UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,924
Published in 7 days
885
Critical in 30 days
414
Actively exploited
420

Latest vulnerabilities

37,924 vulnerabilities
  1. Medium 5.1

    CVE-2025-61933 · F5 BIG-IP

    A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of the targeted logged-out user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 16.1.6.1, 17.1.3, 17.5.1.3 · NVD
  2. High 8.7

    CVE-2025-58071 · F5 BIG-IP

    When IPsec is configured on the BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6.1, 17.1.3 · NVD
  3. High 8.7

    CVE-2025-61960 · F5 BIG-IP

    When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 16.1.6.1, 17.1.3, 17.5.1.3 · NVD
  4. High 8.5

    CVE-2025-61958 · F5 BIG-IP

    A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to a bash shell.  For BIG-IP systems running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not…

    Published 15 Oct 2025 · Fixed in 16.1.6.1, 17.1.3, 17.5.1.1 · NVD
  5. High 8.7

    CVE-2025-61951 · F5 BIG-IP

    Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  This issue may occur when a Datagram Transport Layer Security (DTLS) 1.2 virtual server is enabled with a Server SSL profile that is configured with a certificate, key, and the SSL Sign Hash set to ANY, and the backend server is enabled with DTLS 1.2 and client authentication.  Note: Software versions which…

    Published 15 Oct 2025 · Fixed in 16.1.6.1, 17.1.3 · NVD
  6. High 8.7

    CVE-2025-59781 · F5 BIG-IP

    When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increase in memory resource utilization.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6, 17.1.2.2 · NVD
  7. High 8.5

    CVE-2025-59483 · F5 BIG-IP

    A validation vulnerability exists in an undisclosed URL in the Configuration utility.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6.1, 17.1.3 · NVD
  8. High 8.5

    CVE-2025-59481 · F5 BIG-IP

    A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource administrator role to execute arbitrary system commands with higher privileges.  A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not…

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6.1, 17.1.3 · NVD
  9. High 8.4

    CVE-2025-59269 · F5 BIG-IP

    A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6.1, 17.1.3 · NVD
  10. Medium 6.9

    CVE-2025-59268 · F5 BIG-IP

    On the BIG-IP system, undisclosed endpoints that contain static non-sensitive information are accessible to an unauthenticated remote attacker through the Configuration utility.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6.1, 17.1.3 · NVD
  11. Medium 6.3

    CVE-2025-58424 · F5 BIG-IP

    On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols which do not have message integrity protection.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6 · NVD
  12. High 8.2

    CVE-2025-58153 · F5 BIG-IP

    Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-Speed Bridge (HSB) may experience a lockup of the HSB.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6.1 · NVD
  13. High 8.2

    CVE-2025-58096 · F5 BIG-IP

    When the database variable tm.tcpudptxchecksum is configured as non-default value Software-only on a BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6.1, 17.1.3 · NVD
  14. High 8.7

    CVE-2025-54854 · F5 BIG-IP

    When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6.1, 17.1.3 · NVD
  15. Medium 6.9

    CVE-2025-54755 · F5 BIG-IP

    A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access files which are not limited to the intended files.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6.1, 17.1.3 · NVD
  16. High 8.5

    CVE-2025-53868 · F5 BIG-IP

    When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to bypass Appliance mode restrictions using undisclosed commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6.1, 17.1.3 · NVD
  17. High 8.7

    CVE-2025-53856 · F5 BIG-IP

    When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  To determine which BIG-IP platforms have an ePVA chip refer to K12837: Overview of the ePVA feature…

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6.1, 17.1.3 · NVD
  18. Critical 9.3Actively exploited

    CVE-2025-53521 · F5 BIG-IP

    When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 16.1.6.1, 17.1.3, 17.5.1.3 · NVD
  19. High 8.7

    CVE-2025-53474 · F5 BIG-IP

    When an iRule using an ILX::call command is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 15.1.1.0.8, 16.1.6.1, 17.1.3 · NVD
  20. High 8.7

    CVE-2025-48008 · F5 BIG-IP

    When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6 · NVD
  21. High 7.1

    CVE-2025-47148 · F5 BIG-IP

    When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6.1, 17.1.3 · NVD
  22. High 8.7

    CVE-2025-46706 · F5 BIG-IP

    When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 16.1.6, 17.1.2.2 · NVD
  23. Medium 5.4

    CVE-2025-61797 · Adobe Experience Manager

    Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Exploitation of this issue requires user interaction…

    Published 14 Oct 2025 · NVD
  24. Medium 5.4

    CVE-2025-61796 · Adobe Experience Manager

    Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Exploitation of this issue requires user interaction…

    Published 14 Oct 2025 · NVD
  25. Medium 5.4

    CVE-2025-54272 · Adobe Experience Manager

    Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Exploitation of this issue requires user interaction…

    Published 14 Oct 2025 · NVD
  26. Medium 6.5

    CVE-2025-54267 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to elevated privileges that increase integrity impact to high. Exploitation of this issue does not require user…

    Published 14 Oct 2025 · NVD
  27. Medium 4.8

    CVE-2025-54266 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.…

    Published 14 Oct 2025 · NVD
  28. Medium 5.9

    CVE-2025-54265 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

    Published 14 Oct 2025 · NVD
  29. High 8.1

    CVE-2025-54264 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page…

    Published 14 Oct 2025 · NVD
  30. High 8.1

    CVE-2025-54263 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and maintain unauthorized access. Exploitation of this issue does not require user interaction.

    Published 14 Oct 2025 · NVD
  31. High 8.4

    CVE-2025-34267 · Flowise

    Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated attacker able to create or run a tool that leverages Puppeteer/Playwright can specify…

    Published 14 Oct 2025 · Fixed in 3.0.8 · NVD
  32. High 8.8

    CVE-2025-59249 · Microsoft Exchange Server

    Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

    Published 14 Oct 2025 · Fixed in 15.02.2562.029 · NVD
  33. High 7.5

    CVE-2025-59248 · Microsoft Exchange Server

    Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    Published 14 Oct 2025 · Fixed in 15.02.2562.029 · NVD
  34. Critical 9.9

    CVE-2025-55315 · .NET

    Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

    Published 14 Oct 2025 · Fixed in 2.3.6, 8.0.21, 9.0.10 · NVD
  35. Medium 5.7

    CVE-2025-55248 · .NET

    Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.

    Published 14 Oct 2025 · Fixed in 8.0.21, 9.0.10 · NVD
  36. High 7.3

    CVE-2025-55247 · .NET

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

    Published 14 Oct 2025 · Fixed in 8.0.21, 9.0.10 · NVD
  37. High 7.8

    CVE-2025-53782 · Microsoft Exchange Server

    Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.

    Published 14 Oct 2025 · Fixed in 15.02.2562.029 · NVD
  38. Medium 4.9

    CVE-2025-37145 · HPE ArubaOS

    Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  39. Medium 4.9

    CVE-2025-37144 · HPE ArubaOS

    Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  40. Medium 4.9

    CVE-2025-37143 · HPE ArubaOS

    An arbitrary file download vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated malicious actor to download arbitrary files through carefully constructed exploits.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  41. Medium 4.9

    CVE-2025-37142 · HPE ArubaOS

    Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  42. Medium 4.9

    CVE-2025-37141 · HPE ArubaOS

    Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  43. Medium 4.9

    CVE-2025-37140 · HPE ArubaOS

    Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  44. Medium 6.2

    CVE-2025-37138 · HPE ArubaOS

    An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating system. Exploitation of this vulnerability requires physical access to the hardware controllers. A successful attack could allow an authenticated malicious actor with physical access to execute arbitrary commands as a privileged user on the…

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  45. Medium 6.5

    CVE-2025-37137 · HPE ArubaOS

    Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  46. Medium 6.5

    CVE-2025-37136 · HPE ArubaOS

    Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  47. Medium 6.5

    CVE-2025-37135 · HPE ArubaOS

    Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  48. High 7.2

    CVE-2025-37134 · HPE ArubaOS

    An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  49. High 7.2

    CVE-2025-37133 · HPE ArubaOS

    An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  50. High 7.2

    CVE-2025-37132 · HPE ArubaOS

    An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files and execute arbitrary commands on the underlying operating system.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.