UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,900
Published in 7 days
1,038
Critical in 30 days
414
Actively exploited
419

Latest vulnerabilities

37,900 vulnerabilities
  1. High 8.4

    CVE-2025-61812 · Adobe ColdFusion

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could allow a high privileged attacker to gain arbitrary code execution. Exploitation of this issue does not require user interaction.

    Published 10 Dec 2025 · NVD
  2. Critical 9.1

    CVE-2025-61811 · Adobe ColdFusion

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could leverage this vulnerability to bypass security measures and execute malicious code. Exploitation of this issue does not require user interaction and scope is changed.

    Published 10 Dec 2025 · NVD
  3. High 8.4

    CVE-2025-61810 · Adobe ColdFusion

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerability by providing maliciously crafted serialized data to the application. Exploitation of this issue requires user interaction and scope…

    Published 10 Dec 2025 · NVD
  4. Critical 9.1

    CVE-2025-61809 · Adobe ColdFusion

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction and scope is unchanged.

    Published 10 Dec 2025 · NVD
  5. Critical 9.1

    CVE-2025-61808 · Adobe ColdFusion

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to arbitrary code execution by a high priviledged attacker. Exploitation of this issue does not require user interaction and scope is changed.

    Published 10 Dec 2025 · NVD
  6. Medium 6.1

    CVE-2025-67495 · ZITADEL

    ZITADEL is an open-source identity infrastructure tool. Versions 4.0.0-rc.1 through 4.7.0 are vulnerable to DOM-Based XSS through the Zitadel V2 logout endpoint. The /logout endpoint insecurely routes to a value that is supplied in the post_logout_redirect GET parameter. As a result, unauthenticated remote attacker can execute malicious JS code on Zitadel users’ browsers. To carry out an attack,…

    Published 9 Dec 2025 · Fixed in 4.7.1 · NVD
  7. Medium 5.3

    CVE-2025-67514 · Envoy

    Use-after-free in c-ares can crash Envoy via compromised or malfunctioning DNS

    Published 9 Dec 2025 · Fixed in 1.33.14 · Project advisories (GitHub)
  8. High 8.6

    CVE-2025-67494 · ZITADEL

    ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains,…

    Published 9 Dec 2025 · Fixed in 4.7.1 · NVD
  9. Medium 4.9

    CVE-2025-66625 · Umbraco CMS

    Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an attacker with access to the backoffice can trigger predictable requests to temporary file paths. The application’s error responses (HTTP 500 when a file exists, 404 when it does not) allow the attacker to enumerate the existence of…

    Published 9 Dec 2025 · Fixed in 13.12.1 · NVD
  10. Medium 5.3

    CVE-2025-64667 · Microsoft Exchange Server

    User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    Published 9 Dec 2025 · Fixed in 15.02.2562.035 · NVD
  11. High 7.5

    CVE-2025-64666 · Microsoft Exchange Server

    Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

    Published 9 Dec 2025 · Fixed in 15.02.2562.035 · NVD
  12. High 7.5

    CVE-2025-64471 · Fortinet FortiWeb

    A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to use the hash in place of the password to authenticate via crafted HTTP/HTTPS requests

    Published 9 Dec 2025 · NVD
  13. High 8.1

    CVE-2025-64447 · Fortinet FortiWeb

    A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to execute arbitrary operations on the system via crafted HTTP or HTTPS request via forged cookies, requiring prior…

    Published 9 Dec 2025 · NVD
  14. Medium 5.6

    CVE-2025-62631 · Fortinet FortiOS

    An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control

    Published 9 Dec 2025 · Fixed in 7.4.1 · NVD
  15. Critical 9.8

    CVE-2025-59719 · Fortinet FortiWeb

    An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

    Published 9 Dec 2025 · NVD
  16. Critical 9.8Actively exploited

    CVE-2025-59718 · Fortinet FortiProxy, Fortinet FortiOS

    A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through…

    Published 9 Dec 2025 · Fixed in 7.4.9, 7.4.11, 7.6.4 · NVD
  17. Medium 6.1

    CVE-2025-54353 · Fortinet FortiSandbox

    An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an attacker to perform an XSS attack via crafted HTTP requests.

    Published 9 Dec 2025 · NVD
  18. High 8.8

    CVE-2025-53949 · Fortinet FortiSandbox

    An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests.

    Published 9 Dec 2025 · NVD
  19. High 7.2

    CVE-2025-53679 · Fortinet FortiSandbox

    An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1, FortiSandbox Cloud 23 all versions allows a remote privileged attacker to execute unauthorized code…

    Published 9 Dec 2025 · Fixed in 4.4.8, 5.0.3 · NVD
  20. Medium 6.6

    CVE-2024-47570 · Fortinet FortiProxy, Fortinet FortiOS

    An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.11; FortiPAM 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiSRA 1.4 all versions may allow a read-only administrator to retrieve API tokens of other…

    Published 9 Dec 2025 · Fixed in 7.2.8, 7.2.12, 7.4.4 · NVD
  21. Low 2.3

    CVE-2025-14345 · MongoDB

    A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those…

    Published 9 Dec 2025 · Fixed in 7.0.26, 8.0.16, 8.2.2 · NVD
  22. Medium 6.1

    CVE-2025-67648 · Shopware

    Reflected XSS in Storefront Login Page

    Published 9 Dec 2025 · Fixed in 6.6.10.10, 6.7.5.1 · NVD, Project advisories (GitHub)
  23. Critical 9.4

    CVE-2025-65964 · n8n

    n8n is an open source workflow automation platform. Versions 0.123.1 through 1.119.1 do not have adequate protections to prevent RCE through the project's pre-commit hooks. The Add Config operation allows workflows to set arbitrary Git configuration values, including core.hooksPath, which can point to a malicious Git hook that executes arbitrary commands on the n8n host during subsequent Git…

    Published 9 Dec 2025 · Fixed in 1.119.2 · NVD
  24. Medium 5.3

    CVE-2025-67564 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Exposure of Sensitive System Information to an Unauthorized Control Sphere

    Published 9 Dec 2025 · Fixed in 1.52.0 · WPVulnerability
  25. Medium 5.4

    CVE-2025-12635 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.

    Published 8 Dec 2025 · Fixed in 8.5.5.29, 9.0.5.27, 26.0.0.1 · NVD
  26. Low 3.7

    CVE-2025-67500 · Mastodon

    Inconsistent error handling allows anonymously checking existence of known private posts

    Published 8 Dec 2025 · Fixed in 4.3.15, 4.4.10, 4.5.3 · NVD, Project advisories (GitHub)
  27. Medium 5.9

    CVE-2025-62408 · c-ares

    Use after free due to connection being cleaned up after error

    Published 8 Dec 2025 · Fixed in 1.34.6 · NVD, Project advisories (GitHub)
  28. Medium 6.9

    CVE-2025-66490 · Traefik

    Path Normalization Bypass in Traefik Router + Middleware Rules

    Published 8 Dec 2025 · Fixed in 2.11.32, 3.6.3 · NVD, Project advisories (GitHub)
  29. Medium 5.9

    CVE-2025-66491 · Traefik, github.com/traefik/traefik

    Traefik Inverted TLS Verification Logic in ingress-nginx Provider in github.com/traefik/traefik

    Published 8 Dec 2025 · Fixed in 3.6.3 · NVD, OSV.dev and GitHub, Project advisories (GitHub)
  30. Medium 6.5

    CVE-2025-66202 · Astro

    bypass for CVE-2025-64765

    Published 6 Dec 2025 · Fixed in 5.15.8 · Project advisories (GitHub)
  31. High 8.5

    CVE-2025-67950 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): SQL Injection

    Published 6 Dec 2025 · Fixed in 4.9.1.1 · WPVulnerability
  32. Critical 9.4Actively exploited

    CVE-2025-34291 · Langflow

    Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the…

    Published 5 Dec 2025 · NVD
  33. Medium 4.2

    CVE-2025-8148 · GoAnywhere MFT

    An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.

    Published 5 Dec 2025 · Fixed in 7.9.0 · NVD
  34. Medium 4.3

    CVE-2025-66552 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.

    Published 5 Dec 2025 · Fixed in 30.0.9, 31.0.1 · NVD
  35. Medium 4.3

    CVE-2025-66547 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1.

    Published 5 Dec 2025 · Fixed in 31.0.1 · NVD
  36. Medium 6.1

    CVE-2025-66512 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside of the Nextcloud Servers web page.

    Published 5 Dec 2025 · Fixed in 31.0.12, 32.0.3 · NVD
  37. Medium 4.9

    CVE-2025-66510 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that…

    Published 5 Dec 2025 · Fixed in 30.0.17.3, 31.0.10, 32.0.1 · NVD
  38. Medium 6.4

    CVE-2024-9183 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 prior to 18.4.5, 18.5 prior to 18.5.3, and 18.6 prior to 18.6.1 that could have allowed an authenticated user to obtain credentials from higher-privileged users and perform actions in their context under specific conditions.

    Published 5 Dec 2025 · Fixed in 18.4.5, 18.5.3, 18.6.1 · NVD
  39. High 8.3

    CVE-2025-58098 · Apache HTTP Server

    Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

    Published 5 Dec 2025 · Fixed in 2.4.66 · NVD
  40. Medium 5.4

    CVE-2025-66200 · Apache HTTP Server

    mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

    Published 5 Dec 2025 · Fixed in 2.4.66 · NVD
  41. Medium 6.5

    CVE-2025-65082 · Apache HTTP Server

    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. This issue affects Apache HTTP Server from 2.4.0 through 2.4.65. Users are recommended to upgrade to version 2.4.66 which fixes the issue.

    Published 5 Dec 2025 · Fixed in 2.4.66 · NVD
  42. High 7.5

    CVE-2025-59775 · Apache HTTP Server

    Server-Side Request Forgery (SSRF) vulnerability  in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off  allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.

    Published 5 Dec 2025 · Fixed in 2.4.66 · NVD
  43. High 7.5

    CVE-2025-55753 · Apache HTTP Server

    An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

    Published 5 Dec 2025 · Fixed in 2.4.66 · NVD
  44. Medium 4.8

    CVE-2025-6946 · WatchGuard Fireware OS

    A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the IPS configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management ninterface of another management user.

    Published 4 Dec 2025 · Fixed in 12.5.13, 12.11.3 · NVD
  45. High 7.5

    CVE-2025-1547 · WatchGuard Fireware OS

    A stack-based buffer overflow vulnerability [CWE-121] in WatchGuard Fireware OS's certificate request command could allow an authenticated privileged user to execute arbitrary code via specially crafted CLI commands.

    Published 4 Dec 2025 · Fixed in 12.5.13, 12.11.3 · NVD
  46. High 8.2

    CVE-2025-1545 · WatchGuard Fireware OS

    An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface. This vulnerability only affects Firebox systems that have at least one authentication hotspot configured.

    Published 4 Dec 2025 · Fixed in 12.5.14, 12.11.5, 2025.1.3 · NVD
  47. Medium 6.7

    CVE-2025-13940 · WatchGuard Fireware OS

    An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure. The on-demand system integrity check in the Fireware Web UI will correctly show a failed system integrity check message in the event of a…

    Published 4 Dec 2025 · Fixed in 12.11.5, 2025.1.3 · NVD
  48. Medium 4.8

    CVE-2025-13939 · WatchGuard Fireware OS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless Controller module) allows Stored XSS.

    Published 4 Dec 2025 · Fixed in 12.5.14, 12.11.5, 2025.1.3 · NVD
  49. Medium 4.8

    CVE-2025-13938 · WatchGuard Fireware OS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS.

    Published 4 Dec 2025 · Fixed in 12.5.14, 12.11.5, 2025.1.3 · NVD
  50. Medium 4.8

    CVE-2025-13937 · WatchGuard Fireware OS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS.

    Published 4 Dec 2025 · Fixed in 12.5.14, 12.11.5, 2025.1.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.