Vulnerability database · updated every hour
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 9,661
- Published in 7 days
- 203
- Critical in 30 days
- 35
- Actively exploited
- 47
Latest vulnerabilities
9,661 vulnerabilities- Medium 5.4
CVE-2026-49782 · Elementor
Elementor Website Builder – more than just a page builder: Missing Authorization
Published 2 Jun 2026 · Fixed in 4.1.1 · WPVulnerability - Medium 6.8
CVE-2026-45810 · Nextcloud
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended that the Nextcloud Server is upgraded to 31.0.12 or 32.0.3. It is recommended that the Nextcloud…
Published 1 Jun 2026 · Fixed in 30.0.17.5, 31.0.12, 32.0.3 · NVD - Medium 5.9
CVE-2026-45691 · Nextcloud
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor…
Published 1 Jun 2026 · Fixed in 31.0.14.5, 32.0.9, 33.0.3 · NVD - Medium 5.9
CVE-2026-45690 · Nextcloud
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication (2FA) protections. When a user initiated login with valid credentials on a 2FA-enabled account, the system created a…
Published 1 Jun 2026 · Fixed in 31.0.14.5, 32.0.9, 33.0.3 · NVD - Medium 6.4
CVE-2026-45285 · Nextcloud
Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includes an external member (a person added via email address who does not have a Nextcloud account), the system automatically creates a public link for that external member. This public link is not…
Published 1 Jun 2026 · Fixed in 32.0.9, 33.0.3 · NVD - Medium 4.3
CVE-2026-45283 · Nextcloud
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the ownership of files when processing DAV lock and unlock requests. An authenticated user could lock or unlock files belonging to other users by targeting their absolute WebDAV paths. Additionally, lock…
Published 1 Jun 2026 · Fixed in 31.0.14.4, 32.0.2, 33.0.1 · NVD - Medium 6.5
CVE-2026-45282 · Nextcloud
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments of link shares when knowing the share token, circumventing password protection or download restrictions. It is applicable to any file that is shared directly, as the attacker only needs to know a…
Published 1 Jun 2026 · Fixed in 31.0.14.5, 32.0.9, 33.0.3 · NVD - High 8.1
CVE-2026-45281 · Nextcloud
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL an attacker could possibly send a request to gain full access to their calendar. Therefore, the attacker must be an authenticated user. This is because of improper authorization controls in the backend…
Published 1 Jun 2026 · Fixed in 31.0.14.5, 32.0.9, 33.0.3 · NVD - Medium 6.5
CVE-2026-45279 · Nextcloud
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal. It is recommended that the Nextcloud Server is…
Published 1 Jun 2026 · Fixed in 30.0.17.7, 31.0.14, 32.0.4 · NVD - Medium 4.3
CVE-2026-9050 · Slider Revolution
Slider Revolution: Missing Authorization
Published 1 Jun 2026 · Fixed in 6.7.56 · WPVulnerability - Medium 4.3
CVE-2026-9048 · Slider Revolution
Slider Revolution: Incorrect Authorization
Published 1 Jun 2026 · Fixed in 7.0.15 · WPVulnerability - Medium 5.3
CVE-2026-8382 · Advanced Custom Fields
Advanced Custom Fields (ACF®): Missing Authorization
Published 30 May 2026 · Fixed in 6.8.2 · WPVulnerability - Medium 4.3
CVE-2026-9807 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed a blocked Project Access Token to continue accessing private resources due to incorrect authorization enforcement.
Published 28 May 2026 · Fixed in 18.10.7, 18.11.4 · NVD - High 7.5
CVE-2026-48835 · WPForms Lite
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Missing Authorization
Published 28 May 2026 · Fixed in 1.10.0.5 · WPVulnerability - Medium 5.3
CVE-2025-12714 · SEO By Rank Math (WordPress plugin)
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization
Published 28 May 2026 · Fixed in 1.0.271.1 · WPVulnerability - Medium 4.3
CVE-2026-8716 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user to access CI data from a different ref type than intended.
Published 27 May 2026 · Fixed in 18.10.7, 18.11.4 · NVD - Medium 5.3
CVE-2026-6713 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an unauthorized user to enumerate private projects due to incorrect authorization checks.
Published 27 May 2026 · Fixed in 18.10.7, 18.11.4 · NVD - Medium 4.3
CVE-2026-5296 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that when foundational flows were enabled at the group level, could have allowed an authenticated user with developer-role permissions to bypass flow restrictions under certain conditions.
Published 27 May 2026 · Fixed in 18.10.7, 18.11.4 · NVD - High 8.2
CVE-2026-4868 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that, under certain conditions, could have allowed an authenticated user to cause specific Duo AI workflows to run under another user's identity due to improper user identity resolution when triggering Duo AI workflow runners.
Published 27 May 2026 · Fixed in 18.10.7, 18.11.4 · NVD - Medium 4.3
CVE-2026-2601 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 11.5 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to access sensitive deployment data on projects due to improper authorization checks.
Published 27 May 2026 · Fixed in 18.10.7, 18.11.4 · NVD - Medium 6.5
CVE-2026-1402 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user to cause denial of service due to insufficient validation.
Published 27 May 2026 · Fixed in 18.10.7, 18.11.4 · NVD - High 7.6
CVE-2026-42790 · Erlang/OTP
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted (e.g. permitted;DNS:allowed.example.com) to issue a leaf certificate that an OTP TLS client accepts as a…
Published 27 May 2026 · Fixed in 27.3.4.12, 28.5.0.1, 29.0.1 · NVD - Medium 6.3
CVE-2026-42791 · Erlang/OTP
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid. OCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP…
Published 27 May 2026 · Fixed in 27.3.4.12, 28.5.0.1, 29.0.1 · NVD - High 7.0
CVE-2026-42789 · Erlang/OTP
Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage…
Published 27 May 2026 · Fixed in 27.3.4.12, 28.5.0.1, 29.0.1 · NVD - Unrated
WPV-8d3fffed4c21 · Advanced Custom Fields
Vulnerability in Advanced Custom Fields (ACF®)
Published 27 May 2026 · Fixed in 6.8.2 · WPVulnerability - Medium 6.9
CVE-2026-48905 · Joomla!
Lack of input filtering leads to an XSS vector in the HTML filter code.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.0 · NVD - High 8.2
CVE-2026-48904 · Joomla!
An improper access check allows privelege escalation through the com_users group editing webservice endpoint.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - Medium 6.9
CVE-2026-48903 · Joomla!
Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - Critical 9.8
CVE-2026-48902 · Joomla!
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - High 7.5
CVE-2026-48901 · Joomla!
The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - Medium 6.4
CVE-2026-48900 · Joomla!
An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - Medium 5.3
CVE-2026-48899 · Joomla!
An improper access check allows privilege escalation through the com_users batch task.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - High 8.2
CVE-2026-48898 · Joomla!
An improper access check allows privilege escalation through the com_users batch task.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - High 8.2
CVE-2026-48897 · Joomla!
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - High 8.2
CVE-2026-48896 · Joomla!
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - Medium 5.9
CVE-2026-40384 · Joomla!
An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - High 7.5
CVE-2026-40383 · Joomla!
An improper validation of user-supplied input leads to a local file inclusion vulnerability.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - High 8.6
CVE-2026-35223 · Joomla!
An improper access check allows unauthorized access to com_config webservice endpoints.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - Medium 6.9
CVE-2026-35222 · Joomla!
Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - Medium 6.9
CVE-2026-35221 · Joomla!
Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - Medium 4.6
CVE-2026-35220 · Joomla!
Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.
Published 26 May 2026 · Fixed in 6.1.1 · NVD - Medium 6.9
CVE-2026-30895 · Joomla!
Lack of output escaping leads to a XSS vector in the readmore links for com_content.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - Medium 6.9
CVE-2026-30894 · Joomla!
Lack of output escaping leads to a XSS vector in the content history component.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - Medium 6.9
CVE-2026-25901 · Joomla!
Lack of output escaping leads to a XSS vector in the multilingual associations component.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - Medium 6.9
CVE-2026-25900 · Joomla!
Lack of output escaping leads to a XSS vector in the feed modules.
Published 26 May 2026 · Fixed in 5.4.6, 6.1.1 · NVD - Medium 5.4
CVE-2026-6287 · Woolentor Addons (WordPress plugin)
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting
Published 26 May 2026 · Fixed in 3.3.9 · WPVulnerability - High 7.2
CVE-2026-3375 · LiteSpeed Cache
LiteSpeed Cache: Cross-site Scripting
Published 26 May 2026 · Fixed in 7.8 · WPVulnerability - Medium 4.3
CVE-2025-14481 · Yoast SEO
Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Missing Authorization
Published 26 May 2026 · Fixed in 26.6 · WPVulnerability - High 8.1
CVE-2026-46727 · Ruby
An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:).…
Published 22 May 2026 · Fixed in 4.0.5 · NVD - Critical 9.2
CVE-2026-9256 · nginx
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An…
Published 22 May 2026 · Fixed in 1.30.2 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.