UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,961
Published in 7 days
849
Critical in 30 days
415
Actively exploited
420

Latest vulnerabilities

37,961 vulnerabilities
  1. Medium 6.3

    CVE-2025-55731 · Frappe Framework

    Possibility of Authenticated SQL Injection due to improper validations

    Published 20 Aug 2025 · Fixed in 14.96.15, 15.74.2 · NVD, Project advisories (GitHub)
  2. Medium 6.5

    CVE-2025-57734 · TeamCity

    In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files

    Published 20 Aug 2025 · Fixed in 2025.07.1 · NVD
  3. Low 3.8

    CVE-2025-57733 · TeamCity

    In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content

    Published 20 Aug 2025 · Fixed in 2025.07.1 · NVD
  4. Medium 6.3

    CVE-2025-57732 · TeamCity

    In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership

    Published 20 Aug 2025 · Fixed in 2025.07.1 · NVD
  5. High 7.5

    CVE-2025-55746 · Directus

    Unauthenticated file upload and file modification due to lacking input sanitization

    Published 20 Aug 2025 · Fixed in 11.9.3 · NVD, Project advisories (GitHub)
  6. Medium 5.1

    CVE-2025-43744 · Liferay Portal / DXP

    A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js…

    Published 19 Aug 2025 · Fixed in 2024.q1.21, 2025.Q1.16, 2025.Q2.6 · NVD
  7. Medium 5.3

    CVE-2025-43743 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send…

    Published 19 Aug 2025 · Fixed in 2024.Q1.16, 2025.Q1.6 · NVD
  8. Medium 6.9

    CVE-2025-43745 · Liferay Portal / DXP

    A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote attackers to performs cross-origin request on behalf of the authenticated user via the endpoint…

    Published 19 Aug 2025 · Fixed in 2024.q1.20, 2025.Q1.16, 2025.Q2.8 · NVD
  9. Medium 5.1

    CVE-2025-43737 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via _com_liferay_journal_web_portlet_JournalPortlet_backURL parameter.

    Published 19 Aug 2025 · Fixed in 2025.Q1.16, 2025.Q2.9 · NVD
  10. Low 2.4

    CVE-2025-54411 · Discourse

    Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcome_banner.header.logged_in_members site text to remove the preferred_display_name placeholder, or not impersonate any users for the time being. This…

    Published 19 Aug 2025 · Fixed in 3.5.0 · NVD
  11. Medium 5.4

    CVE-2025-52478 · n8n

    n8n is a workflow automation platform. From 1.77.0 to before 1.98.2, a stored Cross-Site Scripting (XSS) vulnerability was identified in n8n, specifically in the Form Trigger node's HTML form element. An authenticated attacker can inject malicious HTML via an <iframe> with a srcdoc payload that includes arbitrary JavaScript execution. The attacker can also inject malicious Javascript by using…

    Published 19 Aug 2025 · Fixed in 1.98.2 · NVD
  12. Medium 5.1

    CVE-2025-43738 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via…

    Published 19 Aug 2025 · Fixed in 2024.q1.20, 2025.Q1.16, 2025.Q2.9 · NVD
  13. Medium 5.3

    CVE-2025-43739 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allow any authenticated user to modify the content of emails sent through the calendar portlet, allowing an attacker to send phishing emails to any other user in the…

    Published 19 Aug 2025 · Fixed in 2025.Q1.7 · NVD
  14. Medium 4.6

    CVE-2025-43740 · Liferay Portal / DXP

    A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.9 through 2024.Q1.19 allows an remote authenticated attacker to inject JavaScript through the message boards feature available…

    Published 19 Aug 2025 · Fixed in 2024.Q1.20, 2025.Q1.16, 2025.Q2.9 · NVD
  15. High

    CVE-2025-55303 · Astro

    Unauthorized third-party images in Astro’s _image endpoint

    Published 19 Aug 2025 · Fixed in 4.16.19, 5.13.2 · Project advisories (GitHub)
  16. Medium 6.9

    CVE-2025-43731 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories.

    Published 18 Aug 2025 · Fixed in 2024.Q1.17, 2025.Q1.9 · NVD
  17. Low 2.7

    CVE-2025-54234 · Adobe ColdFusion

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to limited file system read. A high-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

    Published 18 Aug 2025 · NVD
  18. Medium 4.8

    CVE-2025-43732 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure Direct Object Reference (IDOR) in the groupId parameter of the _com_liferay_roles_selector_web_portlet_RolesSelectorPortlet_groupId. When…

    Published 18 Aug 2025 · Fixed in 2024.Q1.18, 2025.Q1.11 · NVD
  19. Low 2.3

    CVE-2025-43733 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated attacker to inject JavaScript code via the content page's name field. This malicious payload is then reflected and executed within the user's browser when viewing the "document View Usages" page.

    Published 18 Aug 2025 · Fixed in 2025.Q1.8 · NVD
  20. Critical 9.8

    CVE-2025-54466 · Apache OFBiz

    Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used. Even unauthenticated attackers can exploit this vulnerability. Users are recommended to upgrade to version 24.09.02, which fixes the issue.

    Published 15 Aug 2025 · Fixed in 24.09.02 · NVD
  21. Medium 5.8

    CVE-2025-20224 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition. This vulnerability is due to improper parsing of IKEv2 packets. An attacker could…

    Published 14 Aug 2025 · NVD
  22. High 7.7

    CVE-2025-20127 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the TLS 1.3 implementation for a specific cipher for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Cisco Firepower 3100 and 4200 Series devices could allow an authenticated, remote attacker to consume resources that are associated with incoming TLS 1.3 connections, which eventually could cause the…

    Published 14 Aug 2025 · NVD
  23. High 7.5

    CVE-2025-36047 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

    Published 14 Aug 2025 · Fixed in 25.0.0.9 · NVD
  24. High 7.5

    CVE-2025-33142 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections.

    Published 14 Aug 2025 · Fixed in 8.5.5.29, 9.0.5.25 · NVD
  25. Medium 5.3

    CVE-2025-55675 · Apache Superset

    Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive…

    Published 14 Aug 2025 · Fixed in 5.0.0 · NVD
  26. Medium 5.3

    CVE-2025-55674 · Apache Superset

    A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue…

    Published 14 Aug 2025 · Fixed in 5.0.0 · NVD
  27. Medium 5.3

    CVE-2025-55673 · Apache Superset

    When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3,…

    Published 14 Aug 2025 · Fixed in 4.1.3 · NVD
  28. Medium 5.3

    CVE-2025-55672 · Apache Superset

    A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands…

    Published 14 Aug 2025 · Fixed in 5.0.0 · NVD
  29. Critical 9.8

    CVE-2025-8943 · Flowise

    The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This…

    Published 14 Aug 2025 · Fixed in 3.0.1 · NVD
  30. Critical 9.3

    CVE-2012-10054 · Umbraco CMS

    Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and…

    Published 13 Aug 2025 · Fixed in 4.7.1 · NVD
  31. Critical 10.0

    CVE-2011-10018 · MyBB

    myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP code by injecting payloads into a specially crafted collapsed cookie. This vulnerability was introduced during packaging and was not part of the intended application logic. Exploitation requires no authentication and results in full…

    Published 13 Aug 2025 · NVD
  32. High

    CVE-2025-24293 · Ruby on Rails

    Active Storage allowed transformation methods potentially unsafe

    Published 13 Aug 2025 · Fixed in 7.1.5.2, 7.2.2.2, 8.0.2.1 · Project advisories (GitHub)
  33. Low

    CVE-2025-55193 · Ruby on Rails

    ANSI escape injection in Active Record logging

    Published 13 Aug 2025 · Fixed in 7.1.5.2, 7.2.2.2, 8.0.2.1 · Project advisories (GitHub)
  34. Medium 6.5

    CVE-2025-8770 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allowed authenticated users with specific access to bypass merge request approval policies by manipulating approval rule identifiers.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  35. Medium 5.4

    CVE-2025-7739 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions.

    Published 13 Aug 2025 · Fixed in 18.2.2 · NVD
  36. Medium 5.4

    CVE-2025-7734 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 14.2 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  37. Medium 5.4

    CVE-2025-6186 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to achieve account takeover by injecting malicious HTML into work item names.

    Published 13 Aug 2025 · Fixed in 18.1.4, 18.2.2 · NVD
  38. Medium 5.0

    CVE-2025-5819 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users with developer access to obtain ID tokens for protected branches under certain circumstances.

    Published 13 Aug 2025 · Fixed in 17.11.6, 18.0.4, 18.1.2 · NVD
  39. Medium 6.5

    CVE-2025-2937 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to create a denial of service condition by sending specially crafted markdown payloads to the Wiki feature.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  40. Medium 6.5

    CVE-2025-2614 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an authenticated user to cause a denial of service condition by creating specially crafted content that consumes excessive server resources when processed.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  41. Medium 4.3

    CVE-2025-2498 · GitLab

    An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  42. High 7.5

    CVE-2025-1477 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.14 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an unauthenticated user to create a denial of service condition by sending specially crafted payloads to specific integration API endpoints.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  43. Medium 5.5

    CVE-2024-12303 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users with specific roles and permissions to delete issues including confidential ones by inviting users with a specific role.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  44. Medium 6.5

    CVE-2024-10219 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users to bypass access controls and download private artifacts by accessing specific API endpoints.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  45. Medium 6.9

    CVE-2025-54500 · F5 BIG-IP

    An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack).  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 13 Aug 2025 · Fixed in 16.1.6.1, 17.1.3, 17.5.1.2 · NVD
  46. Medium 6.3

    CVE-2025-53859 · nginx

    NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations…

    Published 13 Aug 2025 · Fixed in 1.29.1 · NVD
  47. High 8.7

    CVE-2025-52585 · F5 BIG-IP

    When a BIG-IP LTM Client SSL profile is configured on a virtual server with SSL Forward Proxy enabled and Anonymous Diffie-Hellman (ADH) ciphers enabled, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 13 Aug 2025 · Fixed in 15.1.10.8, 16.1.6, 17.1.2.2 · NVD
  48. High 7.0

    CVE-2025-48500 · F5 BIG-IP

    A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a malicious package installer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 13 Aug 2025 · Fixed in 16.1.6.1, 17.1.3, 17.5.1.3 · NVD
  49. High 8.7

    CVE-2025-46405 · F5 BIG-IP

    When Network Access is configured on a BIG-IP APM virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 13 Aug 2025 · Fixed in 15.1.10.8, 16.1.6, 17.1.2.2 · NVD
  50. Medium 6.5

    CVE-2025-55668 · Apache Tomcat

    Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

    Published 13 Aug 2025 · Fixed in 9.0.106, 10.1.42, 11.0.8 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.