UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,900
Published in 7 days
994
Critical in 30 days
414
Actively exploited
419

Latest vulnerabilities

37,900 vulnerabilities
  1. Low

    CVE-2024-51999 · Express

    REJECTED (not a vulnerability): improperly controlled modification of query properties in express

    Published 1 Dec 2025 · Fixed in 4.22.0, 5.1.0 · Project advisories (GitHub)
  2. High 7.5

    CVE-2025-64775 · Apache Struts

    Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

    Published 1 Dec 2025 · Fixed in 6.8.0, 7.1.1 · NVD
  3. Low 3.7

    CVE-2025-10939 · Keycloak

    Unable to restrict access to the admin console

    Published 1 Dec 2025 · Fixed in 26.4.4 · Project advisories (GitHub)
  4. Medium 6.8

    CVE-2025-11538 · Keycloak

    Debug default bind address

    Published 1 Dec 2025 · Fixed in 26.4.4 · Project advisories (GitHub)
  5. Critical 9.1

    CVE-2025-12106 · OpenVPN

    Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses

    Published 1 Dec 2025 · NVD
  6. High 8.5

    CVE-2025-66412 · Angular

    Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

    Published 1 Dec 2025 · Project advisories (GitHub)
  7. High 8.6

    CVE-2025-66206 · Frappe Framework

    Path traversal allowed reading certain files

    Published 1 Dec 2025 · Fixed in 14.99.2, 15.86.0 · NVD, Project advisories (GitHub)
  8. Critical 9.8

    CVE-2025-66205 · Frappe Framework

    Possibility of SQL Injection due to improper validations

    Published 1 Dec 2025 · Fixed in 14.99.2, 15.86.0 · NVD, Project advisories (GitHub)
  9. Medium 5.5

    CVE-2025-66382 · Expat

    In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.

    Published 28 Nov 2025 · NVD
  10. Critical 9.9

    CVE-2025-12421 · Mattermost

    Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the…

    Published 27 Nov 2025 · Fixed in 10.11.5, 10.12.2, 11.0.3 · NVD
  11. Medium 4.3

    CVE-2025-12559 · Mattermost

    Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/{channel_id}/common_teams endpoint

    Published 27 Nov 2025 · Fixed in 10.11.5, 10.12.2, 11.0.3 · NVD
  12. Critical 9.9

    CVE-2025-12419 · Mattermost

    Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled…

    Published 27 Nov 2025 · Fixed in 10.11.5, 10.12.2, 11.0.4 · NVD
  13. High 8.6

    CVE-2025-66201 · LibreChat

    Server-side Request Forgery (SSRF) in Actions Capability

    Published 26 Nov 2025 · Fixed in 0.8.1-rc2, 0.8.1 · NVD, Project advisories (GitHub)
  14. Medium 6.5

    CVE-2025-7449 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user with specific permissions to cause a denial of service condition through HTTP response processing.

    Published 26 Nov 2025 · Fixed in 18.4.5, 18.5.3 · NVD
  15. Medium 4.3

    CVE-2025-6195 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user to view information from security reports under certain configuration conditions.

    Published 26 Nov 2025 · Fixed in 18.4.5, 18.5.3 · NVD
  16. Medium 5.3

    CVE-2025-13611 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.5.5 and 18.6 before 18.6.3 that could have allowed an authenticated user with access to certain logs to obtain sensitive tokens under specific conditions.

    Published 26 Nov 2025 · Fixed in 18.4.5, 18.5.3 · NVD
  17. Medium 6.5

    CVE-2025-12653 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that under specific conditions could have allowed an unauthenticated user to join arbitrary organizations by changing headers on some requests.

    Published 26 Nov 2025 · Fixed in 18.4.5, 18.5.3 · NVD
  18. High 7.5

    CVE-2025-12571 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an unauthenticated user to cause a Denial of Service condition by sending specifically crafted requests containing malicious JSON payloads.

    Published 26 Nov 2025 · Fixed in 18.4.5, 18.5.3 · NVD
  19. High 7.7

    CVE-2025-66035 · Angular

    XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client

    Published 26 Nov 2025 · Project advisories (GitHub)
  20. Medium 6.5

    CVE-2025-64295 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Insertion of Sensitive Information Into Sent Data

    Published 26 Nov 2025 · Fixed in 4.8.7 · WPVulnerability
  21. High 7.2

    CVE-2025-64050 · REDAXO

    A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.

    Published 25 Nov 2025 · NVD
  22. Medium 4.8

    CVE-2025-64049 · REDAXO

    A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.

    Published 25 Nov 2025 · NVD
  23. Medium 6.6

    CVE-2025-65960 · Contao

    Remote code execution in template closures

    Published 25 Nov 2025 · Fixed in 4.13.57, 5.3.42, 5.6.5 · NVD, Project advisories (GitHub)
  24. Medium 4.8

    CVE-2025-65961 · Contao

    Cross-site scripting in templates

    Published 25 Nov 2025 · Fixed in 4.13.57, 5.3.42, 5.6.5 · NVD, Project advisories (GitHub)
  25. Medium 6.1

    CVE-2025-66026 · REDAXO

    Reflected XSS in Mediapool Info Banner via args[types]

    Published 25 Nov 2025 · Fixed in 5.20.1 · NVD, Project advisories (GitHub)
  26. High 7.1

    CVE-2025-13644 · MongoDB

    MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.13, and MongoDB Server v8.1…

    Published 25 Nov 2025 · Fixed in 7.0.26, 8.0.13, 8.1.2 · NVD
  27. Low 2.3

    CVE-2025-13643 · MongoDB

    A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully completing. This issue affects MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB Server v8.0 versions prior to 8.0.14

    Published 25 Nov 2025 · Fixed in 7.0.26, 8.0.14 · NVD
  28. High 7.1

    CVE-2025-13507 · MongoDB

    Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8.2 versions prior to 8.2.1.

    Published 25 Nov 2025 · Fixed in 7.0.26, 8.0.16, 8.2.1 · NVD
  29. Low 2.3

    CVE-2025-12893 · MongoDB

    Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running…

    Published 25 Nov 2025 · Fixed in 7.0.26, 8.0.16, 8.2.2 · NVD
  30. Medium 4.3

    CVE-2025-67588 · Elementor

    Elementor Website Builder – more than just a page builder: Missing Authorization

    Published 25 Nov 2025 · Fixed in 3.33.1 · WPVulnerability
  31. High 7.5

    CVE-2025-64761 · OpenBao

    OpenBao Privileged Operator Identity Group Root Escalation

    Published 24 Nov 2025 · Fixed in 2.4.3, 2.4.4 · NVD, Project advisories (GitHub)
  32. Critical 9.8

    CVE-2025-41115 · Grafana

    SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric…

    Published 21 Nov 2025 · Fixed in 12.2.1 · NVD
  33. Medium 6.5

    CVE-2025-9825 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have allowed authenticated users without project membership to view sensitive manual CI/CD variables by querying the GraphQL API.

    Published 21 Nov 2025 · Fixed in 18.2.8, 18.3.4, 18.4.2 · NVD
  34. Medium 6.4

    CVE-2025-11186 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 21 Nov 2025 · Fixed in 2.5.9 · WPVulnerability
  35. Medium 6.5

    CVE-2025-62426 · vLLM

    DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`

    Published 20 Nov 2025 · Fixed in 0.11.1 · NVD, Project advisories (GitHub)
  36. High 8.8

    CVE-2025-62164 · vLLM

    prompt_embeds deserialization allows DoS and potential RCE

    Published 20 Nov 2025 · Fixed in 0.11.1 · NVD, Project advisories (GitHub)
  37. High 8.3

    CVE-2025-62372 · vLLM

    DoS with incorrect shape of multimodal embedding inputs

    Published 20 Nov 2025 · Fixed in 0.11.1 · NVD, Project advisories (GitHub)
  38. Medium 6.1

    CVE-2025-64027 · Snipe-IT

    Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary HTML or JavaScript into the progress_message.…

    Published 20 Nov 2025 · NVD
  39. Medium 6.9

    CVE-2025-41076 · LimeSurvey

    In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database engine, the table name 'lime_sessions', primary keys, and fragments of the content that caused the…

    Published 20 Nov 2025 · NVD
  40. Medium 6.9

    CVE-2025-41075 · LimeSurvey

    Vulnerability in LimeSurvey 6.13.0 in the endpoint /optin that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS attack), by exhausting server or client resources. The system is unable to break the redirect loop, which can cause service degradation or browser instability.

    Published 20 Nov 2025 · NVD
  41. Medium 6.9

    CVE-2025-41074 · LimeSurvey

    Vulnerability in LimeSurvey 6.13.0 in the endpoint /optout that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS attack), by exhausting server or client resources. The system is unable to break the redirect loop, which can cause service degradation or browser instability.

    Published 20 Nov 2025 · NVD
  42. High 7.5

    CVE-2025-40601 · SonicWall SonicOS

    A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash.

    Published 20 Nov 2025 · Fixed in 7.3.1-7013, 8.0.3-8011 · NVD
  43. Medium 5.3

    CVE-2025-13147 · MOVEit Transfer

    Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4.

    Published 19 Nov 2025 · Fixed in 2024.1.8, 2025.0.4 · NVD
  44. Medium 5.4

    CVE-2025-65019 · Astro

    Cross Site Scripting in /_image endpoint in Astro Cloudflare adapter

    Published 19 Nov 2025 · Fixed in 5.15.9 · Project advisories (GitHub)
  45. Low 3.5

    CVE-2025-64757 · Astro

    Arbitrary Local File Read in Astro Development Server

    Published 19 Nov 2025 · Fixed in 5.14.3 · Project advisories (GitHub)
  46. Medium

    CVE-2025-64765 · Astro

    Middleware authentication checks based on url.pathname can be bypassed via url encoded values

    Published 19 Nov 2025 · Fixed in 5.15.8 · Project advisories (GitHub)
  47. High 7.1

    CVE-2025-64764 · Astro

    Reflected XSS via the server islands feature

    Published 19 Nov 2025 · Fixed in 5.15.8 · Project advisories (GitHub)
  48. Medium 5.3

    CVE-2025-64708 · authentik

    Invitation expiry is delayed by at least 5 minutes

    Published 19 Nov 2025 · Fixed in 2025.8.5, 2025.10.2 · NVD, Project advisories (GitHub)
  49. Medium 4.8

    CVE-2025-64521 · authentik

    Deactivated service account can authenticate to OAuth

    Published 19 Nov 2025 · Fixed in 2025.8.5, 2025.10.2 · NVD, Project advisories (GitHub)
  50. High 7.5

    CVE-2025-11230 · HAProxy

    Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

    Published 19 Nov 2025 · Fixed in 3.0.12, 3.1.9, 3.2.6 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.