UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,953
Published in 7 days
858
Critical in 30 days
413
Actively exploited
420

Latest vulnerabilities

37,953 vulnerabilities
  1. High 7.5

    CVE-2025-53694 · Sitecore Experience Platform

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.

    Published 3 Sept 2025 · Fixed in 10.4 · NVD
  2. Critical 9.8

    CVE-2025-53693 · Sitecore Experience Platform

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

    Published 3 Sept 2025 · Fixed in 10.4 · NVD
  3. High 8.8

    CVE-2025-53691 · Sitecore Experience Platform

    Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

    Published 3 Sept 2025 · Fixed in 10.4 · NVD
  4. Medium 4.8

    CVE-2025-9823 · Mautic

    Reflected XSS in lead:addLeadTags - Quick Add

    Published 3 Sept 2025 · Fixed in 4.4.17, 5.2.8, 6.0.5 · Project advisories (GitHub)
  5. Medium 5.9

    CVE-2025-9824 · Mautic

    User Enumeration via Response Timing

    Published 3 Sept 2025 · Fixed in 4.4.17, 5.2.8, 6.0.5 · Project advisories (GitHub)
  6. Medium 5.5

    CVE-2025-9822 · Mautic

    Secret data extraction via elfinder

    Published 3 Sept 2025 · Fixed in 4.4.17, 5.2.8, 6.0.5 · Project advisories (GitHub)
  7. Low 2.7

    CVE-2025-9821 · Mautic

    SSRF via webhook function

    Published 3 Sept 2025 · Fixed in 4.4.17, 5.2.8, 6.0.5 · Project advisories (GitHub)
  8. High 7.5

    CVE-2025-7974 · Rocket.Chat

    rocket.chat Incorrect Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of rocket.chat. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 3000 by default. The issue results from incorrect authorization. An…

    Published 2 Sept 2025 · Fixed in 7.6.4, 7.7.2, 7.8.0 · NVD
  9. High 8.8

    CVE-2025-55162 · Envoy

    oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag

    Published 2 Sept 2025 · Fixed in 1.32.10, 1.34.5 · NVD, Project advisories (GitHub)
  10. High 7.5

    CVE-2025-54588 · Envoy

    Use after free in DNS cache

    Published 2 Sept 2025 · Fixed in 1.34.5 · NVD, Project advisories (GitHub)
  11. High 7.5

    CVE-2025-3586 · Liferay Portal / DXP

    In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 (Liferay PaaS, and Liferay Self-Hosted), the Objects module does not restrict the use of Groovy scripts in Object actions for Admin Users. This allows remote authenticated admin users with the Instance Administrator…

    Published 1 Sept 2025 · Fixed in 7.4.3.43 · NVD
  12. Medium 6.2

    CVE-2025-57752 · Next.js

    Next.js Affected by Cache Key Confusion for Image Optimization API Routes

    Published 29 Aug 2025 · Fixed in 14.2.31, 15.4.5 · OSV.dev and GitHub, Project advisories (GitHub)
  13. Medium 4.3

    CVE-2025-55173 · Next.js

    Next.js Content Injection Vulnerability for Image Optimization

    Published 29 Aug 2025 · Fixed in 14.2.31, 15.4.5 · OSV.dev and GitHub, Project advisories (GitHub)
  14. Medium 6.5

    CVE-2025-57822 · Next.js

    Next.js Improper Middleware Redirect Handling Leads to SSRF

    Published 29 Aug 2025 · Fixed in 14.2.32, 15.4.7 · OSV.dev and GitHub, Project advisories (GitHub)
  15. Medium 4.6

    CVE-2025-43773 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 has a security vulnerability that allowing for improper access through the expandoTableLocalService.

    Published 29 Aug 2025 · Fixed in 2024.Q1.19, 2025.Q1.15 · NVD
  16. High 8.2

    CVE-2024-58259 · Rancher

    Unauthenticated Denial of Service

    Published 28 Aug 2025 · Fixed in 2.10.9, 2.11.5, 2.12.1 · Project advisories (GitHub)
  17. High 7.5

    CVE-2025-6203 · HashiCorp Vault

    A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vault’s auditing subroutine, potentially resulting in the Vault server to become unresponsive. This vulnerability, CVE-2025-6203, is fixed in Vault Community Edition 1.20.3 and Vault…

    Published 28 Aug 2025 · Fixed in 1.19.11, 1.20.5, 1.21.0 · NVD
  18. Medium 6.5

    CVE-2025-25010 · Kibana

    Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces.

    Published 28 Aug 2025 · Fixed in 9.0.6, 9.1.3 · NVD
  19. High 8.7

    CVE-2024-13986 · Nagios XI

    Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename operations. Exploitation results in the placement of attacker-controlled PHP files in a web-accessible…

    Published 28 Aug 2025 · Fixed in 2024 · NVD
  20. Medium 5.3

    CVE-2025-57756 · Contao

    Information disclosure in the front end search index

    Published 28 Aug 2025 · Fixed in 4.13.56, 5.3.38, 5.6.1 · NVD, Project advisories (GitHub)
  21. Medium 5.3

    CVE-2025-57757 · Contao

    Information disclosure in the news module

    Published 28 Aug 2025 · Fixed in 5.3.38, 5.6.1 · NVD, Project advisories (GitHub)
  22. Medium 4.3

    CVE-2025-57758 · Contao

    Improper access control in the back end voters

    Published 28 Aug 2025 · Fixed in 5.3.38, 5.6.1 · NVD, Project advisories (GitHub)
  23. Medium 4.3

    CVE-2025-57759 · Contao

    Improper privilege management for page and article fields

    Published 28 Aug 2025 · Fixed in 5.3.38, 5.6.1 · NVD, Project advisories (GitHub)
  24. Medium 6.5

    CVE-2025-9217 · Slider Revolution

    Slider Revolution: Path Traversal

    Published 28 Aug 2025 · Fixed in 6.7.37 · WPVulnerability
  25. Medium 5.0

    CVE-2025-5101 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that under certain conditions could have allowed an authenticated attacker to distribute malicious code that appears harmless in the web interface by taking advantage of ambiguity between branches and tags during repository imports.

    Published 27 Aug 2025 · Fixed in 18.1.5, 18.2.5 · NVD
  26. High 7.5

    CVE-2025-4225 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 14.1 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that that under certain conditions could have allowed an unauthenticated attacker to cause a denial-of-service condition affecting all users by sending specially crafted GraphQL requests.

    Published 27 Aug 2025 · Fixed in 18.1.5, 18.2.5 · NVD
  27. Medium 6.5

    CVE-2025-3601 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.15 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have could have allowed an authenticated user to cause a Denial of Service (DoS) condition by submitting URLs that generate excessively large responses.

    Published 27 Aug 2025 · Fixed in 18.1.5, 18.2.5 · NVD
  28. Medium 5.3

    CVE-2025-2246 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have allowed unauthenticated users to access sensitive manual CI/CD variables by querying the GraphQL API.

    Published 27 Aug 2025 · Fixed in 18.1.5, 18.2.5 · NVD
  29. Critical 9.4

    CVE-2025-34161 · Coolify

    Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field during project creation. By submitting a crafted repository string containing command injection syntax, an attacker can…

    Published 27 Aug 2025 · Fixed in 4.0.0 · NVD
  30. Critical 9.4

    CVE-2025-34159 · Coolify

    Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary Docker Compose directives during project creation. By crafting a malicious service definition that mounts the host root filesystem, an attacker can gain full root…

    Published 27 Aug 2025 · Fixed in 4.0.0 · NVD
  31. Critical 9.4

    CVE-2025-34157 · Coolify

    Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to delete the project or its associated resource, the payload executes in the admin’s browser…

    Published 27 Aug 2025 · Fixed in 4.0.0 · NVD
  32. Critical 9.1

    CVE-2025-50989 · OPNsense

    OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span POST parameter is concatenated into a system-level command without proper sanitization or escaping, allowing an administrator to inject arbitrary shell operators and payloads. Successful exploitation results in remote code execution with…

    Published 27 Aug 2025 · Fixed in 25.1.8 · NVD
  33. High 7.5

    CVE-2025-53105 · GLPI

    Unauthorized rules execution order update

    Published 27 Aug 2025 · Fixed in 10.0.19 · Project advisories (GitHub)
  34. High 8.8

    CVE-2025-57803 · ImageMagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances…

    Published 26 Aug 2025 · Fixed in 6.9.13-28, 7.1.2-2 · NVD
  35. High 8.8

    CVE-2025-55298 · ImageMagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks…

    Published 26 Aug 2025 · Fixed in 6.9.13-28, 7.1.2-2 · NVD
  36. High 7.5

    CVE-2025-55212 · ImageMagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue…

    Published 26 Aug 2025 · Fixed in 6.9.13-28, 7.1.2-2 · NVD
  37. Medium 6.1

    CVE-2025-56432 · Nagios XI

    A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of a logged-in user's session via a specially crafted URL. The issue resides in a web component responsible for rendering performance-related data.

    Published 26 Aug 2025 · NVD
  38. High 8.8

    CVE-2025-7776 · NetScaler ADC and Gateway

    Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) with PCoIP Profile bounded to it

    Published 26 Aug 2025 · Fixed in 13.1-37.241, 13.1-59.22, 14.1-47.48 · NVD
  39. Critical 9.2Actively exploited

    CVE-2025-7775 · NetScaler ADC and Gateway

    Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or…

    Published 26 Aug 2025 · Fixed in 13.1-37.241, 13.1-59.22, 14.1-47.48 · NVD
  40. Medium 6.1

    CVE-2025-57811 · Craft CMS

    Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI (Server-Side Template Injection). This is a follow-up to CVE-2024-52293. This vulnerability has been patched in versions 4.16.6 and 5.8.7.

    Published 25 Aug 2025 · Fixed in 4.16.6, 5.8.7 · NVD
  41. High

    CVE-2025-54370 · phpoffice/phpspreadsheet

    PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser

    Published 25 Aug 2025 · Fixed in 2.4.0, 3.10.0, 5.0.0 · OSV.dev and GitHub
  42. High 8.8

    CVE-2025-57760 · Langflow

    Privilege Escalation via CLI Superuser Creation (Post-RCE)

    Published 25 Aug 2025 · Fixed in 1.5.0, 1.5.1 · NVD, Project advisories (GitHub)
  43. High 8.6

    CVE-2025-43960 · Adminer

    Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:1000000000), leading to a PHP Object Injection issue. Remote, unauthenticated attackers can trigger this by sending a malicious serialized object, which forces excessive memory usage, rendering Adminer’s interface unresponsive and causing a server-level…

    Published 25 Aug 2025 · NVD
  44. Medium 6.8

    CVE-2025-43766 · Liferay Portal / DXP

    The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component that are processed within the environment enabling arbitrary code execution by attackers.

    Published 23 Aug 2025 · Fixed in 7.4.3.132, 2024.Q1.14 · NVD
  45. Medium 6.9

    CVE-2025-43765 · Liferay Portal / DXP

    A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the text field from a web content.

    Published 23 Aug 2025 · Fixed in 7.4.3.132, 2024.Q1.14 · NVD
  46. Medium 6.9

    CVE-2025-43764 · Liferay Portal / DXP

    Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.1, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92, which allows authenticated users with permissions to update Kaleo…

    Published 23 Aug 2025 · Fixed in 7.4.3.132, 2024.Q4.2 · NVD
  47. Medium 5.1

    CVE-2025-43767 · Liferay Portal / DXP

    Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 update 86 through update 92 allows an attacker to exploit this security vulnerability to redirect users to a malicious site.

    Published 23 Aug 2025 · Fixed in 7.4.3.132, 2024.Q1.13, 2024.Q3.10 · NVD
  48. Medium 4.6

    CVE-2025-43769 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via components tab.

    Published 23 Aug 2025 · Fixed in 7.4.3.132, 2024.Q1.13, 2024.Q3.9 · NVD
  49. Medium 5.1

    CVE-2025-43768 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows authenticated users without any permissions to access sensitive information of admin users using JSONWS APIs.

    Published 23 Aug 2025 · Fixed in 7.4.3.132, 2024.Q1.16 · NVD
  50. Medium 6.9

    CVE-2025-43770 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the referer or FORWARD_URL using %00 in those parameters.

    Published 23 Aug 2025 · Fixed in 7.4.3.132, 2024.Q1.13, 2024.Q4.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.