UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
9,661
Published in 7 days
200
Critical in 30 days
35
Actively exploited
47

Latest vulnerabilities

9,661 vulnerabilities
  1. Medium 4.3

    CVE-2026-2619 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects due to incorrect authorization.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  2. Medium 4.3

    CVE-2026-2104 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to access confidential issues assigned to other users via CSV export due to insufficient authorization checks.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  3. Medium 4.3

    CVE-2026-1752 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in the API.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  4. Medium 5.7

    CVE-2026-1516 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.0.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that in Code Quality reports could have allowed an authenticated user to leak IP addresses of users viewing the report via specially crafted content.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  5. Medium 6.5

    CVE-2026-1101 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to cause denial of service to the GitLab instance due to improper input validation in GraphQL queries.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  6. High 7.5

    CVE-2026-1092 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service due to improper input validation of JSON payloads.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  7. Medium 4.3

    CVE-2025-9484 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user to have access to other users' email addresses via certain GraphQL queries.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  8. High 7.5

    CVE-2025-12664 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  9. High 7.5

    CVE-2026-31790 · OpenSSL

    Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes…

    Published 7 Apr 2026 · Fixed in 3.4.5, 3.5.6, 3.6.2 · NVD
  10. Critical 9.8

    CVE-2026-31789 · OpenSSL

    Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such…

    Published 7 Apr 2026 · Fixed in 3.4.5, 3.5.6, 3.6.2 · NVD
  11. High 7.5

    CVE-2026-28390 · OpenSSL

    Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP…

    Published 7 Apr 2026 · Fixed in 3.4.5, 3.5.6, 3.6.2 · NVD
  12. High 7.5

    CVE-2026-28389 · OpenSSL

    Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional…

    Published 7 Apr 2026 · Fixed in 3.4.5, 3.5.6, 3.6.2 · NVD
  13. High 7.5

    CVE-2026-28388 · OpenSSL

    Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the…

    Published 7 Apr 2026 · Fixed in 3.4.5, 3.5.6, 3.6.2 · NVD
  14. High 8.1

    CVE-2026-28387 · OpenSSL

    Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue…

    Published 7 Apr 2026 · Fixed in 3.4.5, 3.5.6, 3.6.2 · NVD
  15. High 7.5

    CVE-2026-28386 · OpenSSL

    Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds read of up to 15 bytes when processing partial cipher blocks. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is…

    Published 7 Apr 2026 · Fixed in 3.6.2 · NVD
  16. High 7.6

    CVE-2026-32144 · Erlang/OTP

    Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification. The OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder…

    Published 7 Apr 2026 · Fixed in 27.3.4.10, 28.4.2 · NVD
  17. High 8.3

    CVE-2026-28808 · Erlang/OTP

    Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved…

    Published 7 Apr 2026 · Fixed in 26.2.5.19, 27.3.4.10, 28.4.2 · NVD
  18. Medium 6.3

    CVE-2026-28810 · Erlang/OTP

    Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an…

    Published 7 Apr 2026 · Fixed in 26.2.5.19, 27.3.4.10, 28.4.2 · NVD
  19. Medium 6.4

    CVE-2025-14732 · Elementor

    Elementor Website Builder – more than just a page builder: Improper Neutralization of Alternate XSS Syntax

    Published 7 Apr 2026 · Fixed in 3.35.6 · WPVulnerability
  20. Low 2.7

    CVE-2026-34947 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, staged user custom fields and username are exposed on public invite pages without email verification. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

    Published 3 Apr 2026 · NVD
  21. Medium 6.3

    CVE-2026-27481 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass vulnerability allows unauthenticated or unauthorized users to view hidden (staff-only) tags and its associated data. All Discourse instances with tagging enabled and staff-only tag groups configured…

    Published 3 Apr 2026 · NVD
  22. Medium 6.5

    CVE-2026-35549 · MariaDB

    An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca.

    Published 3 Apr 2026 · Fixed in 11.4.10, 11.8.6, 12.2.2 · NVD
  23. High 8.1

    CVE-2026-35414 · OpenSSH

    OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

    Published 2 Apr 2026 · Fixed in 10.3 · NVD
  24. Low 2.5

    CVE-2026-35388 · OpenSSH

    OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

    Published 2 Apr 2026 · Fixed in 10.3 · NVD
  25. Medium 6.5

    CVE-2026-35387 · OpenSSH

    OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.

    Published 2 Apr 2026 · Fixed in 10.3 · NVD
  26. High 8.1

    CVE-2026-35386 · OpenSSH

    In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.

    Published 2 Apr 2026 · Fixed in 10.3 · NVD
  27. High 8.1

    CVE-2026-35385 · OpenSSH

    In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

    Published 2 Apr 2026 · Fixed in 10.3 · NVD
  28. High 8.6

    CVE-2026-23899 · Joomla!

    An improper access check allows unauthorized access to webservice endpoints.

    Published 1 Apr 2026 · Fixed in 5.4.4, 6.0.4 · NVD
  29. High 8.6

    CVE-2026-23898 · Joomla!

    Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

    Published 1 Apr 2026 · Fixed in 5.4.4, 6.0.4 · NVD
  30. Medium 5.9

    CVE-2026-21632 · Joomla!

    Lack of output escaping for article titles leads to XSS vectors in various locations.

    Published 1 Apr 2026 · Fixed in 5.4.4, 6.0.4 · NVD
  31. Medium 5.9

    CVE-2026-21631 · Joomla!

    Lack of output escaping leads to a XSS vector in the multilingual associations component.

    Published 1 Apr 2026 · Fixed in 5.4.4, 6.0.4 · NVD
  32. Medium 6.9

    CVE-2026-21630 · Joomla!

    Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

    Published 1 Apr 2026 · Fixed in 5.4.4, 6.0.4 · NVD
  33. Medium 6.3

    CVE-2026-21629 · Joomla!

    The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.

    Published 1 Apr 2026 · Fixed in 5.4.4, 6.0.4 · NVD
  34. Unrated

    CVE-2026-5032 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 1 Apr 2026 · Fixed in 2.9.4 · WPVulnerability
  35. Medium 5.1

    CVE-2026-33415 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authenticated moderator-level user could retrieve post content, topic titles, and usernames from categories they were not authorized to view. Insufficient access controls on a sentiment analytics endpoint allowed…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  36. Medium 5.3

    CVE-2026-33300 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass in the Category Chatables Controller show action allowed moderators to get information on hidden groups names and user count. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  37. Medium 5.3

    CVE-2026-33185 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the group email settings test endpoint could be used to make the server initiate outbound connections to arbitrary hosts and ports. This could allow probing of internal network infrastructure. The endpoint was accessible to…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  38. Medium 6.3

    CVE-2026-33074 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, a user may be able to purchase a lower tier subscription but grant themselves the benefits that comes along with a higher tier subscription. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  39. Low 2.0

    CVE-2026-33073 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the discourse-subscriptions plugin leaks stripe API keys across sites in a multisite cluster resulting in the potential for stripe related information to be leaked across sites within the same multisite cluster. This issue…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  40. Medium 4.3

    CVE-2026-32951 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authenticated user can obtain shared draft topic titles by sending an inline onebox request with a category_id parameter matching the shared drafts category. This issue has been patched in versions 2026.1.3, 2026.2.2,…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  41. Medium 5.3

    CVE-2026-32620 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, non-staff users could access read receipt information for staff-only posts they weren't supposed to see. No post content was exposed, only metadata about who read the post and when. This issue has been patched in versions…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  42. Medium 6.3

    CVE-2026-32619 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, users who lost access to a topic (e.g., removed from a private category group) could still interact with polls in that topic, including voting and toggling poll status. No content was exposed, but users could modify poll…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  43. Medium 4.3

    CVE-2026-32618 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, there is possible channel membership inference from chat user search without authorization. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  44. Medium 5.3

    CVE-2026-32615 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, category group moderators could perform privileged actions on topics inside private categories they did not have read access to. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  45. Low 2.1

    CVE-2026-32607 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, when the hidden prioritize_full_name_in_ux site setting is enabled (defaults to false, requires console access to change), user and group display names are rendered without HTML escaping in several assignment-related UI…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  46. Medium 5.4

    CVE-2026-32273 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, updating a category description via API is not sanitizing the description string, which can lead to XSS attacks. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  47. Medium 5.3

    CVE-2026-32243 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an attacker with the ability to create shared AI conversations could inject arbitrary HTML and JavaScript via crafted conversation titles. This payload would execute in the browser of any user viewing the onebox preview,…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  48. Medium 5.3

    CVE-2026-32143 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, moderators could export CSV data for admin-restricted reports, bypassing the report visibility restrictions. This could expose sensitive operational data intended only for admins. This issue has been patched in versions…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  49. Medium 5.1

    CVE-2026-32113 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the enter action in StaticController reads the sso_destination_url cookie and redirects to it with allow_other_host: true without validating the destination URL. While this cookie is normally set during legitimate…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  50. High 8.1

    CVE-2026-40764 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 31 Mar 2026 · Fixed in 1.10.0.3 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.