, 8.3.3 · NVD
  7. High 7.1

    CVE-2026-9749 · MongoDB

    This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces enough documents to fill its exchange buffer (that is, many results are routed to the same consumer), the server reaches the code path where a full per-consumer buffer is detected but the internal…

    Published 9 Jun 2026 · Fixed in 8.0.24, 8.2.10, 8.3.3 · NVD
  8. High 7.1

    CVE-2026-9748 · MongoDB

    The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected…

    Published 9 Jun 2026 · Fixed in 8.0.10, 8.2.10, 8.3.3 · NVD
  9. High 7.1

    CVE-2026-9747 · MongoDB

    Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.

    Published 9 Jun 2026 · Fixed in 8.0.24, 8.2.10, 8.3.3 · NVD
  10. High 7.1

    CVE-2026-9746 · MongoDB

    When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement.

    Published 9 Jun 2026 · Fixed in 8.0.24, 8.2.10, 8.3.3 · NVD
  11. High 7.1

    CVE-2026-9743 · MongoDB

    In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation…

    Published 9 Jun 2026 · Fixed in 8.0.24 · NVD
  12. High 8.2

    CVE-2026-9742 · MongoDB

    When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.

    Published 9 Jun 2026 · Fixed in 8.2.10, 8.3.3 · NVD
  13. High 7.1

    CVE-2026-9741 · MongoDB

    A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.

    Published 9 Jun 2026 · Fixed in 8.0.24, 8.2.10, 8.3.3 · NVD
  14. High 8.7

    CVE-2026-9740 · MongoDB

    A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.

    Published 9 Jun 2026 · Fixed in 8.0.24, 8.2.10, 8.3.3 · NVD
  15. Medium 6.8

    CVE-2026-9735 · MongoDB

    MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.

    Published 9 Jun 2026 · Fixed in 8.3.3 · NVD
  16. High 7.5

    CVE-2026-9076 · OpenSSL

    Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following…

    Published 9 Jun 2026 · Fixed in 3.4.6, 3.5.7, 3.6.3 · NVD
  17. High 8.1

    CVE-2026-7383 · OpenSSL

    Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a…

    Published 9 Jun 2026 · Fixed in 3.4.6, 3.5.7, 3.6.3 · NVD
  18. High 8.8

    CVE-2026-45447 · OpenSSL

    Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may…

    Published 9 Jun 2026 · Fixed in 3.4.6, 3.5.7, 3.6.3 · NVD
  19. Medium 4.8

    CVE-2026-45446 · OpenSSL

    Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's application using these ciphers. AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are…

    Published 9 Jun 2026 · Fixed in 3.4.6, 3.5.7, 3.6.3 · NVD
  20. High 7.5

    CVE-2026-45445 · OpenSSL

    Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same…

    Published 9 Jun 2026 · Fixed in 3.4.6, 3.5.7, 3.6.3 · NVD
  21. Medium 6.2

    CVE-2026-42771 · OpenSSL

    Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen. Impact summary: This out of bounds read will not directly exfiltrate the data read to the attacker so the most likely result is a crash and a Denial of Service. An internal helper function called from…

    Published 9 Jun 2026 · NVD
  22. Low 3.7

    CVE-2026-42770 · OpenSSL

    Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after…

    Published 9 Jun 2026 · Fixed in 3.4.6, 3.5.7, 3.6.3 · NVD
  23. Medium 5.3

    CVE-2026-42769 · OpenSSL

    Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level. Impact Summary: The Registration Autority could…

    Published 9 Jun 2026 · Fixed in 3.4.6, 3.5.7, 3.6.3 · NVD
  24. Low 3.7

    CVE-2026-42768 · OpenSSL

    Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA…

    Published 9 Jun 2026 · Fixed in 3.4.6, 3.5.7, 3.6.3 · NVD
  25. Medium 5.9

    CVE-2026-42767 · OpenSSL

    Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request…

    Published 9 Jun 2026 · Fixed in 3.4.6, 3.5.7, 3.6.3 · NVD
  26. Medium 5.9

    CVE-2026-42766 · OpenSSL

    Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs.…

    Published 9 Jun 2026 · Fixed in 3.4.6, 3.5.7, 3.6.3 · NVD
  27. High 7.5

    CVE-2026-42765 · OpenSSL

    Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When performing OCSP response…

    Published 9 Jun 2026 · Fixed in 3.6.3 · NVD
  28. High 7.5

    CVE-2026-42764 · OpenSSL

    Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service. If the address validation is disabled in the OpenSSL QUIC server implementation, an…

    Published 9 Jun 2026 · Fixed in 3.5.7, 3.6.3 · NVD
  29. Medium 5.0

    CVE-2026-35188 · OpenSSL

    Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client's certificate verification path. Impact summary: Successful exploitation allows an attacker to corrupt heap memory via a double-free, potentially leading to a Denial of Service or possibly an attacker controlled code…

    Published 9 Jun 2026 · Fixed in 3.6.3 · NVD
  30. High 7.5

    CVE-2026-34183 · OpenSSL

    Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the…

    Published 9 Jun 2026 · Fixed in 3.4.6, 3.5.7, 3.6.3 · NVD
  31. Critical 9.1

    CVE-2026-34182 · OpenSSL

    Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given…

    Published 9 Jun 2026 · Fixed in 3.4.6, 3.5.7, 3.6.3 · NVD
  32. High 7.4

    CVE-2026-34181 · OpenSSL

    Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability. If…

    Published 9 Jun 2026 · Fixed in 3.4.6, 3.5.7, 3.6.3 · NVD
  33. High 7.5

    CVE-2026-34180 · OpenSSL

    Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More…

    Published 9 Jun 2026 · Fixed in 3.4.6, 3.5.7, 3.6.3 · NVD
  34. Unrated

    CVE-2026-4986 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Missing Authorization

    Published 9 Jun 2026 · Fixed in 1.10.0.5 · WPVulnerability
  35. High 7.5

    CVE-2026-49975 · Apache HTTP Server

    Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

    Published 8 Jun 2026 · Fixed in 2.4.68 · NVD
  36. High 7.3

    CVE-2026-48913 · Apache HTTP Server

    Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.

    Published 8 Jun 2026 · Fixed in 2.4.68 · NVD
  37. Critical 9.8

    CVE-2026-44631 · Apache HTTP Server

    Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

    Published 8 Jun 2026 · Fixed in 2.4.68 · NVD
  38. High 7.3

    CVE-2026-44186 · Apache HTTP Server

    Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

    Published 8 Jun 2026 · Fixed in 2.4.68 · NVD
  39. High 7.3

    CVE-2026-44185 · Apache HTTP Server

    Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

    Published 8 Jun 2026 · Fixed in 2.4.68 · NVD
  40. Medium 5.5

    CVE-2026-44119 · Apache HTTP Server

    Improper Privilege Management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. This issue affects Apache HTTP Server: from through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

    Published 8 Jun 2026 · Fixed in 2.4.68 · NVD
  41. Medium 6.5

    CVE-2026-43951 · Apache HTTP Server

    Out-of-bounds Read vulnerability in Apache HTTP Server with mod_headers and mod_mime and multiple response languages. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

    Published 8 Jun 2026 · NVD
  42. High 7.5

    CVE-2026-42536 · Apache HTTP Server

    Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

    Published 8 Jun 2026 · Fixed in 2.4.68 · NVD
  43. Critical 9.1

    CVE-2026-42535 · Apache HTTP Server

    A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

    Published 8 Jun 2026 · Fixed in 2.4.68 · NVD
  44. High 7.5

    CVE-2026-34356 · Apache HTTP Server

    Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

    Published 8 Jun 2026 · Fixed in 2.4.68 · NVD
  45. High 7.5

    CVE-2026-34355 · Apache HTTP Server

    A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

    Published 8 Jun 2026 · Fixed in 2.4.68 · NVD
  46. Medium 6.1

    CVE-2026-29170 · Apache HTTP Server

    A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

    Published 8 Jun 2026 · Fixed in 2.4.68 · NVD
  47. Critical 9.8

    CVE-2026-29167 · Apache HTTP Server

    Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

    Published 8 Jun 2026 · Fixed in 2.4.68 · NVD
  48. Medium 6.5

    CVE-2026-7542 · Slider Revolution

    Slider Revolution: Exposure of Sensitive Information to an Unauthorized Actor

    Published 8 Jun 2026 · Fixed in 7.0.11 · WPVulnerability
  49. Medium 5.3

    CVE-2026-7792 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Insufficient Verification of Data Authenticity

    Published 5 Jun 2026 · Fixed in 1.10.0.5 · WPVulnerability
  50. Medium 6.5

    CVE-2026-34892 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization

    Published 3 Jun 2026 · Fixed in 1.0.271.1 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.