UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,952
Published in 7 days
891
Critical in 30 days
416
Actively exploited
420

Latest vulnerabilities

37,952 vulnerabilities
  1. Medium 4.3

    CVE-2025-62175 · Mastodon

    Disabled and suspended user accounts stay connected to the streaming API and can connect afterwards

    Published 13 Oct 2025 · Fixed in 4.2.27, 4.3.14, 4.4.6 · NVD, Project advisories (GitHub)
  2. Low 3.5

    CVE-2025-62174 · Mastodon

    Changing a user's password via CLI does not revoke sessions & access tokens

    Published 13 Oct 2025 · Fixed in 4.2.27, 4.3.14, 4.4.6 · NVD, Project advisories (GitHub)
  3. Medium 4.3

    CVE-2025-62176 · Mastodon

    Streaming server allows OAuth clients without the `read` scope to subscribe to public channels

    Published 13 Oct 2025 · Fixed in 4.2.27, 4.3.14, 4.4.6 · NVD, Project advisories (GitHub)
  4. Medium 5.1

    CVE-2025-62245 · Liferay Portal / DXP

    Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.

    Published 10 Oct 2025 · Fixed in 7.4.3.113, 2023.q4.6 · NVD
  5. Medium 6.5

    CVE-2025-61925 · Astro

    `X-Forwarded-Host` reflected with no validation

    Published 10 Oct 2025 · Fixed in 5.14.2 · Project advisories (GitHub)
  6. Medium 4.6

    CVE-2025-62239 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via the crafted input in a workflow definition.

    Published 10 Oct 2025 · Fixed in 7.4.3.112, 2023.q3.9, 2023.q4.6 · NVD
  7. Medium 4.8

    CVE-2025-62238 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via a crafted payload injected into a Account's “Name“ text field.

    Published 10 Oct 2025 · Fixed in 7.4.3.112, 2023.q3.9, 2023.q4.6 · NVD
  8. Medium 4.8

    CVE-2025-62237 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account’s “Name” text field.

    Published 10 Oct 2025 · Fixed in 7.4.3.112, 2023.q3.9, 2023.q4.6 · NVD
  9. Medium 5.7

    CVE-2025-37727 · Elasticsearch

    Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex

    Published 10 Oct 2025 · Fixed in 8.19.5, 9.0.8, 9.1.5 · NVD
  10. Medium 5.4

    CVE-2025-25018 · Kibana

    Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

    Published 10 Oct 2025 · Fixed in 8.19.5, 9.0.8, 9.1.5 · NVD
  11. Medium 6.1

    CVE-2025-25017 · Kibana

    Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)

    Published 10 Oct 2025 · Fixed in 8.19.4, 9.0.7, 9.1.4 · NVD
  12. Medium 4.8

    CVE-2025-62240 · Liferay Portal / DXP

    Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update 92, and 7.3 update 25 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle…

    Published 9 Oct 2025 · Fixed in 7.4.3.112, 2023.Q3.8, 2023.q4.6 · NVD
  13. Medium 5.5

    CVE-2025-4615 · Palo Alto Networks PAN-OS

    An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and execute arbitrary commands. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not…

    Published 9 Oct 2025 · Fixed in 10.2.17, 11.1.11, 11.2.8 · NVD
  14. Medium 4.8

    CVE-2025-4614 · Palo Alto Networks PAN-OS

    An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users authenticated to the firewall web UI. This may allow impersonation of users whose session tokens are leaked.   The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.…

    Published 9 Oct 2025 · Fixed in 10.2.17, 11.1.6, 11.2.8 · NVD
  15. Medium 6.5

    CVE-2025-2934 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 5.2 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2 that could have allowed an authenticated attacker to create a denial of service condition by configuring malicious webhook endpoints that send crafted HTTP responses.

    Published 9 Oct 2025 · Fixed in 18.2.8, 18.3.4, 18.4.2 · NVD
  16. High 7.7

    CVE-2025-11340 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 that, under certain conditions, could have allowed authenticated users with read-only API tokens to perform unauthorized write operations on vulnerability records by exploiting incorrectly scoped GraphQL mutations.

    Published 9 Oct 2025 · Fixed in 18.3.4, 18.4.2 · NVD
  17. High 7.5

    CVE-2025-10004 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository blobs.

    Published 9 Oct 2025 · Fixed in 18.2.8, 18.3.4, 18.4.2 · NVD
  18. Critical 9.9

    CVE-2025-61913 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Flowise 3.0.8 fixes this…

    Published 8 Oct 2025 · Fixed in 3.0.8 · NVD
  19. Medium 4.8

    CVE-2025-43771 · Liferay Portal / DXP

    Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.10 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into (1) a user’s “First Name” text field, (2) a user’s “Middle Name” text field, (3) a user’s “Last…

    Published 8 Oct 2025 · Fixed in 7.4.3.112, 2023.Q3.4, 2023.q4.6 · NVD
  20. Medium 4.9

    CVE-2025-9162 · Keycloak

    Variable resolution on imports can expose environment variables

    Published 8 Oct 2025 · Fixed in 26.2.9 · Project advisories (GitHub)
  21. Medium 5.1

    CVE-2025-43830 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form with a rich text type field.

    Published 8 Oct 2025 · Fixed in 7.4.3.112, 2023.q3.9, 2023.q4.6 · NVD
  22. Medium 4.8

    CVE-2025-43829 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 18 through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a SVG file.

    Published 8 Oct 2025 · Fixed in 7.4.3.112, 2023.q3.9, 2023.q4.6 · NVD
  23. Medium 4.3

    CVE-2025-10044 · Keycloak

    Keycloak error_description injection on error pages that can trigger phishing attacks

    Published 8 Oct 2025 · Fixed in 26.2.9 · Project advisories (GitHub)
  24. Medium 4.8

    CVE-2025-43821 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Commerce Product's Name text field.

    Published 8 Oct 2025 · Fixed in 7.4.3.112, 2023.q3.9, 2023.q4.6 · NVD
  25. Medium 6.5

    CVE-2025-10249 · Slider Revolution

    Slider Revolution: Relative Path Traversal

    Published 8 Oct 2025 · Fixed in 6.7.38 · WPVulnerability
  26. Medium 4.8

    CVE-2025-43822 · Liferay Portal / DXP

    Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92 allow remote attackers to inject arbitrary web script or HTML via crafted payload injected into a Terms and Condition's Name text field to (1) Payment Terms, or (2) the Delivery Term…

    Published 7 Oct 2025 · Fixed in 7.4.3.112, 2023.q3.9, 2023.q4.6 · NVD
  27. Medium 4.8

    CVE-2025-43823 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Commerce Product's Name text field.

    Published 7 Oct 2025 · Fixed in 7.4.3.112, 2023.q3.9, 2023.q4.6 · NVD
  28. High 8.1

    CVE-2025-61787 · Deno

    Command Injection on Windows

    Published 7 Oct 2025 · Fixed in 2.2.15, 2.5.3 · NVD, Project advisories (GitHub)
  29. Low 3.3

    CVE-2025-61786 · Deno

    Deno.FsFile.prototype.stat and Deno.FsFile.prototype.statSyn --deny-read permission bypass

    Published 7 Oct 2025 · Fixed in 2.2.15, 2.5.3 · NVD, Project advisories (GitHub)
  30. Low 3.3

    CVE-2025-61785 · Deno

    Deno.FsFile.prototype.utime and Deno.FsFile.prototype.utimeSync --deny-write permission bypass

    Published 7 Oct 2025 · Fixed in 2.2.15, 2.5.3 · NVD, Project advisories (GitHub)
  31. Medium 5.4

    CVE-2025-25009 · Kibana

    Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.

    Published 7 Oct 2025 · Fixed in 8.19.5, 9.0.8, 9.1.5 · NVD
  32. Medium 6.5

    CVE-2025-61620 · vLLM

    Resource-Exhaustion (DoS) through chat_template / chat_template_kwargs in OpenAI-Compatible Server

    Published 7 Oct 2025 · Fixed in 0.11.0 · Project advisories (GitHub)
  33. High 7.5

    CVE-2025-59425 · vLLM

    API key authentication vulnerable to timing attack

    Published 7 Oct 2025 · Fixed in 0.11.0 · NVD, Project advisories (GitHub)
  34. Medium 4.8

    CVE-2025-43824 · Liferay Portal / DXP

    The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded.

    Published 6 Oct 2025 · Fixed in 7.4.3.112, 2023.q3.9, 2023.q4.6 · NVD
  35. High 8.8

    CVE-2025-61687 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. A file upload vulnerability in version 3.0.7 of FlowiseAI allows authenticated users to upload arbitrary files without proper validation. This enables attackers to persistently store malicious Node.js web shells on the server, potentially leading to Remote Code Execution (RCE). The system fails to validate…

    Published 6 Oct 2025 · NVD
  36. Medium 6.1

    CVE-2025-50538 · Flowise

    Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.

    Published 6 Oct 2025 · Fixed in 3.0.5 · NVD
  37. Medium 6.1

    CVE-2025-29192 · Flowise

    Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.

    Published 6 Oct 2025 · Fixed in 3.0.5 · NVD
  38. Medium 4.6

    CVE-2025-43825 · Liferay Portal / DXP

    A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows sensitive user data to be included in the Freemarker template. This weakness…

    Published 3 Oct 2025 · Fixed in 2024.Q1.13, 2024.Q4.6, 2025.Q1.4 · NVD
  39. Critical 9.9

    CVE-2025-49844 · Valkey, Redis

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue…

    Published 3 Oct 2025 · Fixed in 8.0.6, 8.1.4, 8.2.2 · NVD
  40. High 7.1

    CVE-2025-46819 · Redis

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server…

    Published 3 Oct 2025 · Fixed in 7.4.6, 8.0.4, 8.2.2 · NVD
  41. High 7.3

    CVE-2025-46818 · Redis

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the…

    Published 3 Oct 2025 · Fixed in 7.4.6, 8.0.4, 8.2.2 · NVD
  42. High 8.8

    CVE-2025-46817 · Redis

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.

    Published 3 Oct 2025 · Fixed in 7.4.6, 8.0.4, 8.2.2 · NVD
  43. High 8.2

    CVE-2025-56551 · DirectAdmin

    An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate login interface with arbitrary attacker-controlled content via supplying a crafted GET request.

    Published 3 Oct 2025 · NVD
  44. Medium 5.1

    CVE-2025-49641 · Zabbix

    A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.

    Published 3 Oct 2025 · Fixed in 7.0.18, 7.2.12, 7.4.2 · NVD
  45. Low 2.1

    CVE-2025-27236 · Zabbix

    A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to.

    Published 3 Oct 2025 · Fixed in 6.0.41, 7.0.17, 7.2.11 · NVD
  46. Medium 4.3

    CVE-2025-27231 · Zabbix

    The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.

    Published 3 Oct 2025 · Fixed in 7.0.18, 7.2.12, 7.4.2 · NVD
  47. Medium 6.5

    CVE-2025-56381 · Frappe Framework

    ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and group_by parameters.

    Published 2 Oct 2025 · NVD
  48. Medium 6.5

    CVE-2025-56380 · Frappe Framework

    Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to the fieldname parameter

    Published 2 Oct 2025 · NVD
  49. Medium 5.4

    CVE-2025-56379 · Frappe Framework

    A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the content field.

    Published 2 Oct 2025 · NVD
  50. Medium 6.7

    CVE-2025-22862 · Fortinet FortiProxy, Fortinet FortiOS

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0.5 and above may allow an authenticated attacker to elevate their privileges via triggering a malicious Webhook action in the Automation Stitch component.

    Published 2 Oct 2025 · Fixed in 7.4.8, 7.4.9, 7.6.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.