Vulnerability database · updated every hour
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 9,661
- Published in 7 days
- 201
- Critical in 30 days
- 35
- Actively exploited
- 47
Latest vulnerabilities
9,661 vulnerabilities- High 8.6
CVE-2026-44578 · Next.js
Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub - Medium 5.4
CVE-2026-44576 · Next.js
Next.js vulnerable to cache poisoning in React Server Component responses
Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub - High 7.5
CVE-2026-44575 · Next.js
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub - High 8.1
CVE-2026-44574 · Next.js
Next.js has a Middleware / Proxy bypass through dynamic route parameter injection
Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub - High 7.5
CVE-2026-44573 · Next.js
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n
Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub - High 7.5
GHSA-8h8q-6873-q5fj · Next.js
Next.js Vulnerable to Denial of Service with Server Components
Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub - Medium 6.3
CVE-2026-7263 · PHP
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.
Published 10 May 2026 · Fixed in 8.4.21, 8.5.6 · NVD - Medium 6.3
CVE-2026-6104 · PHP
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or…
Published 10 May 2026 · Fixed in 8.4.21, 8.5.6 · NVD - Medium 6.3
CVE-2026-7568 · PHP
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds…
Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD - Low 2.9
CVE-2026-7262 · PHP
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP…
Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD - Medium 6.3
CVE-2026-7261 · PHP
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which…
Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD - Low 2.1
CVE-2026-7259 · PHP
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD - Medium 6.3
CVE-2026-7258 · PHP
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.
Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD - High 7.3
CVE-2026-6735 · PHP
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD - Critical 9.5
CVE-2026-6722 · PHP
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP…
Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD - High 7.4
CVE-2025-14179 · PHP
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as…
Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD - Medium 5.1
CVE-2022-50958 · Jetpack
Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth
Published 10 May 2026 · WPVulnerability - High 7.1
CVE-2026-8063 · MongoDB
An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads the first element on each stage’s input pipeline array without first verifying that the array is…
Published 7 May 2026 · Fixed in 8.2.7 · NVD - Unrated
CVE-2026-82305 · Yith Woocommerce Wishlist (WordPress plugin)
YITH WooCommerce Wishlist: Authorization Bypass Through User-Controlled Key
Published 7 May 2026 · Fixed in 4.18.1 · WPVulnerability - Medium 5.3
CVE-2026-27329 · Yith Woocommerce Wishlist (WordPress plugin)
YITH WooCommerce Wishlist: Authorization Bypass Through User-Controlled Key
Published 7 May 2026 · Fixed in 4.13.0 · WPVulnerability - High 8.8
CVE-2026-6692 · Slider Revolution
Slider Revolution: Unrestricted Upload of File with Dangerous Type
Published 6 May 2026 · Fixed in 7.0.11 · WPVulnerability - Critical 9.8
CVE-2026-28780 · Apache HTTP Server
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67,…
Published 5 May 2026 · Fixed in 2.4.67 · NVD - High 7.7
CVE-2026-25243 · Redis
Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL…
Published 5 May 2026 · Fixed in 8.6.3 · NVD - Medium 6.1
CVE-2026-23631 · Redis
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using…
Published 5 May 2026 · Fixed in 8.6.3 · NVD - High 7.7
CVE-2026-23479 · Redis
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Published 5 May 2026 · Fixed in 8.6.3 · NVD - High 7.3
CVE-2026-29168 · Apache HTTP Server
Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Published 5 May 2026 · Fixed in 2.4.67 · NVD - Medium 6.5
CVE-2026-33523 · Apache HTTP Server
HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Server: from through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Published 4 May 2026 · Fixed in 2.4.67 · NVD - Medium 5.3
CVE-2026-33007 · Apache HTTP Server
A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
Published 4 May 2026 · Fixed in 2.4.67 · NVD - Medium 4.8
CVE-2026-33006 · Apache HTTP Server
A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
Published 4 May 2026 · Fixed in 2.4.67 · NVD - High 7.5
CVE-2026-29169 · Apache HTTP Server
A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0. Users are recommended to upgrade to version 2.4.66, which fixes this issue,…
Published 4 May 2026 · Fixed in 2.4.67 · NVD - High 8.8
CVE-2026-23918 · Apache HTTP Server
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Published 4 May 2026 · NVD - Medium 5.3
CVE-2026-34032 · Apache HTTP Server
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Published 4 May 2026 · Fixed in 2.4.67 · NVD - Medium 5.3
CVE-2026-33857 · Apache HTTP Server
Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Published 4 May 2026 · Fixed in 2.4.67 · NVD - High 7.5
CVE-2026-34059 · Apache HTTP Server
Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Published 4 May 2026 · Fixed in 2.4.67 · NVD - High 8.8
CVE-2026-24072 · Apache HTTP Server
An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
Published 4 May 2026 · Fixed in 2.4.67 · NVD - Medium 4.9
CVE-2026-1921 · Loco Translate (WordPress plugin)
Loco Translate: Path Traversal
Published 4 May 2026 · Fixed in 2.8.3 · WPVulnerability - High 8.1
CVE-2026-42349 · @clerk/astro, @clerk/backend, @clerk/chrome-extension and 14 more
Clerk has an authorization bypass when combining organization, billing, or reverification checks
Published 30 Apr 2026 · Fixed in 6.7.5, 6.39.3, 7.2.4 · OSV.dev and GitHub - Medium 6.4
CVE-2026-6127 · Elementor
Elementor Website Builder – more than just a page builder: Cross-site Scripting
Published 30 Apr 2026 · Fixed in 4.0.5 · WPVulnerability - Medium 5.3
CVE-2026-6915 · MongoDB
An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account.
Published 29 Apr 2026 · Fixed in 7.0.32, 8.0.21, 8.2.7 · NVD - High 7.1
CVE-2026-6914 · MongoDB
Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server v7.0 versions prior to 7.0.32
Published 29 Apr 2026 · Fixed in 7.0.32, 8.0.21, 8.2.7 · NVD - Medium 6.0
CVE-2026-3087 · Python
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
Published 27 Apr 2026 · NVD - Low 2.1
CVE-2026-6019 · Python
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
Published 22 Apr 2026 · Fixed in 3.13.14 · NVD - Medium 5.4
CVE-2026-6515 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed a user to use invalidated or incorrectly scoped credentials to access Virtual Registries under certain conditions.
Published 22 Apr 2026 · Fixed in 18.9.6, 18.10.4 · NVD - High 8.1
CVE-2026-5816 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions.
Published 22 Apr 2026 · Fixed in 18.10.4 · NVD - Medium 4.3
CVE-2026-5377 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that could have allowed an authenticated user to access titles of confidential or private issues in public projects due to improper access control in the issue description rendering process.
Published 22 Apr 2026 · NVD - Medium 6.1
CVE-2026-5262 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.1.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an unauthenticated user to access tokens in the Storybook development environment due to improper input validation.
Published 22 Apr 2026 · Fixed in 18.9.6, 18.10.4 · NVD - High 8.1
CVE-2026-4922 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.
Published 22 Apr 2026 · Fixed in 18.9.6, 18.10.4 · NVD - Low 3.5
CVE-2026-3254 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to load unauthorized content into another user's browser due to improper input validation in the Mermaid sandbox.
Published 22 Apr 2026 · NVD - Medium 6.5
CVE-2026-1660 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to cause denial of service when importing issues due to improper input validation.
Published 22 Apr 2026 · Fixed in 18.9.6, 18.10.4 · NVD - Low 2.7
CVE-2025-9957 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user with project owner permissions to bypass group fork prevention settings due to improper authorization checks.
Published 22 Apr 2026 · Fixed in 18.9.6, 18.10.4 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.