UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,954
Published in 7 days
865
Critical in 30 days
416
Actively exploited
420

Latest vulnerabilities

37,954 vulnerabilities
  1. Medium 5.4

    CVE-2025-57540 · Proxmox VE

    A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page, enabling client-side attacks.

    Published 9 Sept 2025 · NVD
  2. Medium 5.4

    CVE-2025-57539 · Proxmox VE

    A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially leading to session hijacking or other attacks.

    Published 9 Sept 2025 · NVD
  3. Medium 5.4

    CVE-2025-57538 · Proxmox VE

    A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Environment (PVE) 8.4 allows an authenticated user to inject malicious input. The input is stored and executed in the context of other users' browsers when they view the affected configuration page. This can lead to arbitrary JavaScript execution.

    Published 9 Sept 2025 · NVD
  4. High 8.8

    CVE-2025-55227 · Microsoft SQL Server

    Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

    Published 9 Sept 2025 · Fixed in 15.0.4445.1, 16.0.1150.1, 16.0.4212.1 · NVD
  5. Critical 10.0

    CVE-2025-54261 · Adobe ColdFusion

    ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution by an attacker. The victim must have optional configurations enabled. Scope is changed.

    Published 9 Sept 2025 · NVD
  6. Medium 5.4

    CVE-2025-54252 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. This could result in bypassing security features within the application. Exploitation of this issue requires user interaction in that a victim must browse to the page…

    Published 9 Sept 2025 · NVD
  7. Medium 4.3

    CVE-2025-54251 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access.

    Published 9 Sept 2025 · NVD
  8. Medium 4.9

    CVE-2025-54250 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access.

    Published 9 Sept 2025 · NVD
  9. Medium 6.5

    CVE-2025-54249 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass security controls allowing unauthorized read access.

    Published 9 Sept 2025 · NVD
  10. High 7.7

    CVE-2025-54248 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Scope is changed

    Published 9 Sept 2025 · NVD
  11. Medium 6.5

    CVE-2025-54247 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access.

    Published 9 Sept 2025 · NVD
  12. Medium 6.5

    CVE-2025-54246 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access.

    Published 9 Sept 2025 · NVD
  13. Medium 5.3

    CVE-2025-47997 · Microsoft SQL Server

    Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information over a network.

    Published 9 Sept 2025 · Fixed in 15.0.4445.1, 16.0.1150.1, 16.0.4212.1 · NVD
  14. Medium 5.4

    CVE-2025-8712 · Ivanti Connect Secure

    Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.

    Published 9 Sept 2025 · Fixed in 22.7 · NVD
  15. Medium 5.4

    CVE-2025-8711 · Ivanti Connect Secure

    CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to execute limited actions on behalf of the victim user. User interaction is required.

    Published 9 Sept 2025 · Fixed in 22.7 · NVD
  16. High 7.6

    CVE-2025-55148 · Ivanti Connect Secure

    Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.

    Published 9 Sept 2025 · Fixed in 22.7 · NVD
  17. High 8.8

    CVE-2025-55147 · Ivanti Connect Secure

    CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to execute sensitive actions on behalf of the victim user. User interaction is required

    Published 9 Sept 2025 · Fixed in 22.7 · NVD
  18. Medium 4.9

    CVE-2025-55146 · Ivanti Connect Secure

    An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service.

    Published 9 Sept 2025 · Fixed in 22.7 · NVD
  19. High 8.9

    CVE-2025-55145 · Ivanti Connect Secure

    Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker to hijack existing HTML5 connections.

    Published 9 Sept 2025 · Fixed in 22.7 · NVD
  20. Medium 5.4

    CVE-2025-55144 · Ivanti Connect Secure

    Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.

    Published 9 Sept 2025 · Fixed in 22.7 · NVD
  21. Medium 6.1

    CVE-2025-55143 · Ivanti Connect Secure

    Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to inject arbitrary text into a crafted HTTP response. User interaction is required.

    Published 9 Sept 2025 · Fixed in 22.7 · NVD
  22. High 8.8

    CVE-2025-55142 · Ivanti Connect Secure

    Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.

    Published 9 Sept 2025 · Fixed in 22.7 · NVD
  23. High 8.8

    CVE-2025-55141 · Ivanti Connect Secure

    Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.

    Published 9 Sept 2025 · Fixed in 22.7 · NVD
  24. Medium 6.8

    CVE-2025-55139 · Ivanti Connect Secure

    SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to enumerate internal services.

    Published 9 Sept 2025 · Fixed in 22.7 · NVD
  25. Medium 6.1

    CVE-2025-52277 · YesWiki

    Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots field

    Published 9 Sept 2025 · NVD
  26. Medium 4.6

    CVE-2025-43776 · Liferay Portal / DXP

    A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object…

    Published 9 Sept 2025 · Fixed in 2024.q1.20, 2025.Q1.17, 2025.Q2.10 · NVD
  27. Critical 9.1Actively exploited

    CVE-2025-54236 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

    Published 9 Sept 2025 · NVD
  28. Medium 4.9

    CVE-2025-53609 · Fortinet FortiWeb

    A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7.0.11 may allow an authenticated attacker to perform an arbitrary file read on the underlying system via crafted requests.

    Published 9 Sept 2025 · Fixed in 7.2.12, 7.4.9, 7.6.5 · NVD
  29. Medium 5.3

    CVE-2025-59019 · TYPO3

    Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.

    Published 9 Sept 2025 · Fixed in 11.5.48, 12.4.37, 13.4.18 · NVD
  30. High 7.1

    CVE-2025-59018 · TYPO3

    Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.

    Published 9 Sept 2025 · Fixed in 11.5.48, 12.4.37, 13.4.18 · NVD
  31. Medium 5.3

    CVE-2025-59017 · TYPO3

    Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.

    Published 9 Sept 2025 · Fixed in 11.5.48, 12.4.37, 13.4.18 · NVD
  32. Medium 5.3

    CVE-2025-59016 · TYPO3

    Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations.

    Published 9 Sept 2025 · Fixed in 9.5.55 · NVD
  33. Medium 6.3

    CVE-2025-59015 · TYPO3

    A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.

    Published 9 Sept 2025 · Fixed in 12.4.37, 13.4.18 · NVD
  34. Medium 5.1

    CVE-2025-59014 · TYPO3

    An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar.

    Published 9 Sept 2025 · Fixed in 11.5.48, 12.4.37, 13.4.18 · NVD
  35. Medium 5.3

    CVE-2025-59013 · TYPO3

    An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.

    Published 9 Sept 2025 · Fixed in 11.5.48, 12.4.37, 13.4.18 · NVD
  36. High 8.8

    GHSA-9v82-vcjx-m76j · Shopware

    Reflective Cross Site-Scripting (XSS) in CMS components

    Published 9 Sept 2025 · Fixed in 6.7.2.1 · Project advisories (GitHub)
  37. Medium 5.1

    CVE-2025-43777 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes "Internal Server Error" in the response body when a login attempt is made with a deleted Client Secret.

    Published 9 Sept 2025 · Fixed in 2024.q1.20, 2025.Q1.17, 2025.Q2.10 · NVD
  38. Medium 4.8

    CVE-2025-43778 · Liferay Portal / DXP

    A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 allows an remote authenticated attacker to inject JavaScript through the name of a fieldset in Kaleo Forms…

    Published 9 Sept 2025 · Fixed in 2024.q1.21, 2025.Q1.17, 2025.Q2.12 · NVD
  39. Medium 4.8

    CVE-2025-43763 · Liferay Portal / DXP

    A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other…

    Published 9 Sept 2025 · Fixed in 7.4.3.132, 2024.q1.21 · NVD
  40. Medium 5.4

    CVE-2025-58990 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 9 Sept 2025 · Fixed in 3.2.1 · WPVulnerability
  41. High 8.8

    CVE-2025-56265 · n8n

    An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.

    Published 8 Sept 2025 · NVD
  42. Critical 9.8

    CVE-2025-57807 · ImageMagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When…

    Published 5 Sept 2025 · Fixed in 6.9.13-29, 7.1.2-3 · NVD
  43. Medium 6.5

    CVE-2025-10061 · MongoDB

    An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This vulnerability could lead to denial of service if triggered repeatedly. This issue affects MongoDB Server v6.0 versions prior to…

    Published 5 Sept 2025 · Fixed in 7.0.22, 8.0.12, 8.1.2 · NVD
  44. High 7.5

    CVE-2025-10060 · MongoDB

    MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22 and MongoDB Server v8.0 versions…

    Published 5 Sept 2025 · Fixed in 6.0.25, 7.0.22, 8.0.12 · NVD
  45. Medium 6.5

    CVE-2025-10059 · MongoDB

    An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. This affects MongoDB Server v6.0 versions prior to 6.0.x, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v8.0 versions prior to 8.0.6.

    Published 5 Sept 2025 · Fixed in 6.0.24, 7.0.18, 8.0.6 · NVD
  46. Critical 9.9

    CVE-2025-55190 · Argo CD

    Project API Token Exposes Repository Credentials

    Published 4 Sept 2025 · Fixed in 2.14.16, 3.0.14, 3.1.2 · NVD, Project advisories (GitHub)
  47. High 7.9

    CVE-2025-9636 · pgAdmin

    pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.

    Published 4 Sept 2025 · NVD
  48. Low 3.7

    CVE-2025-51586 · PrestaShop

    Email enumeration

    Published 4 Sept 2025 · Fixed in 8.2.1, 8.2.3 · NVD, Project advisories (GitHub)
  49. Medium 6.5

    CVE-2025-52048 · Frappe Framework

    Possibility of SQL injection due to missing validation

    Published 4 Sept 2025 · Fixed in 14.96.10, 15.72.0 · NVD, Project advisories (GitHub)
  50. Critical 9.0Actively exploited

    CVE-2025-53690 · Sitecore Experience Platform

    Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

    Published 3 Sept 2025 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.