UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,911
Published in 7 days
1,003
Critical in 30 days
414
Actively exploited
419

Latest vulnerabilities

37,911 vulnerabilities
  1. Medium 6.5

    CVE-2025-64748 · Directus

    Conceal fields are searchable if read permissions enabled

    Published 13 Nov 2025 · Fixed in 11.13.0 · NVD, Project advisories (GitHub)
  2. Medium 5.5

    CVE-2025-64747 · Directus

    Store XSS

    Published 13 Nov 2025 · Fixed in 11.13.0 · NVD, Project advisories (GitHub)
  3. Medium 5.4

    CVE-2025-64746 · Directus

    Improper Permission Handling on Deleted Fields in Directus

    Published 13 Nov 2025 · Fixed in 11.13.0 · NVD, Project advisories (GitHub)
  4. High 7.4

    CVE-2025-12765 · pgAdmin

    pgAdmin <= 9.9  is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.

    Published 13 Nov 2025 · Fixed in 9.10 · NVD
  5. High 7.5

    CVE-2025-12764 · pgAdmin

    pgAdmin <= 9.9  is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.

    Published 13 Nov 2025 · Fixed in 9.10 · NVD
  6. High 8.8

    CVE-2025-12763 · pgAdmin

    pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input.

    Published 13 Nov 2025 · Fixed in 9.10 · NVD
  7. Critical 9.8

    CVE-2025-12762 · pgAdmin

    pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

    Published 13 Nov 2025 · Fixed in 9.10 · NVD
  8. Low 3.5

    CVE-2025-20379 · Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands. They could…

    Published 12 Nov 2025 · Fixed in 9.2.9, 9.3.7, 9.4.5 · NVD
  9. Medium 6.1

    CVE-2025-20378 · Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unauthenticated attacker could craft a malicious URL using the `return_to` parameter of the Splunk Web login endpoint. When an authenticated user visits the malicious URL, it could cause an unvalidated redirect to an external malicious site. To…

    Published 12 Nov 2025 · Fixed in 9.2.9, 9.3.7, 9.4.5 · NVD
  10. Medium 6.1

    CVE-2025-63419 · CrushFTP

    Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filename to an emailbody field with no sanitations leading to HTML Injection.

    Published 12 Nov 2025 · Fixed in 11.3.7_60 · NVD
  11. High 7.4

    CVE-2025-64717 · ZITADEL

    Account Takeover with deactivated Instance IdP

    Published 12 Nov 2025 · Fixed in 2.71.19, 3.4.4, 4.6.6 · NVD, Project advisories (GitHub)
  12. High 7.3

    CVE-2025-64500 · Symfony

    Incorrect parsing of PATH_INFO can lead to limited authorization bypass

    Published 12 Nov 2025 · Fixed in 5.4.50, 6.4.29, 7.3.7 · Project advisories (GitHub)
  13. Medium 6.5

    CVE-2025-61623 · Apache OFBiz

    Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 24.09.03, which fixes the issue.

    Published 12 Nov 2025 · Fixed in 24.09.03 · NVD
  14. High 7.3

    CVE-2025-59118 · Apache OFBiz

    Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 24.09.03, which fixes the issue.

    Published 12 Nov 2025 · Fixed in 24.09.03 · NVD
  15. Medium 4.3

    CVE-2025-37734 · Kibana

    Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.

    Published 12 Nov 2025 · Fixed in 8.19.7, 9.1.7 · NVD
  16. High 8.8

    CVE-2025-59499 · Microsoft SQL Server

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

    Published 11 Nov 2025 · Fixed in 15.0.4455.2, 16.0.1160.1, 16.0.4222.2 · NVD
  17. High 8.6

    CVE-2025-64507 · Incus

    Local privilege escalation through custom storage volumes

    Published 10 Nov 2025 · Fixed in 6.0.6, 6.19.0 · NVD, Project advisories (GitHub)
  18. High 8.0

    CVE-2025-64496 · Open WebUI

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account…

    Published 8 Nov 2025 · Fixed in 0.6.35 · NVD
  19. Medium 5.4

    CVE-2025-64495 · Open WebUI

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is assigned to the DOM sink .innerHtml without sanitisation. Any user with permissions to create prompts can…

    Published 8 Nov 2025 · Fixed in 0.6.35 · NVD
  20. Medium 4.1

    CVE-2025-63420 · CrushFTP

    CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin sessions.

    Published 7 Nov 2025 · Fixed in 11.3.7_57 · NVD
  21. Medium 4.3

    CVE-2025-10966 · curl

    curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

    Published 7 Nov 2025 · Fixed in 8.17.0 · NVD
  22. Medium 6.9

    CVE-2025-64329 · containerd

    Host memory exhaustion through goroutine leaks of Attach functionality in CRI server

    Published 6 Nov 2025 · Fixed in 1.7.29, 2.0.7, 2.1.5 · NVD, Project advisories (GitHub)
  23. High 7.8

    CVE-2024-25621 · containerd

    Local privilege escalation via wide permissions on several directories

    Published 6 Nov 2025 · Fixed in 1.7.29, 2.0.7, 2.1.5 · NVD, Project advisories (GitHub)
  24. Critical 9.9

    CVE-2025-63601 · Snipe-IT

    Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands.

    Published 5 Nov 2025 · Fixed in 8.3.3 · NVD
  25. High 8.4

    CVE-2025-52565 · runc

    container escape with malicious config due to /dev/console mount and related races

    Published 5 Nov 2025 · Fixed in 1.2.8, 1.3.3 · NVD, Project advisories (GitHub)
  26. High 7.3

    CVE-2025-52881 · runc

    container escape and denial of service due to arbitrary write gadgets and procfs write redirects

    Published 5 Nov 2025 · Fixed in 1.2.8, 1.3.3 · NVD, Project advisories (GitHub)
  27. High 7.3

    CVE-2025-31133 · runc

    container escape via "masked path" abuse due to mount race conditions

    Published 5 Nov 2025 · Fixed in 1.2.8, 1.3.3 · NVD, Project advisories (GitHub)
  28. Medium 6.0

    CVE-2024-13998 · Nagios XI

    Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts. CVE-2024-13995 addresses a similar vulnerability…

    Published 3 Nov 2025 · Fixed in 2024 · NVD
  29. Critical 9.4

    CVE-2024-13997 · Nagios XI

    Nagios XI versions prior to 2024R1.1.3 contain a privilege escalation vulnerability in which an authenticated administrator could leverage the Migrate Server feature to obtain root privileges on the underlying XI host. By abusing the migration workflow, an admin-level attacker could execute actions outside the intended security scope of the application, resulting in full control of the operating…

    Published 3 Nov 2025 · Fixed in 2024 · NVD
  30. Medium 5.1

    CVE-2021-47698 · Nagios XI

    Nagios XI versions prior to 5.8.7 using embedded Nagios Core are vulnerable to cross-site scripting (XSS) via the Core UI’s Views URL handling (escape_string()). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

    Published 3 Nov 2025 · Fixed in 5.8.7 · NVD
  31. Medium 5.9

    CVE-2025-12657 · MongoDB

    The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations.

    Published 3 Nov 2025 · Fixed in 7.0.22, 8.0.10 · NVD
  32. Medium 6.1

    CVE-2025-63593 · Grav

    Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS).

    Published 3 Nov 2025 · NVD
  33. Medium 6.9

    CVE-2025-12642 · lighttpd

    lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: * Bypass access control rules * Inject unsafe input into backend logic that trusts request headers * Execute HTTP Request Smuggling attacks under some conditions This issue affects…

    Published 3 Nov 2025 · NVD
  34. Critical 9.8

    CVE-2025-12493 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Path Traversal

    Published 3 Nov 2025 · Fixed in 3.2.6 · WPVulnerability
  35. High 7.7

    CVE-2025-62507 · Redis

    Bug in XACKDEL may lead to stack overflow and potential RCE

    Published 2 Nov 2025 · Fixed in 8.2.3 · NVD, Project advisories (GitHub)
  36. Medium 6.9

    CVE-2025-62275 · Liferay Portal / DXP

    Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.

    Published 1 Nov 2025 · Fixed in 7.4.3.112 · NVD
  37. Medium 4.6

    CVE-2025-62276 · Liferay Portal / DXP

    The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser's cache.

    Published 1 Nov 2025 · Fixed in 7.4.3.112 · NVD
  38. Medium 4.6

    CVE-2025-62267 · Liferay Portal / DXP

    Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 35 through update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle Name, or…

    Published 31 Oct 2025 · Fixed in 7.4.3.112 · NVD
  39. Medium 5.1

    CVE-2025-62264 · Liferay Portal / DXP

    Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId`…

    Published 31 Oct 2025 · Fixed in 7.4.3.112 · NVD
  40. Low 1.8

    CVE-2025-6075 · Python

    If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

    Published 31 Oct 2025 · Fixed in 3.9.0, 3.13.11, 3.14.1 · NVD
  41. Medium 5.1

    CVE-2024-13992 · Nagios XI

    Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link from another website. The vulnerable component, page-missing.php, fails to properly validate or escape user-supplied input, allowing an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the…

    Published 31 Oct 2025 · Fixed in 2024 · NVD
  42. High 7.5

    CVE-2025-58149 · Xen

    When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a domain can still have access any 64bit memory BAR when such device is no longer assigned to the domain. For PV domains the permission leak allows the domain itself to map the memory in the page-tables. For HVM it would require a compromised…

    Published 31 Oct 2025 · NVD
  43. High 7.5

    CVE-2025-58148 · Xen

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs. * CVE-2025-58147. Hypercalls using the…

    Published 31 Oct 2025 · NVD
  44. High 7.5

    CVE-2025-58147 · Xen

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs. * CVE-2025-58147. Hypercalls using the…

    Published 31 Oct 2025 · NVD
  45. High 7.5

    CVE-2025-62232 · Apache APISIX

    Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit:  https://github.com/apache/apisix/pull/12629 Users are recommended to upgrade to version 3.14, which fixes this…

    Published 31 Oct 2025 · Fixed in 3.14.0 · NVD
  46. High 7.5

    CVE-2025-8849 · LibreChat

    LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `value` parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessively large values are submitted. This results in the inability to create new memories,…

    Published 31 Oct 2025 · NVD
  47. High 8.8

    CVE-2025-48984 · Veeam Backup & Replication

    A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

    Published 31 Oct 2025 · Fixed in 12.3.2.4165 · NVD
  48. Critical 9.9

    CVE-2025-48983 · Veeam Backup & Replication

    A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.

    Published 31 Oct 2025 · Fixed in 12.3.2.4165 · NVD
  49. High 8.4

    CVE-2025-34287 · Nagios XI

    Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios user but owned by www-data. Because the file was writable by www-data, an attacker with web server privileges could modify its contents, leading to arbitrary code execution as the nagios user when the script is next run. This improper ownership and permission…

    Published 30 Oct 2025 · Fixed in 2024 · NVD
  50. Critical 9.4

    CVE-2025-34286 · Nagios XI

    Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insufficient validation/escaping of parameters used to build backend command lines allows an authenticated administrator to inject shell metacharacters that are executed on the server. Successful exploitation results in arbitrary command execution with the…

    Published 30 Oct 2025 · Fixed in 2026 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.