UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,961
Published in 7 days
848
Critical in 30 days
414
Actively exploited
420

Latest vulnerabilities

37,961 vulnerabilities
  1. Medium 5.3

    CVE-2025-55160 · ImageMagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.

    Published 13 Aug 2025 · Fixed in 6.9.13-27, 7.1.2-1 · NVD
  2. High 7.8

    CVE-2025-55154 · ImageMagick

    Heap Buffer Over-Write in MGN decoder on 32-bit systems

    Published 13 Aug 2025 · Fixed in 6.9.13-58, 7.1.2-1, 7.1.2-33 · NVD, Project advisories (GitHub)
  3. Medium 5.5

    CVE-2025-55005 · ImageMagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, when preparing to transform from Log to sRGB colorspaces, the logmap construction fails to handle cases where the reference-black or reference-white value is larger than 1024. This leads to corrupting memory beyond the end of the allocated logmap buffer. This issue has been…

    Published 13 Aug 2025 · Fixed in 7.1.2-1 · NVD
  4. Medium 4.3

    CVE-2025-55004 · ImageMagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vulnerable to heap-buffer overflow read around the handling of images with separate alpha channels when performing image magnification in ReadOneMNGIMage. This can likely be used to leak subsequent memory contents into the output image. This issue has been…

    Published 13 Aug 2025 · Fixed in 7.1.2-1 · NVD
  5. High 7.5

    CVE-2025-48989 · Apache Tomcat

    Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

    Published 13 Aug 2025 · Fixed in 9.0.108, 10.1.44, 11.0.10 · NVD
  6. Medium 4.8

    CVE-2025-36000 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

    Published 12 Aug 2025 · Fixed in 25.0.0.9 · NVD
  7. High 7.2

    CVE-2025-53744 · Fortinet FortiOS

    An incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote authenticated attacker with high privileges to escalate their privileges to super-admin via registering the device to a malicious FortiManager.

    Published 12 Aug 2025 · Fixed in 7.4.8, 7.6.3 · NVD
  8. High 8.1

    CVE-2025-52970 · Fortinet FortiWeb

    A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.

    Published 12 Aug 2025 · Fixed in 7.2.11, 7.4.8, 7.6.4 · NVD
  9. Medium 6.7

    CVE-2025-47857 · Fortinet FortiWeb

    A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or command via crafted CLI commands.

    Published 12 Aug 2025 · Fixed in 7.4.9, 7.6.4 · NVD
  10. Medium 5.1

    CVE-2025-43734 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in…

    Published 12 Aug 2025 · NVD
  11. High 7.5

    CVE-2025-36124 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration

    Published 12 Aug 2025 · Fixed in 25.0.0.9 · NVD
  12. Medium 6.7

    CVE-2025-32766 · Fortinet FortiWeb

    A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or commands via crafted CLI commands

    Published 12 Aug 2025 · Fixed in 7.4.9, 7.6.4 · NVD
  13. Medium 6.7

    CVE-2025-27759 · Fortinet FortiWeb

    An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiWeb version 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10 and before 7.0.10 allows an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI commands

    Published 12 Aug 2025 · Fixed in 7.2.11, 7.4.8, 7.6.4 · NVD
  14. Medium 6.5

    CVE-2025-25248 · Fortinet FortiProxy, Fortinet FortiOS

    An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions and FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all…

    Published 12 Aug 2025 · Fixed in 7.4.4, 7.4.8, 7.6.3 · NVD
  15. High 8.1

    CVE-2024-26009 · Fortinet FortiProxy, Fortinet FortiOS

    An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0, FortiPAM 1.1.0 through 1.1.2, FortiPAM 1.0.0 through 1.0.3, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.15, FortiSwitchManager 7.2.0 through 7.2.3,…

    Published 12 Aug 2025 · Fixed in 7.0.16, 7.2.9, 7.4.3 · NVD
  16. High 7.2

    CVE-2023-45584 · Fortinet FortiProxy, Fortinet FortiOS

    A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.1, FortiProxy 7.2.0 through 7.2.7, FortiProxy 7.0.0 through 7.0.13 allows a privileged attacker to execute code or commands via crafted HTTP or HTTPs…

    Published 12 Aug 2025 · Fixed in 7.2.6, 7.2.8, 7.4.2 · NVD
  17. High 8.8

    CVE-2025-53727 · Microsoft SQL Server

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

    Published 12 Aug 2025 · Fixed in 15.0.4440.1, 16.0.1145.1, 16.0.4210.1 · NVD
  18. High 8.8

    CVE-2025-49759 · Microsoft SQL Server

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

    Published 12 Aug 2025 · Fixed in 15.0.4440.1, 16.0.1145.1, 16.0.4210.1 · NVD
  19. High 8.8

    CVE-2025-49758 · Microsoft SQL Server

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

    Published 12 Aug 2025 · Fixed in 15.0.4440.1, 16.0.1145.1, 16.0.4210.1 · NVD
  20. Medium 5.3

    CVE-2025-49559 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to modify limited data. Exploitation of this issue does not require user interaction.

    Published 12 Aug 2025 · Fixed in 2.4.4, 2.4.5 · NVD
  21. Medium 5.9

    CVE-2025-49558 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability by manipulating the timing between the check of a resource's state and its use, allowing unauthorized write access.…

    Published 12 Aug 2025 · Fixed in 2.4.4, 2.4.5 · NVD
  22. High 8.7

    CVE-2025-49557 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as…

    Published 12 Aug 2025 · Fixed in 2.4.4, 2.4.5 · NVD
  23. High 7.5

    CVE-2025-49556 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction, and scope is…

    Published 12 Aug 2025 · Fixed in 2.4.4, 2.4.5 · NVD
  24. High 8.1

    CVE-2025-49555 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in privilege escalation. A high-privileged attacker could trick a victim into executing unintended actions on a web application where the victim is authenticated, potentially allowing unauthorized access or…

    Published 12 Aug 2025 · Fixed in 2.4.4, 2.4.5 · NVD
  25. High 7.5

    CVE-2025-49554 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require…

    Published 12 Aug 2025 · Fixed in 2.4.4, 2.4.5 · NVD
  26. High 8.8

    CVE-2025-47954 · Microsoft SQL Server

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

    Published 12 Aug 2025 · Fixed in 16.0.1145.1, 16.0.4210.1 · NVD
  27. High 7.5

    CVE-2025-33051 · Microsoft Exchange Server

    Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

    Published 12 Aug 2025 · Fixed in 15.02.2562.020 · NVD
  28. Medium 5.3

    CVE-2025-25007 · Microsoft Exchange Server

    Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    Published 12 Aug 2025 · Fixed in 15.02.2562.020 · NVD
  29. Medium 5.3

    CVE-2025-25006 · Microsoft Exchange Server

    Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    Published 12 Aug 2025 · Fixed in 15.02.2562.020 · NVD
  30. Medium 6.5

    CVE-2025-25005 · Microsoft Exchange Server

    Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

    Published 12 Aug 2025 · Fixed in 15.02.2562.020 · NVD
  31. High 8.8

    CVE-2025-24999 · Microsoft SQL Server

    Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

    Published 12 Aug 2025 · Fixed in 15.0.4440.1, 16.0.1145.1, 16.0.4210.1 · NVD
  32. Medium 5.5

    CVE-2025-5468 · Ivanti Connect Secure

    Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a local authenticated attacker to read arbitrary files on disk.

    Published 12 Aug 2025 · Fixed in 22.7 · NVD
  33. Medium 4.9

    CVE-2025-5466 · Ivanti Connect Secure

    XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service

    Published 12 Aug 2025 · Fixed in 22.7 · NVD
  34. High 7.5

    CVE-2025-5462 · Ivanti Connect Secure

    A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service.

    Published 12 Aug 2025 · Fixed in 22.7 · NVD
  35. High 7.5

    CVE-2025-5456 · Ivanti Connect Secure

    A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service. CWE-125

    Published 12 Aug 2025 · Fixed in 22.7 · NVD
  36. Medium 6.9

    CVE-2025-43735 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.

    Published 12 Aug 2025 · NVD
  37. Medium 6.9

    CVE-2025-43736 · Liferay Portal / DXP

    A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload more than 300kb profile picture into the user profile. This size more than…

    Published 12 Aug 2025 · NVD
  38. Medium 6.5

    CVE-2025-0818 · File Manager Advanced (WordPress plugin), Filester (WordPress plugin)

    File Manager Pro – Filester: Path Traversal

    Published 12 Aug 2025 · Fixed in 1.9, 5.4.0 · WPVulnerability
  39. Medium 4.9

    CVE-2025-8081 · Elementor

    Elementor Website Builder – more than just a page builder: Path Traversal

    Published 11 Aug 2025 · Fixed in 3.30.3 · NVD, WPVulnerability
  40. Medium 5.1

    CVE-2025-4655 · Liferay Portal / DXP

    SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.

    Published 9 Aug 2025 · Fixed in 2024.Q1.16, 2025.Q1.6 · NVD
  41. Medium 5.3

    CVE-2025-4581 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web due to improper validation of user-supplied URLs. An attacker can…

    Published 9 Aug 2025 · NVD
  42. Medium 5.2

    CVE-2025-54417 · Craft CMS

    Craft is a platform for creating digital experiences. Versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3 contain a vulnerability that can bypass CVE-2025-23209: "Craft CMS has a potential RCE with a compromised security key". To exploit this vulnerability, the project must meet these requirements: have a compromised security key and create an arbitrary file in Craft's /storage/backups…

    Published 9 Aug 2025 · Fixed in 4.16.3, 5.8.4 · NVD
  43. Low 1.9

    CVE-2025-8732 · libxml2

    A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment.…

    Published 8 Aug 2025 · Fixed in 2.15.2 · NVD
  44. Medium 6.9

    CVE-2025-4576 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the…

    Published 8 Aug 2025 · NVD
  45. High 7.2

    CVE-2025-54996 · OpenBao

    OpenBao Operator May Elevate Token Privileges

    Published 8 Aug 2025 · Fixed in 2.3.2 · NVD, Project advisories (GitHub)
  46. Medium 5.7

    CVE-2025-55003 · OpenBao

    OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse

    Published 8 Aug 2025 · Fixed in 2.3.2 · NVD, Project advisories (GitHub)
  47. Critical 9.1

    CVE-2025-54997 · OpenBao

    Privileged OpenBao Operator May Execute Code on the Underlying Host

    Published 8 Aug 2025 · Fixed in 2.3.2 · NVD, Project advisories (GitHub)
  48. Medium 5.3

    CVE-2025-54998 · OpenBao

    OpenBao Userpass and LDAP User Lockout Bypass

    Published 8 Aug 2025 · Fixed in 2.3.2 · NVD, Project advisories (GitHub)
  49. Low 3.7

    CVE-2025-54999 · OpenBao

    Timing Side-Channel in OpenBao’s Userpass Auth Method

    Published 8 Aug 2025 · Fixed in 2.3.2 · NVD, Project advisories (GitHub)
  50. Medium 6.5

    CVE-2025-55000 · OpenBao

    OpenBao TOTP Secrets Engine Code Reuse

    Published 8 Aug 2025 · Fixed in 2.3.2 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.