UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,914
Published in 7 days
992
Critical in 30 days
414
Actively exploited
420

Latest vulnerabilities

37,914 vulnerabilities
  1. Medium 6.9

    CVE-2020-36862 · Nagios XI

    Nagios XI versions prior to 5.6.11 contain unauthenticated vulnerabilities in the Highcharts local exporting tool. Crafted export requests could (1) inject script into exported/returned content due to insufficient output encoding (XSS), and (2) cause the server to fetch attacker-specified URLs (SSRF), potentially accessing internal network resources. An unauthenticated remote attacker can…

    Published 30 Oct 2025 · Fixed in 5.6.11 · NVD
  2. Medium 5.1

    CVE-2020-36861 · Nagios XI

    The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.8 / Nagios XI 5.7.5 contains multiple cross-site scripting (XSS) vulnerabilities in the overlay UI elements and the Notification/Check Period pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

    Published 30 Oct 2025 · Fixed in 5.7.5 · NVD
  3. Medium 5.1

    CVE-2020-36860 · Nagios XI

    The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple cross-site scripting (XSS) vulnerabilities in the object edit pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

    Published 30 Oct 2025 · Fixed in 5.7.4 · NVD
  4. High 8.7

    CVE-2020-36859 · Nagios XI

    The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple SQL injection vulnerabilities in the object edit pages. Unsanitized user-supplied input was incorporated into SQL queries used by configuration object editors, allowing authenticated users to inject SQL fragments. Successful exploitation could lead to unauthorized disclosure or modification…

    Published 30 Oct 2025 · Fixed in 5.7.4 · NVD
  5. High 8.6

    CVE-2020-36857 · Nagios XI

    Nagios XI versions prior to 5.6.14 contain a post-authentication SQL injection vulnerability in the SNMP Trap Interface page. Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not properly sanitized, allowing SQL injection that may lead to unauthorized disclosure or modification…

    Published 30 Oct 2025 · Fixed in 5.6.14 · NVD
  6. Critical 9.4

    CVE-2020-36856 · Nagios XI

    Nagios XI versions prior to 5.6.14 contain an authenticated remote command execution vulnerability in the CCM command_test.php script. Insufficient validation of the `address` parameter allows an authenticated user with access to the Core Config Manager to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command…

    Published 30 Oct 2025 · Fixed in 5.6.14 · NVD
  7. High 8.5

    CVE-2018-25123 · Nagios XI

    Nagios XI versions prior to 5.5.7 contain a privilege escalation vulnerability in the MRTG graphing component. MRTG-related processes/scripts executed with excessive privileges, allowing a local attacker with limited system access to abuse file/command execution paths or writable resources to gain elevated privileges.

    Published 30 Oct 2025 · Fixed in 5.5.7 · NVD
  8. High 8.7

    CVE-2018-25122 · Nagios XI

    Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handler used unsafe command construction with attacker-controlled input and lacked sufficient validation and output encoding, allowing an authenticated user to inject commands or otherwise execute arbitrary code with the privileges of the application service.

    Published 30 Oct 2025 · Fixed in 5.4.13 · NVD
  9. Medium 5.1

    CVE-2018-25121 · Nagios XI

    Nagios XI versions prior to 5.4.13 are vulnerable to cross-site scripting (XSS) via the Views page of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

    Published 30 Oct 2025 · Fixed in 5.4.13 · NVD
  10. Medium 5.1

    CVE-2016-15053 · Nagios XI

    Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the “My Reports” listing of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

    Published 30 Oct 2025 · Fixed in 5.2.4 · NVD
  11. Medium 5.1

    CVE-2016-15052 · Nagios XI

    Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the Menu System of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

    Published 30 Oct 2025 · Fixed in 5.2.4 · NVD
  12. Medium 5.1

    CVE-2016-15051 · Nagios XI

    Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the Reports interface through values from the startdate and enddate fields. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

    Published 30 Oct 2025 · Fixed in 5.2.4 · NVD
  13. High 8.7

    CVE-2016-15050 · Nagios XI

    Nagios XI versions prior to 5.2.4 contain a SQL injection vulnerability in the notification search functionality. User-supplied search parameters were incorporated into SQL statements without adequate parameterization or sanitation, allowing an authenticated user to manipulate database queries. Successful exploitation could disclose or modify notification data and, in some cases, impact the…

    Published 30 Oct 2025 · Fixed in 5.2.4 · NVD
  14. Medium 5.1

    CVE-2013-10074 · Nagios XI

    Nagios XI versions prior to 2012R2.6 are vulnerable to cross-site scripting (XSS) via the Tools Menu of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

    Published 30 Oct 2025 · Fixed in 2012 · NVD
  15. High 8.7

    CVE-2013-10073 · Nagios XI

    Nagios XI versions prior to 2012R1.6 contain a shell command injection vulnerability in the Auto-Discovery tool. User-controlled input is passed to a shell without adequate sanitation or argument quoting, allowing an authenticated user with access to discovery functionality to execute arbitrary commands with the privileges of the application service.

    Published 30 Oct 2025 · Fixed in 2012 · NVD
  16. High 7.2

    CVE-2013-10072 · Nagios XI

    Nagios XI versions prior to 2012R1.6 contain an authorization flaw in the Auto-Discovery functionality. Users with read-only roles could directly reach Auto-Discovery endpoints and pages that should require elevated permissions, exposing discovery results and allowing unintended access to discovery operations.

    Published 30 Oct 2025 · NVD
  17. Medium 5.1

    CVE-2013-10071 · Nagios XI

    Nagios XI versions prior to 2012R1.6 contain a reflected cross-site scripting (XSS) vulnerability in the dashboard dashlet AJAX load functionality. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

    Published 30 Oct 2025 · NVD
  18. High 8.7

    CVE-2012-10063 · Nagios XI

    Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database. Successful exploitation could disclose or modify notification data and, in…

    Published 30 Oct 2025 · NVD
  19. Medium 5.1

    CVE-2011-10040 · Nagios XI

    Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the link-handling functions used by status and report pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

    Published 30 Oct 2025 · NVD
  20. Medium 5.1

    CVE-2011-10039 · Nagios XI

    Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the Alert Heatmap report and the “My Reports” listing of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

    Published 30 Oct 2025 · NVD
  21. Medium 5.1

    CVE-2011-10038 · Nagios XI

    Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the recurring downtime script of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

    Published 30 Oct 2025 · NVD
  22. Medium 5.1

    CVE-2011-10037 · Nagios XI

    Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of xiwindow variables used to build permalinks in the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

    Published 30 Oct 2025 · NVD
  23. Medium 5.1

    CVE-2011-10036 · Nagios XI

    Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of the "backend_url" JavaScript link. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

    Published 30 Oct 2025 · NVD
  24. High 7.3

    CVE-2011-10035 · Nagios XI

    Nagios XI versions prior to 2011R1.9 contain privilege escalation vulnerabilities in the scripts that install or update system crontab entries. Due to time-of-check/time-of-use race conditions and missing synchronization or final-path validation, a local low-privileged user could manipulate filesystem state during crontab installation to influence the files or commands executed with elevated…

    Published 30 Oct 2025 · NVD
  25. High 8.8

    CVE-2025-8850 · LibreChat

    In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verification process. This vulnerability occurs because the backend does not properly validate the OTP or backup code when the API endpoint '/api/auth/2fa/disable' is…

    Published 30 Oct 2025 · NVD
  26. Medium 4.8

    CVE-2025-62265 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted <iframe> injected into a…

    Published 30 Oct 2025 · Fixed in 7.4.3.112 · NVD
  27. Medium 5.1

    CVE-2025-62266 · Liferay Portal / DXP

    By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated…

    Published 30 Oct 2025 · Fixed in 7.4.3.110 · NVD
  28. High 8.8

    CVE-2025-62726 · n8n

    n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing a pre-commit hook, the subsequent use of the Commit operation in the Git Node can inadvertently trigger the hook’s execution. This allows…

    Published 30 Oct 2025 · Fixed in 1.113.0 · NVD
  29. High 8.0

    CVE-2025-64112 · Statamic

    Privilege Escalation: Superadmin Account Takeover via Stored Cross-Site Scripting

    Published 30 Oct 2025 · Fixed in 5.22.1 · Project advisories (GitHub)
  30. Medium 4.6

    CVE-2025-62503 · Apache Airflow

    User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

    Published 30 Oct 2025 · Fixed in 3.1.1 · NVD
  31. Medium 5.4

    CVE-2025-62402 · Apache Airflow

    API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

    Published 30 Oct 2025 · Fixed in 3.1.1 · NVD
  32. Medium 4.6

    CVE-2025-54941 · Apache Airflow

    An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the `example_dag_decorator` please review it and apply the changes…

    Published 30 Oct 2025 · Fixed in 3.0.5 · NVD
  33. Medium 6.3

    CVE-2025-62257 · Liferay Portal / DXP

    Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack.

    Published 30 Oct 2025 · Fixed in 7.4.3.120 · NVD
  34. Medium 5.3

    CVE-2025-12521 · WP Analytify Pro (WordPress plugin)

    Analytify Pro: Exposure of Sensitive Information to an Unauthorized Actor

    Published 30 Oct 2025 · Fixed in 7.0.4 · WPVulnerability
  35. Critical 9.8

    CVE-2025-11201 · MLflow

    MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation…

    Published 29 Oct 2025 · Fixed in 2025-06-10 · NVD
  36. Critical 9.8

    CVE-2025-11200 · MLflow

    MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from weak password requirements. An attacker can leverage this vulnerability to…

    Published 29 Oct 2025 · NVD
  37. High 8.7

    CVE-2025-64103 · ZITADEL

    Bypass Second Authentication Factor

    Published 29 Oct 2025 · Fixed in 2.71.18, 3.4.3, 4.6.0 · NVD, Project advisories (GitHub)
  38. High 7.7

    CVE-2025-64102 · ZITADEL

    Brute-forcing authentication factors

    Published 29 Oct 2025 · Fixed in 2.71.18, 3.4.3, 4.6.0 · NVD, Project advisories (GitHub)
  39. High 8.8

    CVE-2025-64101 · ZITADEL

    Account Takeover via Malicious Forwarded Header Injection

    Published 29 Oct 2025 · Fixed in 2.71.18, 3.4.3, 4.6.0 · NVD, Project advisories (GitHub)
  40. High 8.8

    CVE-2025-11702 · GitLab

    GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker with specific permissions to hijack project runners from other projects.

    Published 29 Oct 2025 · Fixed in 18.3.5, 18.4.3 · NVD
  41. Unrated

    CVE-2025-49042 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 29 Oct 2025 · Fixed in 10.0.3 · WPVulnerability
  42. Medium 6.3

    CVE-2025-61598 · Discourse

    Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was missing from error responses. This may caused unintended caching of those responses by proxies potentially leading to cache poisoning attacks. This vulnerability is fixed in 3.6.2 and 3.6.0.beta2.

    Published 28 Oct 2025 · Fixed in 3.5.2, 3.6.0 · NVD
  43. Critical 9.8

    CVE-2025-64095 · DNN Platform

    Insufficient Access Control - Image Upload allows for Site Content Overwrite

    Published 28 Oct 2025 · Fixed in 10.1.1 · NVD, Project advisories (GitHub)
  44. Medium 5.4

    CVE-2025-64094 · DNN Platform

    Stored cross-site-scripting (XSS) via SVG upload

    Published 28 Oct 2025 · Fixed in 10.1.1 · NVD, Project advisories (GitHub)
  45. Medium 4.3

    CVE-2025-62802 · DNN Platform

    CKEditor Provider allows unauthenticated upload out-of-the-box

    Published 28 Oct 2025 · Fixed in 10.1.1 · NVD, Project advisories (GitHub)
  46. High

    CVE-2025-59837 · Astro

    Bypass of image proxy domain validation (CVE-2025-58179) - SSRF and potential XSS

    Published 28 Oct 2025 · Fixed in 5.13.10 · Project advisories (GitHub)
  47. High 8.8

    GHSA-j47w-4mr3-8gq6 · Astro

    Validate Changesets workflow vulnerable to arbitrary code execution

    Published 28 Oct 2025 · Project advisories (GitHub)
  48. Medium 6.1

    CVE-2025-12450 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 28 Oct 2025 · Fixed in 7.6 · WPVulnerability
  49. Medium 6.9

    CVE-2025-62259 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API.

    Published 27 Oct 2025 · Fixed in 7.4.3.110 · NVD
  50. High 7.0

    CVE-2025-62258 · Liferay Portal / DXP

    CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.

    Published 27 Oct 2025 · Fixed in 7.4.3.108 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.