UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
9,661
Published in 7 days
201
Critical in 30 days
35
Actively exploited
47

Latest vulnerabilities

9,661 vulnerabilities
  1. High 7.5

    CVE-2026-6276 · curl

    Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  2. Medium 5.9

    CVE-2026-6253 · curl

    curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using…

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  3. High 7.5

    CVE-2026-5773 · curl

    libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an…

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  4. Medium 6.5

    CVE-2026-5545 · curl

    libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the…

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  5. Medium 5.9

    CVE-2026-4873 · curl

    A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  6. High 7.7

    CVE-2026-8336 · MongoDB

    After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service. This issue impacts MongoDB…

    Published 13 May 2026 · Fixed in 8.2.9, 8.3.2 · NVD
  7. Medium 5.3

    CVE-2026-8202 · MongoDB

    Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

    Published 13 May 2026 · Fixed in 8.0.23, 8.2.9, 8.3.2 · NVD
  8. Medium 6.1

    CVE-2026-8201 · MongoDB

    A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query. This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions…

    Published 13 May 2026 · Fixed in 8.0.23, 8.2.9, 8.3.2 · NVD
  9. Medium 4.8

    CVE-2026-8200 · MongoDB

    When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted.  This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

    Published 13 May 2026 · Fixed in 8.0.23, 8.2.9, 8.3.2 · NVD
  10. High 7.1

    CVE-2026-8199 · MongoDB

    An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

    Published 13 May 2026 · Fixed in 8.0.23, 8.2.9, 8.3.2 · NVD
  11. High 8.7

    CVE-2026-8053 · MongoDB

    An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution. This issue…

    Published 13 May 2026 · Fixed in 8.0.23, 8.2.9, 8.3.2 · NVD
  12. Medium 4.3

    CVE-2026-97343 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Improper Authentication

    Published 13 May 2026 · Fixed in 3.7.2 · WPVulnerability
  13. Critical 9.8

    CVE-2026-8181 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Improper Authentication

    Published 13 May 2026 · Fixed in 3.4.2 · WPVulnerability
  14. High 8.7

    CVE-2026-34686 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,…

    Published 12 May 2026 · NVD
  15. Low 3.4

    CVE-2026-34685 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  16. Medium 4.8

    CVE-2026-34658 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  17. Medium 4.3

    CVE-2026-34656 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  18. Medium 4.8

    CVE-2026-34655 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  19. Medium 5.3

    CVE-2026-34654 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  20. High 8.7

    CVE-2026-34653 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system read and write. An authenticated attacker with administrative privileges could exploit this vulnerability to read or write files outside the…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  21. High 7.5

    CVE-2026-34652 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  22. High 7.5

    CVE-2026-34651 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  23. High 7.5

    CVE-2026-34650 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  24. High 7.5

    CVE-2026-34649 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  25. High 7.5

    CVE-2026-34648 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  26. High 7.4

    CVE-2026-34647 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue requires user interaction in that a victim…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  27. High 7.5

    CVE-2026-34646 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  28. High 7.5

    CVE-2026-34645 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  29. Critical 9.1

    CVE-2026-43515 · Apache Tomcat

    Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which…

    Published 12 May 2026 · Fixed in 9.0.118, 10.1.55, 11.0.22 · NVD
  30. Low 3.7

    CVE-2026-43514 · Apache Tomcat

    Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118…

    Published 12 May 2026 · Fixed in 9.0.118, 10.1.55, 11.0.22 · NVD
  31. High 7.5

    CVE-2026-43513 · Apache Tomcat

    Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which…

    Published 12 May 2026 · Fixed in 9.0.118, 10.1.55, 11.0.22 · NVD
  32. Critical 9.8

    CVE-2026-43512 · Apache Tomcat

    DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also be affect Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which…

    Published 12 May 2026 · Fixed in 9.0.118, 10.1.55, 11.0.22 · NVD
  33. High 7.3

    CVE-2026-42498 · Apache Tomcat

    Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.

    Published 12 May 2026 · Fixed in 9.0.118, 10.1.55, 11.0.22 · NVD
  34. Critical 9.8

    CVE-2026-41293 · Apache Tomcat

    Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

    Published 12 May 2026 · Fixed in 9.0.118, 10.1.55, 11.0.22 · NVD
  35. High 7.5

    CVE-2026-41284 · Apache Tomcat

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

    Published 12 May 2026 · Fixed in 9.0.118, 10.1.55, 11.0.22 · NVD
  36. Medium 6.3

    CVE-2026-7210 · Python

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

    Published 11 May 2026 · Fixed in 3.13.14, 3.14.6 · NVD
  37. Unrated

    CVE-2026-34095 · MediaWiki

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    Published 11 May 2026 · Fixed in 1.43.7, 1.44.4, 1.45.2 · NVD
  38. Low 2.0

    CVE-2026-34094 · MediaWiki

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    Published 11 May 2026 · Fixed in 1.43.7, 1.44.4, 1.45.2 · NVD
  39. Low 1.1

    CVE-2026-34093 · MediaWiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    Published 11 May 2026 · Fixed in 1.43.7, 1.44.4, 1.45.2 · NVD
  40. High 7.5

    CVE-2026-45109 · Next.js

    Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

    Published 11 May 2026 · Fixed in 15.5.18, 16.2.6 · OSV.dev and GitHub
  41. Low 2.1

    CVE-2026-34092 · MediaWiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    Published 11 May 2026 · Fixed in 1.43.7, 1.44.4, 1.45.2 · NVD
  42. Medium 5.5

    CVE-2026-34091 · MediaWiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    Published 11 May 2026 · Fixed in 1.43.7, 1.44.4, 1.45.2 · NVD
  43. Low 1.3

    CVE-2026-34088 · MediaWiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    Published 11 May 2026 · Fixed in 1.43.7, 1.44.4, 1.45.2 · NVD
  44. Medium 5.1

    CVE-2026-34087 · MediaWiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.

    Published 11 May 2026 · Fixed in 1.43.7, 1.44.4, 1.45.2 · NVD
  45. Low 3.7

    CVE-2026-44572 · Next.js

    Next.js's Middleware / Proxy redirects can be cache-poisoned

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  46. Medium 4.7

    CVE-2026-44581 · Next.js

    Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  47. Low 3.7

    CVE-2026-44582 · Next.js

    Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  48. Medium 6.1

    CVE-2026-44580 · Next.js

    Next.js has cross-site scripting in beforeInteractive scripts with untrusted input

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  49. High 7.5

    CVE-2026-44579 · Next.js

    Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  50. Medium 5.9

    CVE-2026-44577 · Next.js

    Next.js has a Denial of Service in the Image Optimization API

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.