UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
9,661
Published in 7 days
202
Critical in 30 days
35
Actively exploited
47

Latest vulnerabilities

9,661 vulnerabilities
  1. Low 2.1

    CVE-2026-34154 · Discourse

    Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, a vulnerability in the discourse-subscriptions plugin allows users to gain access to subscription-gated groups without completing payment. This issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1.

    Published 19 May 2026 · Fixed in 2026.1.4, 2026.3.1, 2026.4.1 · NVD
  2. Medium 6.0

    CVE-2026-33514 · Discourse

    Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, an authenticated user on a Discourse instance with the form templates feature enabled can read the name and structured content of form templates that are intended exclusively for categories they are not authorized to access. Impact is limited to disclosure of site…

    Published 19 May 2026 · Fixed in 2026.1.4, 2026.3.1, 2026.4.1 · NVD
  3. Medium 5.3

    CVE-2026-32244 · Discourse

    Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, outdated cached AI summaries can leak removed content to anonymous and unprivileged users who cannot regenerate summaries. This issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1. To work around this issue, restrict summary generation by…

    Published 19 May 2026 · Fixed in 2026.1.4, 2026.3.1, 2026.4.1 · NVD
  4. Medium 5.3

    CVE-2026-6728 · Slider Revolution

    Slider Revolution: Exposure of Sensitive Information to an Unauthorized Actor

    Published 19 May 2026 · Fixed in 7.0.10 · WPVulnerability
  5. Medium 4.3

    CVE-2026-5075 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Exposure of Sensitive Information to an Unauthorized Actor

    Published 19 May 2026 · Fixed in 4.9.7.1 · WPVulnerability
  6. High 7.1

    CVE-2026-8843 · MongoDB

    Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices. This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6

    Published 18 May 2026 · Fixed in 7.0.32, 8.0.21, 8.2.6 · NVD
  7. High 8.8

    CVE-2026-6638 · PostgreSQL

    SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16…

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  8. High 8.8

    CVE-2026-6637 · PostgreSQL

    Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update…

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  9. Medium 4.3

    CVE-2026-6575 · PostgreSQL

    Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL 18.4 are affected. Versions before PostgreSQL 18 are unaffected.

    Published 14 May 2026 · Fixed in 18.4 · NVD
  10. High 7.5

    CVE-2026-6479 · PostgreSQL

    Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  11. Medium 6.5

    CVE-2026-6478 · PostgreSQL

    Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4,…

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  12. High 8.8

    CVE-2026-6477 · PostgreSQL

    Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the…

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  13. High 7.2

    CVE-2026-6476 · PostgreSQL

    SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.

    Published 14 May 2026 · Fixed in 17.10, 18.4 · NVD
  14. High 8.8

    CVE-2026-6475 · PostgreSQL

    Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical…

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  15. Medium 4.3

    CVE-2026-6474 · PostgreSQL

    Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  16. High 8.8

    CVE-2026-6473 · PostgreSQL

    Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation…

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  17. Medium 5.4

    CVE-2026-6472 · PostgreSQL

    Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  18. Medium 6.5

    CVE-2026-8280 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to cause denial of service through excessive memory consumption due to improper input validation.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  19. Medium 4.3

    CVE-2026-8144 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with project membership to enumerate private group members due to missing authorization checks.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  20. Medium 5.4

    CVE-2026-7481 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  21. Low 3.5

    CVE-2026-7471 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with control of a virtual registry upstream to make requests to internal hosts due to improper validation.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  22. Medium 5.4

    CVE-2026-7377 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  23. Medium 4.3

    CVE-2026-6883 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 15.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to bypass merge request approval requirements due to improper cleanup of orphaned policy records.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  24. Medium 5.4

    CVE-2026-6335 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user to execute arbitrary code in another user's browser session due to improper sanitization.

    Published 14 May 2026 · Fixed in 18.11.3 · NVD
  25. Medium 5.4

    CVE-2026-6073 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  26. Medium 4.3

    CVE-2026-6063 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user with developer-role permissions to remove code owner approval rules from merge requests due to improper access control.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  27. Medium 6.5

    CVE-2026-4527 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to create unauthorized Jira subscriptions for a targeted user's namespace via a specially crafted link due to missing CSRF protection.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  28. Medium 6.5

    CVE-2026-4524 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to access confidential issue content in public projects without proper authorization due to improper authorization checks.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  29. Medium 4.3

    CVE-2026-3607 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass package protection rules due to improper access control.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  30. Medium 5.8

    CVE-2026-3160 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to view Jira issues outside the configured project scope due to an integration filter functioning only as a display control rather than enforcing access boundaries as specified.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  31. Medium 4.3

    CVE-2026-3074 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to download private debugging symbols from inaccessible projects due to improper access control.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  32. Medium 4.3

    CVE-2026-3073 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass PyPI package protection rules and upload restricted packages due to improper authorization checks.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  33. Low 2.7

    CVE-2026-2900 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-level approval rule editing prevention was enabled, could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  34. High 7.5

    CVE-2026-1659 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted requests due to insufficient input validation.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  35. Medium 4.3

    CVE-2026-1338 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to delete protected container registry tags due to improper authorization checks.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  36. High 8.1

    CVE-2026-1322 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with a read_api scoped OAuth application to create issues and add comments to issues in private projects due to improper authorization.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  37. High 7.5

    CVE-2026-1184 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by uploading a specially crafted file due to improper validation.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  38. High 7.5

    CVE-2025-14870 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted JSON payloads due to insufficient input validation.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  39. High 7.5

    CVE-2025-14869 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted payloads on certain API endpoints.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  40. Medium 4.3

    CVE-2025-13874 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with Guest permissions to view issues in projects they were not authorized to access.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  41. Medium 5.4

    CVE-2025-12669 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to inject HTML and JavaScript into email notifications sent to other users due to improper input sanitization.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  42. High 8.3

    CVE-2026-42946 · nginx

    A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note:…

    Published 13 May 2026 · NVD
  43. Critical 9.2

    CVE-2026-42945 · nginx

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond…

    Published 13 May 2026 · NVD
  44. Medium 6.3

    CVE-2026-42934 · nginx

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited…

    Published 13 May 2026 · NVD
  45. Medium 6.3

    CVE-2026-42926 · nginx

    When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 13 May 2026 · NVD
  46. Medium 6.3

    CVE-2026-40701 · nginx

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a…

    Published 13 May 2026 · NVD
  47. Medium 6.9

    CVE-2026-40460 · nginx

    When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 13 May 2026 · NVD
  48. Medium 5.3

    CVE-2026-7168 · curl

    Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  49. Medium 5.3

    CVE-2026-7009 · curl

    When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine.

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  50. Medium 5.3

    CVE-2026-6429 · curl

    When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

    Published 13 May 2026 · Fixed in 8.20.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.