UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,949
Published in 7 days
864
Critical in 30 days
416
Actively exploited
420

Latest vulnerabilities

37,949 vulnerabilities
  1. Medium 4.8

    CVE-2025-43791 · Liferay Portal / DXP

    Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a "Rich Text" type field to (1) a web content structure, (2) a Documents and Media Document…

    Published 15 Sept 2025 · Fixed in 7.4.3.112, 2023.q3.5 · NVD
  2. Medium 5.4

    CVE-2025-58177 · n8n

    n8n is an open source workflow automation platform. From 1.24.0 to before 1.107.0, there is a stored cross-site scripting (XSS) vulnerability in @n8n/n8n-nodes-langchain.chatTrigger. An authorized user can configure the LangChain Chat Trigger node with malicious JavaScript in the initialMessages field and enable public access so that the payload is executed in the browser of any user who visits…

    Published 15 Sept 2025 · Fixed in 1.107.0 · NVD
  3. Low 2.3

    CVE-2025-43792 · Liferay Portal / DXP

    Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not properly obtain the remote address of the live site from the database which, which allows remote authenticated users to exfiltrate data to an attacker…

    Published 15 Sept 2025 · Fixed in 7.3, 7.4.3.106, 2023.q3.5 · NVD
  4. Medium 6.9

    CVE-2025-43793 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions may incorrectly identify the subdomain of a domain name and create a supercookie, which allows remote attackers who control a website that share the same TLD to read cookies set by the…

    Published 15 Sept 2025 · Fixed in 7.3, 7.4.3.106, 2023.q3.5 · NVD
  5. Medium 4.6

    CVE-2025-43794 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote authenticated attackers with the instance administrator role to inject arbitrary web script or HTML into all pages via a…

    Published 15 Sept 2025 · Fixed in 7.3, 7.4.3.112, 2023.q3.5 · NVD
  6. Medium 6.1

    CVE-2025-9084 · Mattermost

    Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs

    Published 15 Sept 2025 · Fixed in 10.5.10 · NVD
  7. Medium 5.4

    CVE-2025-9072 · Mattermost

    Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL.

    Published 15 Sept 2025 · Fixed in 10.5.10, 10.9.5, 10.10.2 · NVD
  8. Medium 4.3

    CVE-2025-9078 · Mattermost

    Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing

    Published 15 Sept 2025 · Fixed in 10.8.4, 10.9.4, 10.10.2 · NVD
  9. Medium 6.5

    CVE-2025-9076 · Mattermost

    Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.

    Published 15 Sept 2025 · Fixed in 10.10.2 · NVD
  10. High 7.5

    CVE-2025-59375 · Expat

    libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

    Published 15 Sept 2025 · Fixed in 2.7.2 · NVD
  11. Medium 6.1

    CVE-2025-9862 · Ghost

    SSRF via oEmbed Bookmark

    Published 14 Sept 2025 · Fixed in 5.130.4, 6.0.9 · NVD, Project advisories (GitHub)
  12. High 7.1

    CVE-2025-43796 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing queries that return a large number of objects.

    Published 12 Sept 2025 · Fixed in 7.4.3.102, 2023.Q3.5 · NVD
  13. Medium 5.1

    CVE-2025-43795 · Liferay Portal / DXP

    Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_configuration_admin_web_portlet_SystemSettingsPortlet_redirect parameter. Open…

    Published 12 Sept 2025 · Fixed in 7.3, 7.4.3.102, 2023.Q3.5 · NVD
  14. Critical 9.8

    CVE-2025-58434 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a…

    Published 12 Sept 2025 · Fixed in 3.0.6 · NVD
  15. Medium 5.1

    CVE-2025-43787 · Liferay Portal / DXP

    A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 allows an remote authenticated attacker to inject JavaScript through the organization site names.…

    Published 12 Sept 2025 · Fixed in 2024.q1.21 · NVD
  16. High 7.5

    CVE-2025-27240 · Zabbix

    A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.

    Published 12 Sept 2025 · Fixed in 6.0.34, 6.4.19, 7.0.4 · NVD
  17. Low 2.1

    CVE-2025-27238 · Zabbix

    Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.

    Published 12 Sept 2025 · Fixed in 7.0.14, 7.2.8 · NVD
  18. High 7.5

    CVE-2025-9086 · curl

    1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path="/"`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl…

    Published 12 Sept 2025 · Fixed in 8.16.0 · NVD
  19. Medium 6.5

    CVE-2025-7337 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 7.8 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user with Developer-level access to cause a persistent denial of service affecting all users on a GitLab instance by uploading large files.

    Published 12 Sept 2025 · Fixed in 18.1.6, 18.2.6, 18.3.2 · NVD
  20. Medium 4.3

    CVE-2025-6769 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.1 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to view administrator-only maintenance notes by accessing runner details through specific interfaces.

    Published 12 Sept 2025 · Fixed in 18.1.6, 18.2.6, 18.3.2 · NVD
  21. High 8.8

    CVE-2025-6454 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences.

    Published 12 Sept 2025 · Fixed in 18.1.6, 18.2.6, 18.3.2 · NVD
  22. High 7.5

    CVE-2025-2256 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed unauthorized users to render the GitLab instance unresponsive to legitimate users by sending multiple concurrent large SAML responses.

    Published 12 Sept 2025 · Fixed in 18.1.6, 18.2.6, 18.3.2 · NVD
  23. Medium 6.5

    CVE-2025-1250 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user to stall background job processing by sending specially crafted commit messages, merge request descriptions, or notes.

    Published 12 Sept 2025 · Fixed in 18.1.6, 18.2.6, 18.3.2 · NVD
  24. Medium 5.3

    CVE-2025-10148 · curl

    curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as…

    Published 12 Sept 2025 · Fixed in 8.16.0 · NVD
  25. Medium 6.5

    CVE-2025-10094 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to disrupt access to token listings and related administrative operations by creating tokens with excessively large names.

    Published 12 Sept 2025 · Fixed in 18.1.6, 18.2.6, 18.3.2 · NVD
  26. Low 1.0

    CVE-2025-43789 · Liferay Portal / DXP

    JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked directly as classes which allows Service Access Policies get executed.

    Published 12 Sept 2025 · Fixed in 7.4.3.120, 2024.Q1.10 · NVD
  27. Medium 5.3

    CVE-2025-43788 · Liferay Portal / DXP

    The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.

    Published 12 Sept 2025 · Fixed in 7.4.3.125, 2024.Q1.13 · NVD
  28. High 7.4

    CVE-2025-43790 · Liferay Portal / DXP

    Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to access, create, edit, relate data/object entries/definitions to an object in a different virtual instance.

    Published 11 Sept 2025 · Fixed in 7.4.3.124, 2024.Q1.13, 2024.Q2.7 · NVD
  29. Medium 5.3

    CVE-2025-43782 · Liferay Portal / DXP

    Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote authenticated users to access a workflow definition by name via the API

    Published 11 Sept 2025 · Fixed in 7.4.3.125, 2024.Q1.13, 2024.Q2.8 · NVD
  30. High 7.5

    CVE-2025-58145 · Xen

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related to the mapping of pages belonging to other domains: For one, an assertion is wrong there, where the case actually needs handling. A NULL pointer de-reference could result on a release build. This is CVE-2025-58144. And then the P2M lock…

    Published 11 Sept 2025 · Fixed in 4.17.0 · NVD
  31. High 7.5

    CVE-2025-58144 · Xen

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related to the mapping of pages belonging to other domains: For one, an assertion is wrong there, where the case actually needs handling. A NULL pointer de-reference could result on a release build. This is CVE-2025-58144. And then the P2M lock…

    Published 11 Sept 2025 · Fixed in 4.17.0 · NVD
  32. Critical 9.8

    CVE-2025-58143 · Xen

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped…

    Published 11 Sept 2025 · Fixed in 4.17.0 · NVD
  33. Critical 9.8

    CVE-2025-58142 · Xen

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped…

    Published 11 Sept 2025 · Fixed in 4.17.0 · NVD
  34. Critical 9.8

    CVE-2025-27466 · Xen

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped…

    Published 11 Sept 2025 · Fixed in 4.17.0 · NVD
  35. Low 3.1

    CVE-2025-6088 · LibreChat

    In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they can be obtained from less-protected sources such as server-side access logs, browser history, or…

    Published 11 Sept 2025 · NVD
  36. Medium 4.3

    CVE-2025-64351 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Insertion of Sensitive Information Into Sent Data

    Published 11 Sept 2025 · Fixed in 1.0.253 · WPVulnerability
  37. Low 3.8

    CVE-2025-64350 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization

    Published 11 Sept 2025 · Fixed in 1.0.253 · WPVulnerability
  38. Medium 5.1

    CVE-2025-43783 · Liferay Portal / DXP

    Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor path.

    Published 10 Sept 2025 · Fixed in 7.4.3.129, 2024.Q1.13, 2024.Q3.2 · NVD
  39. High 7.1

    CVE-2025-59052 · Angular

    Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage

    Published 10 Sept 2025 · Fixed in 19.2.16, 20.3.0, 21.0.0-next.3 · Project advisories (GitHub)
  40. Medium 5.5

    CVE-2025-9714 · libxml2

    Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow…

    Published 10 Sept 2025 · Fixed in 2.10.0 · NVD
  41. Medium 6.2

    CVE-2025-43784 · Liferay Portal / DXP

    Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest users to obtain object entries information via the API Builder.

    Published 10 Sept 2025 · Fixed in 7.4.3.125, 2024.Q1.13, 2024.Q2.9 · NVD
  42. Medium 4.6

    CVE-2025-43785 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92 allows remote attackers to execute an arbitrary web script or HTML in the My Workflow Tasks page.

    Published 10 Sept 2025 · Fixed in 7.4.3.129, 2024.Q1.13 · NVD
  43. High

    CVE-2025-59045 · Stalwart

    Memory Exhaustion via CalDAV Event Expansion

    Published 10 Sept 2025 · Fixed in 0.13.3 · Project advisories (GitHub)
  44. Medium 6.9

    CVE-2025-43786 · Liferay Portal / DXP

    Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and 7.4 GA through update 92 allow attackers to determine existent ERC in the application by exploit the time response.

    Published 9 Sept 2025 · Fixed in 7.4.3.129, 2024.Q1.13, 2024.Q3.2 · NVD
  45. Medium 5.3

    CVE-2025-43781 · Liferay Portal / DXP

    Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.12 allows remote attackers to inject arbitrary web script or HTML via the URL in search bar portlet

    Published 9 Sept 2025 · Fixed in 7.4.3.129, 2024.Q1.13, 2024.Q3.9 · NVD
  46. Medium 4.6

    CVE-2025-43775 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via remote app title field.

    Published 9 Sept 2025 · Fixed in 7.4.3.129, 2024.Q1.13, 2024.Q3.6 · NVD
  47. Medium 5.4

    CVE-2025-57540 · Proxmox VE

    A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page, enabling client-side attacks.

    Published 9 Sept 2025 · NVD
  48. Medium 5.4

    CVE-2025-57539 · Proxmox VE

    A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially leading to session hijacking or other attacks.

    Published 9 Sept 2025 · NVD
  49. Medium 5.4

    CVE-2025-57538 · Proxmox VE

    A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Environment (PVE) 8.4 allows an authenticated user to inject malicious input. The input is stored and executed in the context of other users' browsers when they view the affected configuration page. This can lead to arbitrary JavaScript execution.

    Published 9 Sept 2025 · NVD
  50. High 8.8

    CVE-2025-55227 · Microsoft SQL Server

    Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

    Published 9 Sept 2025 · Fixed in 15.0.4445.1, 16.0.1150.1, 16.0.4212.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.