UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,954
Published in 7 days
895
Critical in 30 days
416
Actively exploited
420

Latest vulnerabilities

37,954 vulnerabilities
  1. High 7.1

    CVE-2025-47148 · F5 BIG-IP

    When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 15.1.10.8, 16.1.6.1, 17.1.3 · NVD
  2. High 8.7

    CVE-2025-46706 · F5 BIG-IP

    When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 15 Oct 2025 · Fixed in 16.1.6, 17.1.2.2 · NVD
  3. Medium 5.4

    CVE-2025-61797 · Adobe Experience Manager

    Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Exploitation of this issue requires user interaction…

    Published 14 Oct 2025 · NVD
  4. Medium 5.4

    CVE-2025-61796 · Adobe Experience Manager

    Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Exploitation of this issue requires user interaction…

    Published 14 Oct 2025 · NVD
  5. Medium 5.4

    CVE-2025-54272 · Adobe Experience Manager

    Adobe Experience Manager versions 11.6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Exploitation of this issue requires user interaction…

    Published 14 Oct 2025 · NVD
  6. Medium 6.5

    CVE-2025-54267 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to elevated privileges that increase integrity impact to high. Exploitation of this issue does not require user…

    Published 14 Oct 2025 · NVD
  7. Medium 4.8

    CVE-2025-54266 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.…

    Published 14 Oct 2025 · NVD
  8. Medium 5.9

    CVE-2025-54265 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

    Published 14 Oct 2025 · NVD
  9. High 8.1

    CVE-2025-54264 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page…

    Published 14 Oct 2025 · NVD
  10. High 8.1

    CVE-2025-54263 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and maintain unauthorized access. Exploitation of this issue does not require user interaction.

    Published 14 Oct 2025 · NVD
  11. High 8.4

    CVE-2025-34267 · Flowise

    Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated attacker able to create or run a tool that leverages Puppeteer/Playwright can specify…

    Published 14 Oct 2025 · Fixed in 3.0.8 · NVD
  12. High 8.8

    CVE-2025-59249 · Microsoft Exchange Server

    Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

    Published 14 Oct 2025 · Fixed in 15.02.2562.029 · NVD
  13. High 7.5

    CVE-2025-59248 · Microsoft Exchange Server

    Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    Published 14 Oct 2025 · Fixed in 15.02.2562.029 · NVD
  14. Critical 9.9

    CVE-2025-55315 · .NET

    Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

    Published 14 Oct 2025 · Fixed in 2.3.6, 8.0.21, 9.0.10 · NVD
  15. Medium 5.7

    CVE-2025-55248 · .NET

    Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.

    Published 14 Oct 2025 · Fixed in 8.0.21, 9.0.10 · NVD
  16. High 7.3

    CVE-2025-55247 · .NET

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

    Published 14 Oct 2025 · Fixed in 8.0.21, 9.0.10 · NVD
  17. High 7.8

    CVE-2025-53782 · Microsoft Exchange Server

    Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.

    Published 14 Oct 2025 · Fixed in 15.02.2562.029 · NVD
  18. Medium 4.9

    CVE-2025-37145 · HPE ArubaOS

    Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  19. Medium 4.9

    CVE-2025-37144 · HPE ArubaOS

    Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  20. Medium 4.9

    CVE-2025-37143 · HPE ArubaOS

    An arbitrary file download vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated malicious actor to download arbitrary files through carefully constructed exploits.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  21. Medium 4.9

    CVE-2025-37142 · HPE ArubaOS

    Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  22. Medium 4.9

    CVE-2025-37141 · HPE ArubaOS

    Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  23. Medium 4.9

    CVE-2025-37140 · HPE ArubaOS

    Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  24. Medium 6.2

    CVE-2025-37138 · HPE ArubaOS

    An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating system. Exploitation of this vulnerability requires physical access to the hardware controllers. A successful attack could allow an authenticated malicious actor with physical access to execute arbitrary commands as a privileged user on the…

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  25. Medium 6.5

    CVE-2025-37137 · HPE ArubaOS

    Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  26. Medium 6.5

    CVE-2025-37136 · HPE ArubaOS

    Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  27. Medium 6.5

    CVE-2025-37135 · HPE ArubaOS

    Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  28. High 7.2

    CVE-2025-37134 · HPE ArubaOS

    An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  29. High 7.2

    CVE-2025-37133 · HPE ArubaOS

    An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  30. High 7.2

    CVE-2025-37132 · HPE ArubaOS

    An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files and execute arbitrary commands on the underlying operating system.

    Published 14 Oct 2025 · Fixed in 8.13.1.0, 10.4.1.9, 10.7.2.1 · NVD
  31. Medium 4.9

    CVE-2025-58903 · Fortinet FortiOS

    An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specialy crafted request.

    Published 14 Oct 2025 · Fixed in 7.4.9, 7.6.4 · NVD
  32. Medium 6.7

    CVE-2025-58325 · Fortinet FortiOS

    An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may allow a local authenticated attacker to execute system commands via crafted CLI commands.

    Published 14 Oct 2025 · Fixed in 7.0.16, 7.2.11, 7.4.6 · NVD
  33. High 8.8

    CVE-2025-57740 · Fortinet FortiProxy, Fortinet FortiOS

    An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions…

    Published 14 Oct 2025 · Fixed in 7.4.4, 7.4.8, 7.6.3 · NVD
  34. Medium 4.3

    CVE-2025-54822 · Fortinet FortiProxy, Fortinet FortiOS

    An improper authorization vulnerability [CWE-285] vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.11, FortiProxy 7.4.0 through 7.4.8, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiProxy 2.0 all versions allows an authenticated attacker to access static files of others VDOMs via crafted HTTP or HTTPS requests.

    Published 14 Oct 2025 · Fixed in 7.2.9, 7.4.2, 7.4.9 · NVD
  35. Medium 6.1

    CVE-2025-47890 · Fortinet FortiProxy, Fortinet FortiOS

    An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSASE 25.2.a may allow an unauthenticated attacker…

    Published 14 Oct 2025 · Fixed in 7.4.9, 7.6.4 · NVD
  36. Medium 4.3

    CVE-2025-31514 · Fortinet FortiProxy, Fortinet FortiOS

    A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to information disclosure via <insert attack…

    Published 14 Oct 2025 · Fixed in 7.6.4 · NVD
  37. Medium 6.1

    CVE-2025-31366 · Fortinet FortiProxy, Fortinet FortiOS

    An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSASE 25.2.a may allow an…

    Published 14 Oct 2025 · Fixed in 7.4.9, 7.6.4 · NVD
  38. Medium 4.3

    CVE-2025-25255 · Fortinet FortiProxy, Fortinet FortiOS

    An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0.1 through 7.0.22 may allow an unauthenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests.

    Published 14 Oct 2025 · Fixed in 7.6.4 · NVD
  39. High 7.5

    CVE-2025-25253 · Fortinet FortiProxy, Fortinet FortiOS

    An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections…

    Published 14 Oct 2025 · Fixed in 7.4.9, 7.6.2, 7.6.3 · NVD
  40. Medium 6.5

    CVE-2025-25252 · Fortinet FortiOS

    An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML…

    Published 14 Oct 2025 · Fixed in 7.2.11, 7.4.7, 7.6.3 · NVD
  41. High 7.2

    CVE-2025-22258 · Fortinet FortiProxy, Fortinet FortiOS

    A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1, 7.4.0 through 7.4.7, FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.2 through 7.0.16, FortiSwitchManager 7.2.1 through 7.2.5 allows attackers to…

    Published 14 Oct 2025 · Fixed in 7.4.8, 7.6.2, 7.6.3 · NVD
  42. High 7.2

    CVE-2024-50571 · Fortinet FortiProxy, Fortinet FortiOS

    A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7.2.0 through 7.2.9, FortiAnalyzer 7.0.0 through 7.0.13, FortiAnalyzer 6.4 all versions, FortiAnalyzer 6.2 all versions, FortiAnalyzer 6.0 all versions, FortiAnalyzer Cloud 7.4.1 through 7.4.5, FortiAnalyzer Cloud 7.2.1 through 7.2.9, FortiAnalyzer Cloud…

    Published 14 Oct 2025 · Fixed in 7.4.7, 7.4.8, 7.6.3 · NVD
  43. Medium 4.3

    CVE-2024-47569 · Fortinet FortiProxy, Fortinet FortiWeb, Fortinet FortiOS

    A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiNDR 7.6.0 through 7.6.1, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR…

    Published 14 Oct 2025 · Fixed in 7.2.9, 7.2.11, 7.4.5 · NVD
  44. Medium 5.3

    CVE-2024-26008 · Fortinet FortiProxy, Fortinet FortiOS

    An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version 7.4.0 through 7.4.3 and before 7.2.9, FortiPAM before 1.2.0 and FortiSwitchManager version 7.2.0 through 7.2.3 and version 7.0.0 through 7.0.3 fgfm daemon may allow an unauthenticated attacker to repeatedly reset the fgfm connection via…

    Published 14 Oct 2025 · Fixed in 7.2.8, 7.2.10, 7.4.4 · NVD
  45. High 7.8

    CVE-2023-46718 · Fortinet FortiProxy, Fortinet FortiOS

    A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16 and 6.0.13 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted CLI commands.

    Published 14 Oct 2025 · Fixed in 7.2.12, 7.4.2, 7.4.8 · NVD
  46. Medium 4.8

    CVE-2025-62251 · Liferay Portal / DXP

    Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows content to users who do not have permission to view it via the Menu Display Widget. This security flaw could result in sensitive information being exposed to unauthorized users.

    Published 13 Oct 2025 · Fixed in 7.4.3.119, 2023.q3.9, 2023.q4.6 · NVD
  47. Medium 5.3

    CVE-2025-62252 · Liferay Portal / DXP

    Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users in one virtual instance to assign an organization to a user in a different virtual instance via the…

    Published 13 Oct 2025 · Fixed in 7.4.3.112, 2023.q4.6 · NVD
  48. Medium 4.8

    CVE-2025-62246 · Liferay Portal / DXP

    Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a user’s first, middle or…

    Published 13 Oct 2025 · Fixed in 7.4.3.112, 2023.q3.9, 2023.q4.6 · NVD
  49. Medium 5.3

    CVE-2025-62242 · Liferay Portal / DXP

    Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses from a different account via the…

    Published 13 Oct 2025 · Fixed in 7.4.3.112 · NVD
  50. Medium 5.3

    CVE-2025-62241 · Liferay Portal / DXP

    Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual instance to view the shipment addresses of different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.

    Published 13 Oct 2025 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.