UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,922
Published in 7 days
884
Critical in 30 days
414
Actively exploited
420

Latest vulnerabilities

37,922 vulnerabilities
  1. Critical 9.8

    CVE-2025-64095 · DNN Platform

    Insufficient Access Control - Image Upload allows for Site Content Overwrite

    Published 28 Oct 2025 · Fixed in 10.1.1 · NVD, Project advisories (GitHub)
  2. Medium 5.4

    CVE-2025-64094 · DNN Platform

    Stored cross-site-scripting (XSS) via SVG upload

    Published 28 Oct 2025 · Fixed in 10.1.1 · NVD, Project advisories (GitHub)
  3. Medium 4.3

    CVE-2025-62802 · DNN Platform

    CKEditor Provider allows unauthenticated upload out-of-the-box

    Published 28 Oct 2025 · Fixed in 10.1.1 · NVD, Project advisories (GitHub)
  4. High

    CVE-2025-59837 · Astro

    Bypass of image proxy domain validation (CVE-2025-58179) - SSRF and potential XSS

    Published 28 Oct 2025 · Fixed in 5.13.10 · Project advisories (GitHub)
  5. High 8.8

    GHSA-j47w-4mr3-8gq6 · Astro

    Validate Changesets workflow vulnerable to arbitrary code execution

    Published 28 Oct 2025 · Project advisories (GitHub)
  6. Medium 6.1

    CVE-2025-12450 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 28 Oct 2025 · Fixed in 7.6 · WPVulnerability
  7. Medium 6.9

    CVE-2025-62259 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API.

    Published 27 Oct 2025 · Fixed in 7.4.3.110 · NVD
  8. High 7.0

    CVE-2025-62258 · Liferay Portal / DXP

    CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.

    Published 27 Oct 2025 · Fixed in 7.4.3.108 · NVD
  9. Medium 6.9

    CVE-2025-62261 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.

    Published 27 Oct 2025 · Fixed in 7.4.3.100 · NVD
  10. High 7.1

    CVE-2025-62260 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects.

    Published 27 Oct 2025 · Fixed in 7.4.3.99 · NVD
  11. Medium 4.6

    CVE-2025-62262 · Liferay Portal / DXP

    Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows local users to view user email address in the log files.

    Published 27 Oct 2025 · Fixed in 7.4.3.98 · NVD
  12. Medium 5.5

    CVE-2025-62594 · ImageMagick

    ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function. When tile width or height is zero, unsigned underflow occurs in pointer arithmetic, leading to out-of-bounds memory access, and division-by-zero causes…

    Published 27 Oct 2025 · Fixed in 7.1.2-8 · NVD
  13. Medium 4.8

    CVE-2025-62263 · Liferay Portal / DXP

    Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account Role’s “Title” text field to (1) view account role page, or (2) select account role…

    Published 27 Oct 2025 · Fixed in 7.4.3.104 · NVD
  14. Medium 6.9

    CVE-2025-62253 · Liferay Portal / DXP

    Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the…

    Published 27 Oct 2025 · Fixed in 7.3, 7.4.3.98 · NVD
  15. Medium 5.3

    CVE-2025-61795 · Apache Tomcat

    Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible…

    Published 27 Oct 2025 · Fixed in 10.0.27, 10.1.47, 11.0.12 · NVD
  16. Critical 9.6

    CVE-2025-55754 · Apache Tomcat

    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the…

    Published 27 Oct 2025 · Fixed in 10.0.27, 10.1.45, 11.0.11 · NVD
  17. High 7.5

    CVE-2025-55752 · Apache Tomcat

    Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If…

    Published 27 Oct 2025 · Fixed in 10.0.27, 10.1.45, 11.0.11 · NVD
  18. High 7.5

    CVE-2025-11419 · Keycloak

    Keycloak TLS Client-Initiated Renegotiation Denial of Service

    Published 27 Oct 2025 · Fixed in 26.0.16 · Project advisories (GitHub)
  19. Medium 6.5

    CVE-2025-6601 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approval workflow.

    Published 27 Oct 2025 · Fixed in 18.4.3 · NVD
  20. High 8.1

    CVE-2025-11989 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to execute unauthorized quick actions by including malicious commands in specific descriptions.

    Published 27 Oct 2025 · Fixed in 18.3.5, 18.4.3 · NVD
  21. Medium 6.5

    CVE-2025-11974 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to specific API endpoints.

    Published 27 Oct 2025 · Fixed in 18.3.5, 18.4.3 · NVD
  22. Medium 6.5

    CVE-2025-11971 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits.

    Published 27 Oct 2025 · Fixed in 18.3.5, 18.4.3 · NVD
  23. High 7.5

    CVE-2025-11447 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending GraphQL requests with crafted JSON payloads.

    Published 27 Oct 2025 · Fixed in 18.3.5, 18.4.3 · NVD
  24. High 7.5

    CVE-2025-10497 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending specially crafted payloads.

    Published 27 Oct 2025 · Fixed in 18.3.5, 18.4.3 · NVD
  25. Unrated

    CVE-2025-9501 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 27 Oct 2025 · Fixed in 2.8.13 · WPVulnerability
  26. Medium

    GHSA-qrq5-v93p-8xhw · Frappe Framework

    Possible LDAP injection due to unsanitised inputs

    Published 24 Oct 2025 · Fixed in 14.99.2, 15.86.0 · Project advisories (GitHub)
  27. Medium 4.3

    CVE-2024-58269 · Rancher

    Exposure of sensitive information through audit logs

    Published 24 Oct 2025 · Fixed in 2.12.3 · Project advisories (GitHub)
  28. Medium 6.4

    CVE-2025-11823 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

    Published 24 Oct 2025 · Fixed in 3.2.5 · WPVulnerability
  29. Medium 4.3

    CVE-2023-32199 · Rancher

    User retains access to clusters despite Global Role removal

    Published 23 Oct 2025 · Fixed in 2.11.7, 2.12.3 · Project advisories (GitHub)
  30. Medium 6.9

    CVE-2025-62254 · Liferay Portal / DXP

    The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number or size of the files it will combine, which allows remote attackers to create very large responses that lead to a denial of…

    Published 23 Oct 2025 · NVD
  31. High 7.5

    CVE-2025-12044 · HashiCorp Vault

    Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393]  which allowed for processing JSON payloads before applying rate limits. This vulnerability,…

    Published 23 Oct 2025 · Fixed in 1.16.27, 1.20.5, 1.21.0 · NVD
  32. Low 2.0

    CVE-2025-62255 · Liferay Portal / DXP

    Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an attachment's filename.

    Published 23 Oct 2025 · Fixed in 7.3, 7.4.3.102 · NVD
  33. High 8.1

    CVE-2025-11621 · HashiCorp Vault

    Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27

    Published 23 Oct 2025 · Fixed in 1.19.11, 1.20.5, 1.21.0 · NVD
  34. Medium 6.9

    CVE-2025-62256 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not properly restrict access to OpenAPI in certain circumstances, which allows remote attackers to access the OpenAPI YAML file via a crafted URL.

    Published 23 Oct 2025 · Fixed in 7.4.3.110 · NVD
  35. Medium 4.3

    CVE-2025-62401 · Moodle

    An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.

    Published 23 Oct 2025 · Fixed in 4.4.11, 4.5.7, 5.0.3 · NVD
  36. Medium 6.5

    CVE-2025-62400 · Moodle

    Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.

    Published 23 Oct 2025 · Fixed in 4.4.11, 4.5.7, 5.0.3 · NVD
  37. High 7.5

    CVE-2025-62399 · Moodle

    Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.

    Published 23 Oct 2025 · Fixed in 4.4.11, 4.5.7, 5.0.3 · NVD
  38. Medium 5.4

    CVE-2025-62398 · Moodle

    A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.

    Published 23 Oct 2025 · Fixed in 4.4.11, 4.5.7, 5.0.3 · NVD
  39. Medium 5.3

    CVE-2025-62397 · Moodle

    The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.

    Published 23 Oct 2025 · Fixed in 5.0.3 · NVD
  40. Medium 5.3

    CVE-2025-62396 · Moodle

    An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.

    Published 23 Oct 2025 · Fixed in 4.5.7, 5.0.3 · NVD
  41. Medium 4.3

    CVE-2025-62395 · Moodle

    A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative data.

    Published 23 Oct 2025 · Fixed in 4.4.11, 4.5.7, 5.0.3 · NVD
  42. Medium 4.3

    CVE-2025-62394 · Moodle

    Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information.

    Published 23 Oct 2025 · Fixed in 4.5.7, 5.0.3 · NVD
  43. Medium 4.3

    CVE-2025-62393 · Moodle

    A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.

    Published 23 Oct 2025 · Fixed in 5.0.3 · NVD
  44. Low 2.0

    CVE-2025-62247 · Liferay Portal / DXP

    Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows instance users to read and select unauthorized Blueprints through the Collection Providers…

    Published 22 Oct 2025 · Fixed in 2024.q1.20 · NVD
  45. Medium 5.7

    CVE-2025-62705 · OpenBao

    OpenBao and Vault Leak []byte Fields in Audit Logs

    Published 22 Oct 2025 · Fixed in 2.4.2 · NVD, Project advisories (GitHub)
  46. Medium 4.8

    CVE-2025-62248 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows a remote, authenticated attacker to inject and…

    Published 22 Oct 2025 · Fixed in 2024.q1.20 · NVD
  47. Medium 5.7

    CVE-2025-62513 · OpenBao

    OpenBao leaks HTTPRawBody in Audit Logs

    Published 22 Oct 2025 · Fixed in 2.4.1, 2.4.2 · NVD, Project advisories (GitHub)
  48. Medium 5.4

    CVE-2025-8848 · LibreChat

    A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the <html lang=""> tag of the response. This can lead to potential security risks such as cross-site scripting (XSS) attacks.

    Published 22 Oct 2025 · NVD
  49. Medium 5.3

    CVE-2025-11750 · Dify

    In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system responds with a message such as "account not found." Conversely, when the username or email exists but…

    Published 22 Oct 2025 · NVD
  50. High 8.7

    CVE-2025-22167 · Jira

    This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server. This Path Traversal (Arbitrary Write) vulnerability, with a CVSS Score of 8.7, allows an attacker to modify any filesystem path writable by the Jira JVM process. Atlassian recommends that Jira Software Data Center and…

    Published 22 Oct 2025 · Fixed in 9.12.28, 10.3.12, 11.1.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.