UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,902
Published in 7 days
996
Critical in 30 days
414
Actively exploited
419

Latest vulnerabilities

37,902 vulnerabilities
  1. Medium 4.8

    CVE-2025-64521 · authentik

    Deactivated service account can authenticate to OAuth

    Published 19 Nov 2025 · Fixed in 2025.8.5, 2025.10.2 · NVD, Project advisories (GitHub)
  2. High 7.5

    CVE-2025-11230 · HAProxy

    Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

    Published 19 Nov 2025 · Fixed in 3.0.12, 3.1.9, 3.2.6 · NVD
  3. High 8.8

    CVE-2025-37162 · HPE ArubaOS

    A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

    Published 18 Nov 2025 · Fixed in 10.7.2.0 · NVD
  4. High 7.5

    CVE-2025-37161 · HPE ArubaOS

    A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.

    Published 18 Nov 2025 · Fixed in 10.7.2.0 · NVD
  5. Medium 6.1

    CVE-2025-63828 · Backdrop CMS

    Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.

    Published 18 Nov 2025 · NVD
  6. Medium 5.5

    CVE-2025-59669 · Fortinet FortiWeb

    A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker with shell access to the device to connect to redis service and access its data

    Published 18 Nov 2025 · Fixed in 7.6.1 · NVD
  7. High 7.5

    CVE-2025-58413 · Fortinet FortiOS

    A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiSASE 25.3.b allows attacker to execute unauthorized code or commands via specially crafted packets

    Published 18 Nov 2025 · Fixed in 7.4.9, 7.6.4 · NVD
  8. High 7.2Actively exploited

    CVE-2025-58034 · Fortinet FortiWeb

    An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted…

    Published 18 Nov 2025 · Fixed in 7.4.11, 7.6.6, 8.0.2 · NVD
  9. Medium 6.0

    CVE-2025-54821 · Fortinet FortiProxy, Fortinet FortiOS

    An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions,…

    Published 18 Nov 2025 · Fixed in 7.6.4 · NVD
  10. High 7.5

    CVE-2025-53843 · Fortinet FortiOS

    A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted packets

    Published 18 Nov 2025 · Fixed in 7.4.9, 7.6.4 · NVD
  11. Medium 5.3

    CVE-2025-46215 · Fortinet FortiSandbox

    An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to evade the sandboxing scan via a crafted file.

    Published 18 Nov 2025 · Fixed in 4.4.8, 5.0.2 · NVD
  12. Low 3.7

    CVE-2025-13083 · Drupal

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.

    Published 18 Nov 2025 · Fixed in 10.5.6, 11.1.9, 11.2.8 · NVD
  13. Medium 4.3

    CVE-2025-13082 · Drupal

    User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

    Published 18 Nov 2025 · Fixed in 10.5.6, 11.1.9, 11.2.8 · NVD
  14. Medium 5.9

    CVE-2025-13081 · Drupal

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

    Published 18 Nov 2025 · Fixed in 10.5.6, 11.1.9, 11.2.8 · NVD
  15. Medium 5.3

    CVE-2025-13080 · Drupal

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

    Published 18 Nov 2025 · Fixed in 10.5.6, 11.1.9, 11.2.8 · NVD
  16. Low 3.5

    CVE-2025-55074 · Mattermost

    Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects

    Published 18 Nov 2025 · Fixed in 10.5.12, 10.11.4 · NVD
  17. Medium 5.1

    CVE-2025-65012 · Kirby

    Cross-site scripting (XSS) in the changes dialog

    Published 18 Nov 2025 · Fixed in 5.1.4 · NVD, Project advisories (GitHub)
  18. Critical 9.1

    CVE-2025-40549 · SolarWinds Serv-U

    A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences in how paths and home directories are handled.

    Published 18 Nov 2025 · Fixed in 15.5.3 · NVD
  19. Critical 9.1

    CVE-2025-40548 · SolarWinds Serv-U

    A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.

    Published 18 Nov 2025 · Fixed in 15.5.3 · NVD
  20. Critical 9.1

    CVE-2025-40547 · SolarWinds Serv-U

    A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.

    Published 18 Nov 2025 · Fixed in 15.5.3 · NVD
  21. Medium 5.3

    CVE-2025-12777 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Improper Authorization

    Published 18 Nov 2025 · Fixed in 4.10.1 · WPVulnerability
  22. Medium 5.3

    CVE-2025-12545 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Exposure of Sensitive Information to an Unauthorized Actor

    Published 18 Nov 2025 · Fixed in 1.49.3 · WPVulnerability
  23. Medium 5.3

    CVE-2025-12427 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Authorization Bypass Through User-Controlled Key

    Published 18 Nov 2025 · WPVulnerability
  24. Medium 6.5

    CVE-2025-12983 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to cause a denial of service condition by submitting specially crafted markdown content with nested formatting patterns.

    Published 15 Nov 2025 · Fixed in 18.3.6, 18.4.4, 18.5.2 · NVD
  25. Medium 4.3

    CVE-2025-7736 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to bypass access control restrictions and view GitLab Pages content intended only for project members by authenticating through OAuth providers.

    Published 15 Nov 2025 · Fixed in 18.3.6, 18.4.4, 18.5.2 · NVD
  26. Medium 4.3

    CVE-2025-7000 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.6 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that, under specific conditions, could have allowed unauthorized users to view confidential branch names by accessing project issues with related merge requests.

    Published 15 Nov 2025 · Fixed in 18.3.6, 18.4.4, 18.5.2 · NVD
  27. Low 3.5

    CVE-2025-6945 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments.

    Published 15 Nov 2025 · Fixed in 18.3.6, 18.4.4, 18.5.2 · NVD
  28. Medium 4.3

    CVE-2025-6171 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker with reporter access to view branch names and pipeline details by accessing the packages API endpoint even when repository access was disabled.

    Published 15 Nov 2025 · Fixed in 18.3.6, 18.4.4, 18.5.2 · NVD
  29. Medium 6.5

    CVE-2025-2615 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections.

    Published 15 Nov 2025 · Fixed in 18.3.6, 18.4.4, 18.5.2 · NVD
  30. Low 3.5

    CVE-2025-11990 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses.

    Published 15 Nov 2025 · Fixed in 18.4.4, 18.5.2 · NVD
  31. Medium 5.3

    CVE-2025-11865 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 18.1 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that, under certain circumstances, could have allowed an attacker to remove Duo flows of another user.

    Published 15 Nov 2025 · Fixed in 18.3.6, 18.4.4, 18.5.2 · NVD
  32. Critical 9.8Actively exploited

    CVE-2025-64446 · Fortinet FortiWeb

    A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

    Published 14 Nov 2025 · Fixed in 7.4.10, 7.6.5, 8.0.2 · NVD
  33. Medium 4.9

    CVE-2025-11794 · Mattermost

    Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{user_id}/email/verify/member endpoint

    Published 14 Nov 2025 · Fixed in 10.5.12, 10.11.4, 10.12.1 · NVD
  34. Medium 5.3

    CVE-2025-55073 · Mattermost

    Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL.

    Published 14 Nov 2025 · Fixed in 10.5.12, 10.11.4, 10.12.1 · NVD
  35. High 7.5

    CVE-2025-55070 · Mattermost

    Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events

    Published 14 Nov 2025 · Fixed in 11.0.0 · NVD
  36. Medium 4.3

    CVE-2025-41436 · Mattermost

    Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads

    Published 14 Nov 2025 · Fixed in 11.0.0 · NVD
  37. Medium 4.3

    CVE-2025-11776 · Mattermost

    Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint

    Published 14 Nov 2025 · Fixed in 11.0.0 · NVD
  38. Medium 4.3

    CVE-2025-12847 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Missing Authorization

    Published 14 Nov 2025 · Fixed in 4.9.0 · WPVulnerability
  39. Low 2.7

    CVE-2025-64745 · Astro

    Reflected XSS in Astro development server error page

    Published 13 Nov 2025 · Fixed in 5.15.6 · Project advisories (GitHub)
  40. Medium 4.3

    CVE-2025-11777 · Mattermost

    Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint

    Published 13 Nov 2025 · Fixed in 10.5.12, 10.11.4 · NVD
  41. Medium 4.3

    CVE-2025-64749 · Directus

    Information Leakage: Existing Collections

    Published 13 Nov 2025 · Fixed in 11.13.0 · NVD, Project advisories (GitHub)
  42. Medium 6.5

    CVE-2025-64748 · Directus

    Conceal fields are searchable if read permissions enabled

    Published 13 Nov 2025 · Fixed in 11.13.0 · NVD, Project advisories (GitHub)
  43. Medium 5.5

    CVE-2025-64747 · Directus

    Store XSS

    Published 13 Nov 2025 · Fixed in 11.13.0 · NVD, Project advisories (GitHub)
  44. Medium 5.4

    CVE-2025-64746 · Directus

    Improper Permission Handling on Deleted Fields in Directus

    Published 13 Nov 2025 · Fixed in 11.13.0 · NVD, Project advisories (GitHub)
  45. High 7.4

    CVE-2025-12765 · pgAdmin

    pgAdmin <= 9.9  is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.

    Published 13 Nov 2025 · Fixed in 9.10 · NVD
  46. High 7.5

    CVE-2025-12764 · pgAdmin

    pgAdmin <= 9.9  is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.

    Published 13 Nov 2025 · Fixed in 9.10 · NVD
  47. High 8.8

    CVE-2025-12763 · pgAdmin

    pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input.

    Published 13 Nov 2025 · Fixed in 9.10 · NVD
  48. Critical 9.8

    CVE-2025-12762 · pgAdmin

    pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

    Published 13 Nov 2025 · Fixed in 9.10 · NVD
  49. Low 3.5

    CVE-2025-20379 · Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands. They could…

    Published 12 Nov 2025 · Fixed in 9.2.9, 9.3.7, 9.4.5 · NVD
  50. Medium 6.1

    CVE-2025-20378 · Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unauthenticated attacker could craft a malicious URL using the `return_to` parameter of the Splunk Web login endpoint. When an authenticated user visits the malicious URL, it could cause an unvalidated redirect to an external malicious site. To…

    Published 12 Nov 2025 · Fixed in 9.2.9, 9.3.7, 9.4.5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.