UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,924
Published in 7 days
885
Critical in 30 days
414
Actively exploited
420

Latest vulnerabilities

37,924 vulnerabilities
  1. Medium 5.3

    CVE-2025-11750 · Dify

    In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system responds with a message such as "account not found." Conversely, when the username or email exists but…

    Published 22 Oct 2025 · NVD
  2. High 8.7

    CVE-2025-22167 · Jira

    This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server. This Path Traversal (Arbitrary Write) vulnerability, with a CVSS Score of 8.7, allows an attacker to modify any filesystem path writable by the Jira JVM process. Atlassian recommends that Jira Software Data Center and…

    Published 22 Oct 2025 · Fixed in 9.12.28, 10.3.12, 11.1.0 · NVD
  3. Medium 5.3

    CVE-2025-61764 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a…

    Published 21 Oct 2025 · NVD
  4. High 7.5

    CVE-2025-61752 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 21 Oct 2025 · NVD
  5. Low 3.7

    CVE-2025-61748 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple…

    Published 21 Oct 2025 · NVD
  6. Medium 4.9

    CVE-2025-53069 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 21 Oct 2025 · Fixed in 8.0.43, 8.4.6, 9.4.0 · NVD
  7. Medium 4.9

    CVE-2025-53067 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 21 Oct 2025 · Fixed in 9.4.0 · NVD
  8. High 7.5

    CVE-2025-53066 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker…

    Published 21 Oct 2025 · NVD
  9. Medium 4.9

    CVE-2025-53062 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 21 Oct 2025 · Fixed in 8.0.43, 8.4.6, 9.4.0 · NVD
  10. Medium 5.9

    CVE-2025-53057 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated…

    Published 21 Oct 2025 · NVD
  11. Medium 5.5

    CVE-2025-53054 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 21 Oct 2025 · NVD
  12. Medium 5.5

    CVE-2025-53053 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 21 Oct 2025 · NVD
  13. Medium 4.9

    CVE-2025-53045 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 21 Oct 2025 · NVD
  14. Medium 4.9

    CVE-2025-53044 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 21 Oct 2025 · NVD
  15. Medium 4.9

    CVE-2025-53042 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 21 Oct 2025 · NVD
  16. Medium 4.9

    CVE-2025-53040 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 21 Oct 2025 · NVD
  17. Medium 6.9

    CVE-2025-62249 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20, and 2023.Q4.0 through 2023.Q4.10 allows an remote non-authenticated…

    Published 21 Oct 2025 · Fixed in 2024.q1.21, 2025.q1.18, 2025.q3.3 · NVD
  18. Medium 6.9

    CVE-2025-62250 · Liferay Portal / DXP

    Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to send malicious data to the Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0,…

    Published 21 Oct 2025 · Fixed in 7.3, 7.4.3.132, 2023.q3.5 · NVD
  19. High 8.3

    CVE-2025-22166 · Confluence

    This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Atlassian recommends that Confluence Data Center…

    Published 21 Oct 2025 · Fixed in 8.5.25, 9.2.7, 10.0.2 · NVD
  20. Medium 4.3

    CVE-2025-62605 · Mastodon

    Quotes control bypass

    Published 21 Oct 2025 · Fixed in 4.4.8 · NVD, Project advisories (GitHub)
  21. Low 3.1

    GHSA-h2x3-h9qr-cf82 · Shopware

    Missing CSRF protection in subscription management

    Published 21 Oct 2025 · Project advisories (GitHub)
  22. Medium 4.3

    GHSA-r2vg-hvjm-fg38 · Shopware

    Customer Orders can be canceled, even if refunds are disabled

    Published 21 Oct 2025 · Fixed in 6.6.10.7 · Project advisories (GitHub)
  23. Low 2.7

    GHSA-6wh5-mw9h-5c3w · Shopware

    Path traversal via Plugin upload

    Published 21 Oct 2025 · Fixed in 6.6.10.7 · Project advisories (GitHub)
  24. Low 2.7

    GHSA-3cpp-fv95-mpr5 · Shopware

    Server-Side Request Forgery (SSRF) – order invoice

    Published 21 Oct 2025 · Fixed in 6.6.10.7 · Project advisories (GitHub)
  25. Medium 4.9

    GHSA-27c9-vp3w-6ww8 · Shopware

    Exposure of sensitive user information via CSV export mapping

    Published 21 Oct 2025 · Fixed in 6.6.10.7 · Project advisories (GitHub)
  26. Medium 5.3

    GHSA-m895-2hj3-8cg9 · Shopware

    Reading media entities by aggregating fields individually bypasses MediaVisibilityRestrictionSubscriber

    Published 21 Oct 2025 · Fixed in 6.6.10.7 · Project advisories (GitHub)
  27. Medium 5.9

    CVE-2025-67554 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 21 Oct 2025 · Fixed in 2.5.9 · WPVulnerability
  28. Medium 6.5

    CVE-2025-11979 · MongoDB

    An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0.

    Published 20 Oct 2025 · Fixed in 7.0.25, 8.0.15 · NVD
  29. Medium 6.5

    GHSA-vffh-c9pq-4crh · Uptime Kuma

    Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read

    Published 20 Oct 2025 · Fixed in 2.0.0 · Project advisories (GitHub)
  30. High 7.2

    CVE-2026-5934 · WP Rocket (WordPress plugin)

    WP Rocket: Cross-site Scripting

    Published 20 Oct 2025 · Fixed in 3.21.1 · WPVulnerability
  31. Medium 5.9

    CVE-2026-28044 · WP Rocket (WordPress plugin)

    WP Rocket: Cross-site Scripting

    Published 20 Oct 2025 · Fixed in 3.20.0.2 · WPVulnerability
  32. Medium 6.5

    CVE-2025-57164 · Flowise

    Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase RPC Filter" field.

    Published 17 Oct 2025 · NVD
  33. High 7.5

    CVE-2025-62171 · ImageMagick

    ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4…

    Published 17 Oct 2025 · Fixed in 6.9.13-32, 7.1.2-7 · NVD
  34. High 7.5

    CVE-2025-59043 · OpenBao

    Potential Denial of Service when processing malicious unauthenticated JSON requests

    Published 17 Oct 2025 · Fixed in 2.4.0, 2.4.1 · NVD, Project advisories (GitHub)
  35. Low 2.0

    CVE-2025-58747 · Dify

    Dify MCP OAuth Flow Vulnerable to XSS

    Published 17 Oct 2025 · Fixed in 1.8.0, 1.9.2 · NVD, Project advisories (GitHub)
  36. High 7.5

    CVE-2025-62168 · Squid

    SQUID-2025:2 Information Disclosure in Error handling

    Published 17 Oct 2025 · Fixed in 7.2 · NVD, Project advisories (GitHub)
  37. High 7.5

    CVE-2025-62504 · Envoy

    Lua modified large enough response body will cause Envoy to crash

    Published 16 Oct 2025 · Fixed in 1.34.10, 1.35.6, 1.36.2 · NVD, Project advisories (GitHub)
  38. High 7.1

    CVE-2025-61541 · Webmin

    Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full…

    Published 16 Oct 2025 · NVD
  39. High 8.2

    CVE-2024-56143 · Strapi

    Unauthorized Access to Private Fields via parms.lookup

    Published 16 Oct 2025 · Fixed in 5.5.2 · NVD, Project advisories (GitHub)
  40. Medium 6.3

    CVE-2025-25298 · Strapi

    Weak Password Length Validation

    Published 16 Oct 2025 · Fixed in 5.10.3 · NVD, Project advisories (GitHub)
  41. Medium 6.5

    CVE-2025-53092 · Strapi

    CORS Misconfiguration Leads to Sensitive Data Exposure

    Published 16 Oct 2025 · Fixed in 5.20.0 · NVD, Project advisories (GitHub)
  42. High 8.1

    CVE-2025-58075 · Mattermost

    Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState

    Published 16 Oct 2025 · Fixed in 10.5.11, 10.10.3, 10.11.3 · NVD
  43. High 8.1

    CVE-2025-58073 · Mattermost

    Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.

    Published 16 Oct 2025 · Fixed in 10.5.11, 10.10.3, 10.11.3 · NVD
  44. Low 3.7

    CVE-2025-54499 · Mattermost

    Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets

    Published 16 Oct 2025 · Fixed in 10.5.11, 10.11.3 · NVD
  45. Medium 5.4

    CVE-2025-41410 · Mattermost

    Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions

    Published 16 Oct 2025 · Fixed in 10.5.11, 10.10.3, 10.11.3 · NVD
  46. Medium 4.3

    CVE-2025-10545 · Mattermost

    Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the `/api/v4/channels/{channel_id}/members` endpoint

    Published 16 Oct 2025 · Fixed in 10.5.11, 10.11.3 · NVD
  47. Medium 4.3

    CVE-2025-41443 · Mattermost

    Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint

    Published 16 Oct 2025 · Fixed in 10.5.11, 10.11.3 · NVD
  48. Medium 6.1

    CVE-2025-62407 · Frappe Framework

    Open Redirect on Login Page

    Published 16 Oct 2025 · Fixed in 14.98.0, 15.83.0 · NVD, Project advisories (GitHub)
  49. Medium 6.6

    CVE-2025-62409 · Envoy

    Large requests and responses can cause TCP connection pool crash

    Published 15 Oct 2025 · Fixed in 1.33.11, 1.34.9, 1.35.5 · NVD, Project advisories (GitHub)
  50. High 8.7

    CVE-2025-61990 · F5 BIG-IP

    When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 16.1.6.1, 17.1.3, 17.5.1.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.