UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,900
Published in 7 days
1,036
Critical in 30 days
414
Actively exploited
419

Latest vulnerabilities

37,900 vulnerabilities
  1. Medium 4.8

    CVE-2025-13936 · WatchGuard Fireware OS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS.

    Published 4 Dec 2025 · Fixed in 12.5.14, 12.11.5, 2025.1.3 · NVD
  2. High 8.6

    CVE-2025-12196 · WatchGuard Fireware OS

    An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.

    Published 4 Dec 2025 · Fixed in 12.5.14, 12.11.5, 2025.1.3 · NVD
  3. High 8.6

    CVE-2025-12195 · WatchGuard Fireware OS

    An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via specially crafted IPSec configuration CLI commands.

    Published 4 Dec 2025 · Fixed in 12.5.14, 12.11.5, 2025.1.3 · NVD
  4. High 8.6

    CVE-2025-12026 · WatchGuard Fireware OS

    An Out-of-bounds Write vulnerability in WatchGuard Fireware OS’s certificate request command could allow an authenticated privileged user to execute arbitrary code via specially crafted CLI commands.

    Published 4 Dec 2025 · Fixed in 12.5.14, 12.11.5, 2025.1.3 · NVD
  5. High 8.7

    CVE-2025-11838 · WatchGuard Fireware OS

    A memory corruption vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker to trigger a Denial of Service (DoS) condition in the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.

    Published 4 Dec 2025 · Fixed in 12.11.5, 2025.1.3 · NVD
  6. Medium 5.4

    CVE-2025-65959 · Open WebUI

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note…

    Published 4 Dec 2025 · Fixed in 0.6.37 · NVD
  7. High 7.1

    CVE-2025-65958 · Open WebUI

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services…

    Published 4 Dec 2025 · Fixed in 0.6.37 · NVD
  8. Medium 5.4

    CVE-2025-59788 · Nextcloud

    Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to…

    Published 4 Dec 2025 · Fixed in 30.0.17, 31.0.10, 32.0.1 · NVD
  9. Medium 4.3

    CVE-2025-63681 · Open WebUI

    open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers (a normal user) to stop arbitrary LLM response tasks.

    Published 4 Dec 2025 · NVD
  10. Medium 4.6

    CVE-2025-13086 · OpenVPN

    Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client

    Published 3 Dec 2025 · Fixed in 2.6.16 · NVD
  11. Medium 6.3

    CVE-2025-12084 · Python

    When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

    Published 3 Dec 2025 · Fixed in 3.13.11, 3.14.2 · NVD
  12. Critical 10.0

    GHSA-9qr9-h5gf-34mp · Next.js

    Next.js is vulnerable to RCE in React flight protocol

    Published 3 Dec 2025 · Fixed in 15.4.8, 15.5.7, 16.0.7 · OSV.dev and GitHub
  13. Medium 6.5

    CVE-2025-20389 · Splunk Enterprise

    In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and versions below 3.9.10, 3.8.58 and 3.7.28 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the `label` column field after adding a new device in the Splunk Secure Gateway app. This could potentially…

    Published 3 Dec 2025 · Fixed in 9.3.8, 9.4.6, 10.0.2 · NVD
  14. Low 2.7

    CVE-2025-20388 · Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.

    Published 3 Dec 2025 · Fixed in 9.2.10, 9.3.8, 9.4.6 · NVD
  15. Medium 6.5

    CVE-2025-20387 · Splunk Enterprise

    In Splunk Universal Forwarder for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory. This lets non-administrator users on the machine access the directory and all its contents.

    Published 3 Dec 2025 · Fixed in 9.3.8, 9.4.6, 10.0.2 · NVD
  16. Medium 6.5

    CVE-2025-20386 · Splunk Enterprise

    In Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Splunk Enterprise for Windows Installation directory. This lets non-administrator users on the machine access the directory and all its contents.

    Published 3 Dec 2025 · Fixed in 9.3.8, 9.4.6, 10.0.2 · NVD
  17. Medium 4.8

    CVE-2025-20385 · Splunk Enterprise

    In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117, a user who holds a role with a high privilege capability `admin_all_objects` could craft a malicious payload through the href attribute of an anchor tag within a collection in the navigation bar, which could result in execution of unauthorized…

    Published 3 Dec 2025 · Fixed in 9.3.8, 9.4.6, 10.0.2 · NVD
  18. Medium 5.3

    CVE-2025-20384 · Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files due to improper validation at the /en-US/static/ web endpoint. This may allow them to poison, forge, or obfuscate…

    Published 3 Dec 2025 · Fixed in 9.2.10, 9.3.8, 9.4.6 · NVD
  19. Medium 4.3

    CVE-2025-20383 · Splunk Enterprise

    In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mobile push notifications could receive notifications that disclose the title and description of the report or alert even if they do not have…

    Published 3 Dec 2025 · Fixed in 9.3.8, 9.4.6, 10.0.2 · NVD
  20. Medium 5.4

    CVE-2025-20382 · Splunk Enterprise

    In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.10, 10.0.2503.8, and 9.3.2411.120, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a views dashboard with a custom background using the `data:image/png;base64` protocol that could potentially lead to an unvalidated redirect. This…

    Published 3 Dec 2025 · Fixed in 9.3.8, 9.4.6, 10.0.2 · NVD
  21. Low 1.3

    CVE-2025-13751 · OpenVPN

    Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service.

    Published 3 Dec 2025 · Fixed in 2.6.17 · NVD
  22. Medium 6.5

    CVE-2025-64527 · Envoy

    Envoy crashes when JWT authentication is configured with the remote JWKS fetching

    Published 3 Dec 2025 · Fixed in 1.34.11, 1.35.7, 1.36.3 · NVD, Project advisories (GitHub)
  23. Medium 5.3

    CVE-2025-64763 · Envoy

    Forwarding of early CONNECT data in TCP proxy mode

    Published 3 Dec 2025 · Fixed in 1.34.11, 1.35.7, 1.36.3 · NVD, Project advisories (GitHub)
  24. High 7.1

    CVE-2025-66220 · Envoy

    TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte

    Published 3 Dec 2025 · Fixed in 1.34.11, 1.35.7, 1.36.3 · NVD, Project advisories (GitHub)
  25. Critical 10.0Actively exploited

    CVE-2025-55182 · Next.js

    RCE in React Server Components

    Published 3 Dec 2025 · Fixed in 16.0.7 · Project advisories (GitHub)
  26. Critical 9.0

    CVE-2025-65267 · Frappe Framework

    In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected…

    Published 3 Dec 2025 · NVD
  27. Medium 6.1

    CVE-2025-65955 · ImageMagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick’s Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. Clearing a font family calls RelinquishMagickMemory on _drawInfo->font, freeing the font string but leaving _drawInfo->font pointing to freed…

    Published 2 Dec 2025 · Fixed in 6.9.13-34, 7.1.2-9 · NVD
  28. Medium 6.1

    CVE-2025-65186 · Grav

    Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize <script> tags, allowing stored XSS payloads to execute when pages are viewed in the admin interface.

    Published 2 Dec 2025 · NVD
  29. High 8.8

    CVE-2025-13827 · Mautic

    GrapesJsBuilder File Upload allows all file uploads

    Published 2 Dec 2025 · Fixed in 4.4.18 · Project advisories (GitHub)
  30. Critical 9.0

    CVE-2025-13828 · Mautic

    Mautic user without privileged access to the Marketplace can install and uninstall composer packages

    Published 2 Dec 2025 · Fixed in 4.4.18 · Project advisories (GitHub)
  31. Medium 4.3

    CVE-2025-13870 · Mattermost

    Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does not have access to

    Published 2 Dec 2025 · Fixed in 10.5.13, 10.11.5 · NVD
  32. Medium 6.5

    CVE-2025-66306 · Grav

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMS Admin Panel which allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin email addresses and other metadata can be exposed, increasing the risk of phishing, credential…

    Published 1 Dec 2025 · Fixed in 1.8.0 · NVD
  33. Medium 6.9

    CVE-2025-66305 · Grav

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu of the Grav admin configuration panel (/admin/config/system). Specifically, the Supported parameter fails to properly validate user input. If a malformed value is inserted—such as a single forward slash (/) or an XSS test string—it causes a fatal regular…

    Published 1 Dec 2025 · Fixed in 1.8.0 · NVD
  34. High 7.2

    CVE-2025-66304 · Grav

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-beta.27.

    Published 1 Dec 2025 · Fixed in 1.8.0 · NVD
  35. Medium 4.9

    CVE-2025-66303 · Grav

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A Denial of Service (DoS) vulnerability has been identified in Grav related to the handling of scheduled_at parameters. Specifically, the application fails to properly sanitize input for cron expressions. By manipulating the scheduled_at parameter with a malicious input, such as a single quote, the application admin panel becomes…

    Published 1 Dec 2025 · Fixed in 1.8.0 · NVD
  36. Medium 6.8

    CVE-2025-66302 · Grav

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been identified in Grav CMS, allowing authenticated attackers with administrative privileges to read arbitrary files on the underlying server filesystem. This vulnerability arises due to insufficient input sanitization in the backup tool, where user-supplied paths are not properly restricted, enabling…

    Published 1 Dec 2025 · Fixed in 1.8.0 · NVD
  37. High 8.6

    CVE-2025-66301 · Grav

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][form] which is the YAML frontmatter which…

    Published 1 Dec 2025 · Fixed in 1.8.0 · NVD
  38. High 8.5

    CVE-2025-66300 · Grav

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a…

    Published 1 Dec 2025 · Fixed in 1.8.0 · NVD
  39. High 8.8

    CVE-2025-66299 · Grav

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Since the security sandbox does not fully protect the Twig object, it is possible to interact with it (e.g., call methods,…

    Published 1 Dec 2025 · Fixed in 1.8.0 · NVD
  40. High 7.7

    CVE-2025-66298 · Grav

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side Template (SST) vulnerability. Sensitive information may be contained in the configuration details. This vulnerability is fixed in 1.8.0-beta.27.

    Published 1 Dec 2025 · Fixed in 1.8.0 · NVD
  41. Medium 5.4

    CVE-2025-65622 · Snipe-IT

    Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.

    Published 1 Dec 2025 · Fixed in 8.3.4 · NVD
  42. High 7.4

    CVE-2025-66297 · Grav

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and…

    Published 1 Dec 2025 · Fixed in 1.8.0 · NVD
  43. High 8.8

    CVE-2025-66296 · Grav

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, and then log in as that administrator. This…

    Published 1 Dec 2025 · Fixed in 1.8.0 · NVD
  44. High 8.8

    CVE-2025-66295 · Grav

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creation creates a new user through the Admin UI and supplies a username containing path traversal sequences (for example ..\Nijat or ../Nijat), Grav writes the account YAML file to an unintended path outside user/accounts/. The written YAML can contain account fields such as email, fullname,…

    Published 1 Dec 2025 · Fixed in 1.8.0 · NVD
  45. High 8.7

    CVE-2025-66294 · Grav

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig…

    Published 1 Dec 2025 · Fixed in 1.8.0 · NVD
  46. Medium 5.4

    CVE-2025-65621 · Snipe-IT

    Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.

    Published 1 Dec 2025 · Fixed in 8.3.4 · NVD
  47. Medium 4.3

    CVE-2025-12756 · Mattermost

    Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.

    Published 1 Dec 2025 · Fixed in 10.11.5, 10.12.2, 11.0.3 · NVD
  48. High 8.8

    CVE-2025-66448 · vLLM

    Remote code execution via transformers_utils/get_config

    Published 1 Dec 2025 · Fixed in 0.11.1 · NVD, Project advisories (GitHub)
  49. Low 2.1

    CVE-2025-13837 · Python

    When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

    Published 1 Dec 2025 · Fixed in 3.13.10, 3.14.1 · NVD
  50. Medium 6.3

    CVE-2025-13836 · Python

    When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

    Published 1 Dec 2025 · Fixed in 3.11.15, 3.12.13, 3.13.11 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.