UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,949
Published in 7 days
893
Critical in 30 days
416
Actively exploited
420

Latest vulnerabilities

37,949 vulnerabilities
  1. Critical 9.0

    CVE-2025-20363 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user…

    Published 25 Sept 2025 · Fixed in 9.20.3.16, 9.22.2, 9.23.1.3 · NVD
  2. High 8.6Actively exploited

    CVE-2025-20362 · Cisco ASA and Firepower Threat Defense

    Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed…

    Published 25 Sept 2025 · Fixed in 9.20.4.10, 9.22.2.14, 9.23.1.19 · NVD
  3. Critical 9.9Actively exploited

    CVE-2025-20333 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials…

    Published 25 Sept 2025 · Fixed in 9.19.1.37, 9.20.3.7, 9.22.1.3 · NVD
  4. Medium 6.0

    CVE-2025-59422 · Dify

    Broken Access Control on Log Message Endpoint Allows Reading Chats of Others

    Published 24 Sept 2025 · NVD, Project advisories (GitHub)
  5. Medium 5.3

    CVE-2025-43819 · Liferay Portal / DXP

    A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12 is allow an remote non-authenticated attacker to reuse old user session by SLO API

    Published 24 Sept 2025 · Fixed in 7.4.3.132, 2024.Q1.13, 2024.Q4.4 · NVD
  6. Medium 6.9

    CVE-2025-43779 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_commerce_product_definitions_web_internal_portlet_CPDefinitionsPortlet_productTypeName parameter. This malicious payload is then reflected and…

    Published 24 Sept 2025 · Fixed in 7.4.3.113, 2024.Q1.19 · NVD
  7. Medium 5.3

    CVE-2025-7106 · LibreChat

    danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` function in `api/server/middleware/roles/access.js` uses `permissions.some()` to validate permissions, which incorrectly grants access if only one of multiple required permissions is present. This allows users with the 'USER' role to create agents despite having…

    Published 23 Sept 2025 · Fixed in 0.7.9 · NVD
  8. Medium 6.1

    CVE-2025-59821 · DNN Platform

    Reflected Cross-Site Scripting (XSS) using url to profile

    Published 23 Sept 2025 · Fixed in 10.1.0 · NVD, Project advisories (GitHub)
  9. Medium 5.9

    CVE-2025-59548 · DNN Platform

    Reflected Cross-Site Scripting (XSS) in CKEditor File Browser

    Published 23 Sept 2025 · Fixed in 10.1.0 · NVD, Project advisories (GitHub)
  10. Medium 5.3

    CVE-2025-59547 · DNN Platform

    Vulnerability in CKEditor's File Uploader functionality through Unicode obfuscation

    Published 23 Sept 2025 · Fixed in 10.1.0 · NVD, Project advisories (GitHub)
  11. Medium 4.8

    CVE-2025-59546 · DNN Platform

    Stored XSS Using Backend Admin Credentials

    Published 23 Sept 2025 · Fixed in 10.1.0 · NVD, Project advisories (GitHub)
  12. Medium 6.9

    CVE-2025-43814 · Liferay Portal / DXP

    In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions the audit events records a user’s password reminder answer, which allows remote authenticated users to obtain a user’s password reminder answer via the audit events.

    Published 22 Sept 2025 · Fixed in 7.4.3.113, 2023.Q4.9 · NVD
  13. Medium 5.3

    CVE-2025-43810 · Liferay Portal / DXP

    Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to add a note to an order in a different virtual instance via the…

    Published 22 Sept 2025 · Fixed in 7.4.3.113, 2023.Q4.9 · NVD
  14. Critical 9.0

    CVE-2025-59545 · DNN Platform

    Stored Cross-Site Scripting (XSS) in Prompt module

    Published 22 Sept 2025 · Fixed in 10.1.0 · NVD, Project advisories (GitHub)
  15. Medium 5.3

    CVE-2025-43806 · Liferay Portal / DXP

    Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly check permission with import and export tasks, which allows remote authenticated users to access the exported data via the REST APIs.

    Published 22 Sept 2025 · Fixed in 7.4.3.113, 2023.Q4.8 · NVD
  16. Medium 5.4

    CVE-2025-59539 · DNN Platform

    Stored Cross-Site Scripting (XSS) in Profile Biography field

    Published 22 Sept 2025 · Fixed in 10.1.0 · NVD, Project advisories (GitHub)
  17. Medium 6.5

    CVE-2025-59535 · DNN Platform

    Loading unused themes on annonymous clients through query parameters

    Published 22 Sept 2025 · Fixed in 10.1.0 · NVD, Project advisories (GitHub)
  18. Critical 10.0

    CVE-2025-59528 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it…

    Published 22 Sept 2025 · NVD
  19. High 7.5

    CVE-2025-59527 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery (SSRF) vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability allows an attacker to use the Flowise server as a proxy to access internal network web services and explore their link structures. This issue…

    Published 22 Sept 2025 · NVD
  20. Medium 4.8

    CVE-2025-43807 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a publication’s “Name” text field.

    Published 22 Sept 2025 · Fixed in 7.4.3.113, 2023.Q4.9 · NVD
  21. Medium 5.5

    CVE-2025-59800 · Ghostscript

    In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.

    Published 22 Sept 2025 · NVD
  22. Medium 5.5

    CVE-2025-59799 · Ghostscript

    Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value.

    Published 22 Sept 2025 · NVD
  23. Medium 5.5

    CVE-2025-59798 · Ghostscript

    Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c.

    Published 22 Sept 2025 · NVD
  24. Medium 5.4

    CVE-2025-58650 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 22 Sept 2025 · Fixed in 4.8.7.2 · WPVulnerability
  25. Medium 4.3

    CVE-2025-58649 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 22 Sept 2025 · Fixed in 4.8.7.2 · WPVulnerability
  26. Medium 6.9

    CVE-2025-43808 · Liferay Portal / DXP

    The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through update 35 saves virtual products uploaded to Documents and Media with guest view permission, which allows remote attackers to access and download virtual products for free via a crafted URL.

    Published 19 Sept 2025 · Fixed in 7.4.3.113, 2023.Q4.9 · NVD
  27. Medium 6.5

    CVE-2025-9081 · Mattermost

    Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration

    Published 19 Sept 2025 · Fixed in 9.11.17, 10.5.9 · NVD
  28. High 7.2

    CVE-2025-9079 · Mattermost

    Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory

    Published 19 Sept 2025 · Fixed in 10.8.4, 10.9.4, 10.10.2 · NVD
  29. Medium 5.1

    CVE-2025-43809 · Liferay Portal / DXP

    Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, and older unsupported versions allows remote attackers to register a server license via the 'orderUuid' parameter.

    Published 19 Sept 2025 · Fixed in 7.4.3.112, 2023.q3.9, 2023.Q4.8 · NVD
  30. Medium 6.9

    CVE-2025-43803 · Liferay Portal / DXP

    Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to view contact information, including the contact’s name and email address, via…

    Published 19 Sept 2025 · Fixed in 7.4.3.120, 2023.Q4.7 · NVD
  31. Critical 9.0Actively exploited

    CVE-2025-48703 · Control Web Panel

    CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

    Published 19 Sept 2025 · Fixed in 0.9.8.1205 · NVD
  32. High 8.1

    CVE-2025-59713 · Snipe-IT

    Snipe-IT before 8.1.18 allows unsafe deserialization.

    Published 19 Sept 2025 · Fixed in 8.1.18 · NVD
  33. Medium 5.4

    CVE-2025-59712 · Snipe-IT

    Snipe-IT before 8.1.18 allows XSS.

    Published 19 Sept 2025 · Fixed in 8.1.18 · NVD
  34. Critical 9.8Actively exploited

    CVE-2025-10035 · GoAnywhere MFT

    A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

    Published 18 Sept 2025 · Fixed in 7.6.3, 7.8.4 · NVD
  35. Medium 5.3

    CVE-2025-59476 · Jenkins

    Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.

    Published 17 Sept 2025 · Fixed in 2.516.3, 2.528 · NVD
  36. Medium 4.3

    CVE-2025-59475 · Jenkins

    Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).

    Published 17 Sept 2025 · Fixed in 2.516.3, 2.528 · NVD
  37. Medium 5.3

    CVE-2025-59474 · Jenkins

    Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.

    Published 17 Sept 2025 · Fixed in 2.516.3, 2.528 · NVD
  38. Medium 5.3

    CVE-2025-8419 · Keycloak

    Keycloak SMTP Inject Vulnerability

    Published 17 Sept 2025 · Fixed in 26.2.8 · Project advisories (GitHub)
  39. High 7.7

    CVE-2025-59457 · TeamCity

    In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows

    Published 17 Sept 2025 · Fixed in 2025.07.2 · NVD
  40. Medium 5.5

    CVE-2025-59456 · TeamCity

    In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload

    Published 17 Sept 2025 · Fixed in 2025.07.2 · NVD
  41. Medium 4.2

    CVE-2025-59455 · TeamCity

    In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition

    Published 17 Sept 2025 · Fixed in 2025.07.2 · NVD
  42. Critical 9.3Actively exploited

    CVE-2025-9242 · WatchGuard Fireware OS

    An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN…

    Published 17 Sept 2025 · Fixed in 12.5.13, 12.11.4 · NVD
  43. Medium 5.1

    CVE-2025-43804 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_search_web_portlet_SearchPortlet_userId parameter.

    Published 16 Sept 2025 · Fixed in 7.4.3.112 · NVD
  44. Medium 6.9

    CVE-2025-43805 · Liferay Portal / DXP

    Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an authorization check when users attempt to view a display page template, which allows remote attackers to view display page templates via crafted URLs.

    Published 16 Sept 2025 · Fixed in 7.4.3.112, 2023.Q3.5 · NVD
  45. Medium 6.9

    CVE-2025-43801 · Liferay Portal / DXP

    Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to perform a denial-of-service (DoS) attacks via a crafted XML-RPC request.

    Published 16 Sept 2025 · Fixed in 7.3, 7.4.3.112, 2023.Q3.5 · NVD
  46. Medium 4.8

    CVE-2025-43802 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 update 51 through update 92, and 7.3 update 33 through update 35. allows remote attackers to inject arbitrary web script or HTML via the externalReferenceCode parameter.

    Published 15 Sept 2025 · Fixed in 7.4.3.110, 2023.q3.5 · NVD
  47. Medium 5.3

    CVE-2025-43797 · Liferay Portal / DXP

    In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions, the default membership type of a newly created site is “Open” which allows any registered users to become a member of the site. A remote attacker with site membership can potentially view, add or edit content on the…

    Published 15 Sept 2025 · Fixed in 7.3, 7.4.3.112, 2023.q3.5 · NVD
  48. Medium 6.9

    CVE-2025-43799 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, which allows remote users to access and edit content via the API.

    Published 15 Sept 2025 · Fixed in 7.3, 7.4.3.112, 2023.q3.5 · NVD
  49. Low 2.1

    CVE-2025-43798 · Liferay Portal / DXP

    Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user.

    Published 15 Sept 2025 · Fixed in 2023.q3.5 · NVD
  50. Medium 4.8

    CVE-2025-43800 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an object with a rich text type field.

    Published 15 Sept 2025 · Fixed in 7.4.3.112, 2023.q3.5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.