UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,963
Published in 7 days
848
Critical in 30 days
414
Actively exploited
420

Latest vulnerabilities

37,963 vulnerabilities
  1. Medium 6.5

    CVE-2025-55000 · OpenBao

    OpenBao TOTP Secrets Engine Code Reuse

    Published 8 Aug 2025 · Fixed in 2.3.2 · NVD, Project advisories (GitHub)
  2. Medium 6.5

    CVE-2025-55001 · OpenBao

    OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias

    Published 8 Aug 2025 · Fixed in 2.3.2 · NVD, Project advisories (GitHub)
  3. Low 3.4

    CVE-2025-54940 · Advanced Custom Fields

    Advanced Custom Fields (ACF®): Code Injection

    Published 8 Aug 2025 · Fixed in 6.4.3 · WPVulnerability
  4. Medium 6.6

    CVE-2025-44779 · Ollama

    An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.

    Published 7 Aug 2025 · NVD
  5. High 7.5

    CVE-2024-56339 · IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a failure to honor security configuration.

    Published 7 Aug 2025 · NVD
  6. Medium

    CVE-2025-54793 · Astro

    Trailing slash handling causes open redirect issue

    Published 7 Aug 2025 · Fixed in 5.12.8 · Project advisories (GitHub)
  7. High 8.0

    CVE-2025-53786 · Microsoft Exchange Server

    On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April…

    Published 6 Aug 2025 · Fixed in 15.02.2562.017 · NVD
  8. High 8.1

    CVE-2025-50286 · Grav

    A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Once uploaded, the plugin is automatically extracted and loaded, allowing arbitrary PHP code execution and reverse shell access.

    Published 6 Aug 2025 · NVD
  9. High 8.1

    CVE-2025-6013 · HashiCorp Vault

    Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24.

    Published 6 Aug 2025 · Fixed in 1.18.13, 1.19.8, 1.20.2 · NVD
  10. Medium 6.0

    CVE-2025-7954 · Shopware

    A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.

    Published 6 Aug 2025 · Fixed in 6.7.2.0 · NVD
  11. Low 2.0

    CVE-2025-8573 · Concrete CMS

    Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page.  Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.0 with vector…

    Published 5 Aug 2025 · Fixed in 9.4.3 · NVD
  12. Medium 4.8

    CVE-2025-8571 · Concrete CMS

    Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and (if victim is an admin), the execution of unauthorized actions. The Concrete CMS security team gave this vulnerability…

    Published 5 Aug 2025 · Fixed in 8.5.21, 9.4.3 · NVD
  13. Medium 6.9

    CVE-2025-54571 · ModSecurity

    Insufficient Return Value Handling on ModSecurity leads to XSS and Source Code Disclosure

    Published 5 Aug 2025 · Fixed in 2.9.12 · NVD, Project advisories (GitHub)
  14. Medium 6.1

    CVE-2025-51541 · Shopware

    A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. The c_database_schema field fails to properly sanitize user-supplied input before rendering it in the browser, allowing an attacker to inject malicious JavaScript. This vulnerability can be exploited via a Cross-Site Request Forgery (CSRF) attack due to…

    Published 5 Aug 2025 · Fixed in 6.2.3 · NVD
  15. High 7.5

    CVE-2025-54879 · Mastodon

    Mastodon confirmation e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails

    Published 5 Aug 2025 · Fixed in 4.2.24, 4.3.11, 4.4.3 · NVD, Project advisories (GitHub)
  16. Medium 5.4

    CVE-2025-46958 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 5 Aug 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  17. Unrated

    WPV-3f29e4c03b12 · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Published 5 Aug 2025 · Fixed in 3.5.2 · WPVulnerability
  18. Medium 6.9

    CVE-2025-4604 · Liferay Portal / DXP

    The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.0 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7, 2025.Q1.0 through 2025.Q1.15 and 7.4 update 80 through update 92 and then attackers can run scripts in the Gogo shell

    Published 4 Aug 2025 · NVD
  19. Low 2.0

    CVE-2025-4599 · Liferay Portal / DXP

    The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 update 61 through update 92 was found to be vulnerable to postMessage-based XSS because it allows a remote non-authenticated attacker to inject JavaScript into the fragment…

    Published 4 Aug 2025 · Fixed in 7.4.3.132 · NVD
  20. High 7.5

    CVE-2025-54868 · LibreChat

    Reading of arbitrary Chats

    Published 4 Aug 2025 · Fixed in 0.7.8 · NVD, Project advisories (GitHub)
  21. High

    CVE-2025-28062 · Frappe Framework

    Account takeover via CSRF

    Published 4 Aug 2025 · Fixed in 14.96.10, 15.72.0 · Project advisories (GitHub)
  22. Medium 6.8

    CVE-2025-6037 · HashiCorp Vault

    Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonate another user. Fixed in Vault…

    Published 1 Aug 2025 · Fixed in 1.18.12, 1.19.7, 1.20.1 · NVD
  23. Medium 5.7

    CVE-2025-6015 · HashiCorp Vault

    Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

    Published 1 Aug 2025 · Fixed in 1.18.12, 1.19.7, 1.20.1 · NVD
  24. Medium 6.5

    CVE-2025-6014 · HashiCorp Vault

    Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

    Published 1 Aug 2025 · Fixed in 1.18.12, 1.19.7, 1.20.1 · NVD
  25. Low 3.7

    CVE-2025-6011 · HashiCorp Vault

    A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

    Published 1 Aug 2025 · Fixed in 1.18.12, 1.19.7, 1.20.1 · NVD
  26. Medium 5.3

    CVE-2025-6004 · HashiCorp Vault

    Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

    Published 1 Aug 2025 · Fixed in 1.18.12, 1.19.7, 1.20.1 · NVD
  27. Critical 9.1

    CVE-2025-6000 · HashiCorp Vault

    A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

    Published 1 Aug 2025 · Fixed in 1.18.12, 1.19.7, 1.20.1 · NVD
  28. High 7.2

    CVE-2025-5999 · HashiCorp Vault

    A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22.

    Published 1 Aug 2025 · Fixed in 1.18.11, 1.19.6, 1.20.0 · NVD
  29. High 7.3

    CVE-2025-54386 · Traefik

    Path Traversal in WASM Client Plugin

    Published 1 Aug 2025 · Fixed in 3.4.4, 3.4.5, 3.5.0 · NVD, Project advisories (GitHub)
  30. Medium 5.1

    CVE-2025-41376 · LimeSurvey

    CRLF Injection vulnerability in Limesurvey v2.65.1+170522.  This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via '/index.php/survey/index/sid/<SID>/token/fwyfw%0d%0aCookie:%20POC'.

    Published 1 Aug 2025 · Fixed in 3.0.0 · NVD
  31. Critical 9.3

    CVE-2025-41375 · LimeSurvey

    SQL Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability allows an attacker to retrieve, create, update and delete database via 'token' parameter in '/index.php' endpoint.

    Published 1 Aug 2025 · Fixed in 3.0.0 · NVD
  32. High 7.5

    CVE-2025-54939 · LiteSpeed Web Server, OpenLiteSpeed

    LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.

    Published 1 Aug 2025 · Fixed in 1.8.4, 6.3.4 · NVD
  33. Low 6.5

    CVE-2025-45769 · firebase/php-jwt

    php-jwt contains weak encryption

    Published 31 Jul 2025 · Fixed in 7.0.0 · OSV.dev and GitHub
  34. Critical 9.8

    CVE-2025-54574 · Squid

    SQUID-2025:1 Buffer Overflow in URN Handling

    Published 31 Jul 2025 · Fixed in 6.4 · NVD, Project advisories (GitHub)
  35. Medium 6.5

    CVE-2025-25692 · PrestaShop

    A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.

    Published 30 Jul 2025 · NVD
  36. Medium 6.5

    CVE-2025-25691 · PrestaShop

    A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.

    Published 30 Jul 2025 · NVD
  37. Medium 6.1

    CVE-2024-45515 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability exists in Zimbra webmail due to insufficient validation of the content type metadata when importing files into the briefcase. Attackers can exploit this issue by crafting a file with manipulated metadata, allowing them to bypass content type checks and execute arbitrary JavaScript…

    Published 30 Jul 2025 · NVD
  38. Medium 5.4

    CVE-2025-47001 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 30 Jul 2025 · Fixed in 6.5.22.0, 2025.5.0 · NVD
  39. Critical 9.8

    CVE-2025-40600 · SonicWall SonicOS

    Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption.

    Published 29 Jul 2025 · Fixed in 7.3.0-7012 · NVD
  40. High 8.2

    CVE-2025-53102 · Discourse

    Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the `stable` branch and version 3.5.0.beta.8 on the `tests-passed` branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared from the user’s session after authentication, potentially allowing reuse and increasing security…

    Published 29 Jul 2025 · Fixed in 3.4.6 · NVD
  41. Medium 4.3

    CVE-2025-53112 · GLPI

    Data removal from allowed users

    Published 29 Jul 2025 · Fixed in 10.0.19 · NVD, Project advisories (GitHub)
  42. Medium 6.5

    CVE-2025-53111 · GLPI

    Data exposure to non allowed users

    Published 29 Jul 2025 · Fixed in 10.0.19 · NVD, Project advisories (GitHub)
  43. Low 2.7

    CVE-2025-53113 · GLPI

    Access to unallowed items information through external links

    Published 29 Jul 2025 · Fixed in 10.0.19 · NVD, Project advisories (GitHub)
  44. Medium 5.4

    CVE-2025-53357 · GLPI

    Reservations modification by unauthorized user

    Published 29 Jul 2025 · Fixed in 10.0.19 · NVD, Project advisories (GitHub)
  45. Medium 6.5

    CVE-2025-53008 · GLPI

    Mail receiver credentials exfiltration

    Published 29 Jul 2025 · Fixed in 10.0.19 · NVD, Project advisories (GitHub)
  46. Medium 6.1

    CVE-2025-52897 · GLPI

    XSS and open redirection in planning

    Published 29 Jul 2025 · Fixed in 10.0.19 · NVD, Project advisories (GitHub)
  47. Medium 5.0

    CVE-2025-52567 · GLPI

    Blind SSRF in RSS feeds and planning

    Published 29 Jul 2025 · Fixed in 10.0.19 · NVD, Project advisories (GitHub)
  48. Medium 5.4

    CVE-2025-27514 · GLPI

    Stored XSS on projects kanban

    Published 29 Jul 2025 · Fixed in 10.0.19 · NVD, Project advisories (GitHub)
  49. Medium

    CVE-2025-7784 · Keycloak

    Privilege Escalation in Keycloak Admin Console (FGAPv2 Enabled)

    Published 29 Jul 2025 · Fixed in 26.2.6 · Project advisories (GitHub)
  50. Medium

    CVE-2025-7365 · Keycloak

    Phishing attack via email verification step in first login flow

    Published 29 Jul 2025 · Fixed in 26.2.6 · Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.