UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,953
Published in 7 days
842
Critical in 30 days
413
Actively exploited
420

Latest vulnerabilities

37,953 vulnerabilities
  1. Medium 6.9

    CVE-2025-43761 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the frontend-editor-ckeditor-web/ckeditor/samples/old/ajax.html…

    Published 22 Aug 2025 · Fixed in 7.4.3.132, 2024.Q1.13, 2024.Q4.5 · NVD
  2. Medium 5.3

    CVE-2025-43762 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the forms, the files are stored in the document_library allowing an attacker to cause a potential DDoS.

    Published 22 Aug 2025 · Fixed in 2024.Q1.15, 2025.Q1.2 · NVD
  3. Medium 6.7

    CVE-2025-43759 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows admin users of a virtual instance to add pages that are not in the default/main virtual instance, then any tenant can create a list of all other tenants.

    Published 22 Aug 2025 · Fixed in 2024.Q1.15 · NVD
  4. Medium 5.3

    CVE-2025-43758 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded by object entry and stored in document_library

    Published 22 Aug 2025 · Fixed in 2024.Q1.16, 2025.Q1.6 · NVD
  5. Medium 5.3

    CVE-2025-43760 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect

    Published 22 Aug 2025 · Fixed in 2024.Q4.7, 2025.Q1.5 · NVD
  6. Medium 6.9

    CVE-2025-43751 · Liferay Portal / DXP

    User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10 and 7.4 GA through update 92 allows remote attackers to determine if an account exist in the application via the create account…

    Published 22 Aug 2025 · Fixed in 2024.Q1.15 · NVD
  7. Medium 5.3

    CVE-2025-57770 · ZITADEL

    User Enumeration in Login UI

    Published 22 Aug 2025 · Fixed in 2.71.15, 3.4.0, 4.0.3 · NVD, Project advisories (GitHub)
  8. Medium 5.3

    CVE-2025-43752 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the object entries attachment fields, the files are stored in the document_library allowing an attacker to…

    Published 22 Aug 2025 · Fixed in 2024.Q1.16, 2025.Q1.5 · NVD
  9. Low 2.1

    CVE-2025-43753 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 update 32 through update 92 allows an remote authenticated user to inject JavaScript into the embedded message field from…

    Published 21 Aug 2025 · Fixed in 2024.Q1.17, 2025.Q1.8 · NVD
  10. Medium 4.8

    CVE-2025-43747 · Liferay Portal / DXP

    A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation on analytics.cloud.domain.allowed, allowing an attacker to perform requests by change the domain and bypassing the validation method, this insecure validation is not distinguishing between trusted subdomains and malicious domains.

    Published 21 Aug 2025 · Fixed in 2025.Q2.4 · NVD
  11. Medium 6.9

    CVE-2025-43754 · Liferay Portal / DXP

    Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspecting the server processing time of the login request.

    Published 21 Aug 2025 · Fixed in 2024.Q1.15 · NVD
  12. Medium 4.9

    CVE-2025-8402 · Mattermost

    Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data which allows a system admin to crash the server via the bulk import feature.

    Published 21 Aug 2025 · Fixed in 10.5.9, 10.8.4, 10.9.4 · NVD
  13. Medium 4.3

    CVE-2025-6465 · Mattermost

    Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names which allows users with file upload permission to overwrite file attachment thumbnails via path traversal in file streaming APIs.

    Published 21 Aug 2025 · Fixed in 10.5.9, 10.8.4, 10.9.4 · NVD
  14. Medium 6.9

    CVE-2025-43756 · Liferay Portal / DXP

    <!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}-->A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.15, 2025.Q2.0 through 2025.Q2.2 and 2024.Q1.13 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via snippet parameter.

    Published 21 Aug 2025 · Fixed in 2024.q1.20, 2025.Q1.16, 2025.Q2.3 · NVD
  15. Medium 5.1

    CVE-2025-43755 · Liferay Portal / DXP

    A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.13, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the…

    Published 21 Aug 2025 · Fixed in 2024.Q1.18, 2025.Q1.14 · NVD
  16. High 7.5

    CVE-2025-48956 · vLLM

    vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.10.1.1, a Denial of Service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory exhaustion, potentially leading to a crash or unresponsiveness. The attack does not require authentication, making it…

    Published 21 Aug 2025 · Fixed in 0.10.1.1 · NVD
  17. Medium 4.9

    CVE-2025-8023 · Mattermost

    Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fails to sanitize path traversal sequences in template file destination paths, which allows a system admin to perform path traversal attacks via malicious path components, potentially enabling malicious file placement outside intended directories.

    Published 21 Aug 2025 · Fixed in 10.5.9, 10.8.4, 10.9.3 · NVD
  18. Low 3.8

    CVE-2025-53971 · Mattermost

    Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members to Guests via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endpoint.

    Published 21 Aug 2025 · Fixed in 9.11.18, 10.5.9 · NVD
  19. Medium 4.3

    CVE-2025-49810 · Mattermost

    Mattermost versions 10.5.x <= 10.5.8 fail to validate access controls at time of access which allows user to read a thread via AI posts

    Published 21 Aug 2025 · Fixed in 10.5.9 · NVD
  20. Medium 6.8

    CVE-2025-49222 · Mattermost

    Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2, 10.10.x <= 10.10.0 fail to validate upload types in remote cluster upload sessions which allows a system admin to upload non-attachment file types via shared channels that could potentially be placed in arbitrary filesystem directories.

    Published 21 Aug 2025 · Fixed in 10.5.9, 10.8.4, 10.9.3 · NVD
  21. Medium 4.3

    CVE-2025-47870 · Mattermost

    Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint which allows an team admin with no member invite privileges to get the team’s invite id.

    Published 21 Aug 2025 · Fixed in 10.5.9, 10.8.4, 10.9.3 · NVD
  22. Low 3.5

    CVE-2025-47700 · Mattermost

    Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions

    Published 21 Aug 2025 · Fixed in 10.5.9 · NVD
  23. Medium 4.9

    CVE-2025-36530 · Mattermost

    Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations which allows restricted admin users to install unauthorized custom plugins via path traversal in the import functionality, bypassing plugin signature enforcement and marketplace restrictions.

    Published 21 Aug 2025 · Fixed in 10.5.9, 10.8.4, 10.9.2 · NVD
  24. Medium 6.5

    CVE-2025-57749 · n8n

    n8n is a workflow automation platform. Before 1.106.0, a symlink traversal vulnerability was discovered in the Read/Write File node in n8n. While the node attempts to restrict access to sensitive directories and files, it does not properly account for symbolic links (symlinks). An attacker with the ability to create symlinks—such as by using the Execute Command node—could exploit this to bypass…

    Published 20 Aug 2025 · Fixed in 1.106.0 · NVD
  25. High 7.7

    CVE-2025-5115 · Eclipse Jetty

    In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory. For example, a client can open a stream and then send…

    Published 20 Aug 2025 · NVD
  26. Medium 4.8

    CVE-2025-43757 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via…

    Published 20 Aug 2025 · Fixed in 2024.Q1.19, 2025.Q1.15, 2025.Q2.3 · NVD
  27. Medium 5.1

    CVE-2025-43746 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via…

    Published 20 Aug 2025 · Fixed in 2024.Q1.19, 2025.Q1.15, 2025.Q2.3 · NVD
  28. Medium 5.4

    CVE-2025-47054 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. A low privileged attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a specially crafted web page.

    Published 20 Aug 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  29. Medium 5.4

    CVE-2025-46998 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 20 Aug 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  30. Medium 5.4

    CVE-2025-46962 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 20 Aug 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  31. Medium 5.4

    CVE-2025-46936 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 20 Aug 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  32. Medium 5.4

    CVE-2025-46932 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 20 Aug 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  33. Medium 5.4

    CVE-2025-46856 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. A low privileged attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a specially crafted web page.

    Published 20 Aug 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  34. Medium 5.4

    CVE-2025-46852 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 20 Aug 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  35. Medium 5.4

    CVE-2025-46849 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 20 Aug 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  36. Critical 9.3

    CVE-2010-20103 · ProFTPD

    A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.

    Published 20 Aug 2025 · NVD
  37. High 7.1

    CVE-2025-43748 · Liferay Portal / DXP

    Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery

    Published 20 Aug 2025 · Fixed in 7.4.3.120, 2024.Q1.7 · NVD
  38. Medium 5.1

    CVE-2025-43750 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows remote unauthenticated users (guests) to upload files via the form attachment field without proper validation, enabling extension obfuscation and bypassing…

    Published 20 Aug 2025 · Fixed in 2024.Q1.15, 2025.Q1.2 · NVD
  39. Medium 5.3

    CVE-2025-43749 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded in the form and stored in document_library

    Published 20 Aug 2025 · Fixed in 2024.Q1.15, 2025.Q1.2 · NVD
  40. Medium 6.9

    CVE-2025-43742 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript in web content for friendly urls.

    Published 20 Aug 2025 · Fixed in 2024.Q1.15, 2025.Q1.4 · NVD
  41. Medium 5.1

    CVE-2025-43741 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScrip in the…

    Published 20 Aug 2025 · Fixed in 2024.Q1.15, 2025.Q1.4 · NVD
  42. High 8.7

    CVE-2025-55732 · Frappe Framework

    Possibility of SQL Injection due to improper validations

    Published 20 Aug 2025 · Fixed in 14.96.15, 15.74.2 · NVD, Project advisories (GitHub)
  43. Medium 6.3

    CVE-2025-55731 · Frappe Framework

    Possibility of Authenticated SQL Injection due to improper validations

    Published 20 Aug 2025 · Fixed in 14.96.15, 15.74.2 · NVD, Project advisories (GitHub)
  44. Medium 6.5

    CVE-2025-57734 · TeamCity

    In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files

    Published 20 Aug 2025 · Fixed in 2025.07.1 · NVD
  45. Low 3.8

    CVE-2025-57733 · TeamCity

    In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content

    Published 20 Aug 2025 · Fixed in 2025.07.1 · NVD
  46. Medium 6.3

    CVE-2025-57732 · TeamCity

    In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership

    Published 20 Aug 2025 · Fixed in 2025.07.1 · NVD
  47. High 7.5

    CVE-2025-55746 · Directus

    Unauthenticated file upload and file modification due to lacking input sanitization

    Published 20 Aug 2025 · Fixed in 11.9.3 · NVD, Project advisories (GitHub)
  48. Medium 5.1

    CVE-2025-43744 · Liferay Portal / DXP

    A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js…

    Published 19 Aug 2025 · Fixed in 2024.q1.21, 2025.Q1.16, 2025.Q2.6 · NVD
  49. Medium 5.3

    CVE-2025-43743 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send…

    Published 19 Aug 2025 · Fixed in 2024.Q1.16, 2025.Q1.6 · NVD
  50. Medium 6.9

    CVE-2025-43745 · Liferay Portal / DXP

    A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote attackers to performs cross-origin request on behalf of the authenticated user via the endpoint…

    Published 19 Aug 2025 · Fixed in 2024.q1.20, 2025.Q1.16, 2025.Q2.8 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.