UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
10,270
Published in 7 days
211
Critical in 30 days
41
Actively exploited
49

Latest vulnerabilities

10,270 vulnerabilities
  1. High 8.8

    CVE-2026-6638 · PostgreSQL

    SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16…

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  2. High 8.8

    CVE-2026-6637 · PostgreSQL

    Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update…

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  3. Medium 4.3

    CVE-2026-6575 · PostgreSQL

    Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL 18.4 are affected. Versions before PostgreSQL 18 are unaffected.

    Published 14 May 2026 · Fixed in 18.4 · NVD
  4. High 7.5

    CVE-2026-6479 · PostgreSQL

    Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  5. Medium 6.5

    CVE-2026-6478 · PostgreSQL

    Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4,…

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  6. High 8.8

    CVE-2026-6477 · PostgreSQL

    Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the…

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  7. High 7.2

    CVE-2026-6476 · PostgreSQL

    SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.

    Published 14 May 2026 · Fixed in 17.10, 18.4 · NVD
  8. High 8.8

    CVE-2026-6475 · PostgreSQL

    Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical…

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  9. Medium 4.3

    CVE-2026-6474 · PostgreSQL

    Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  10. High 8.8

    CVE-2026-6473 · PostgreSQL

    Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation…

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  11. Medium 5.4

    CVE-2026-6472 · PostgreSQL

    Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

    Published 14 May 2026 · Fixed in 16.14, 17.10, 18.4 · NVD
  12. Medium 6.5

    CVE-2026-8280 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to cause denial of service through excessive memory consumption due to improper input validation.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  13. Medium 4.3

    CVE-2026-8144 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with project membership to enumerate private group members due to missing authorization checks.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  14. Medium 5.4

    CVE-2026-7481 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  15. Low 3.5

    CVE-2026-7471 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with control of a virtual registry upstream to make requests to internal hosts due to improper validation.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  16. Medium 5.4

    CVE-2026-7377 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  17. Medium 4.3

    CVE-2026-6883 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 15.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to bypass merge request approval requirements due to improper cleanup of orphaned policy records.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  18. Medium 5.4

    CVE-2026-6335 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user to execute arbitrary code in another user's browser session due to improper sanitization.

    Published 14 May 2026 · Fixed in 18.11.3 · NVD
  19. Medium 5.4

    CVE-2026-6073 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  20. Medium 4.3

    CVE-2026-6063 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user with developer-role permissions to remove code owner approval rules from merge requests due to improper access control.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  21. Medium 6.5

    CVE-2026-4527 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to create unauthorized Jira subscriptions for a targeted user's namespace via a specially crafted link due to missing CSRF protection.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  22. Medium 6.5

    CVE-2026-4524 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to access confidential issue content in public projects without proper authorization due to improper authorization checks.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  23. Medium 4.3

    CVE-2026-3607 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass package protection rules due to improper access control.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  24. Medium 5.8

    CVE-2026-3160 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to view Jira issues outside the configured project scope due to an integration filter functioning only as a display control rather than enforcing access boundaries as specified.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  25. Medium 4.3

    CVE-2026-3074 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to download private debugging symbols from inaccessible projects due to improper access control.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  26. Medium 4.3

    CVE-2026-3073 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass PyPI package protection rules and upload restricted packages due to improper authorization checks.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  27. Low 2.7

    CVE-2026-2900 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-level approval rule editing prevention was enabled, could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  28. High 7.5

    CVE-2026-1659 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted requests due to insufficient input validation.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  29. Medium 4.3

    CVE-2026-1338 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to delete protected container registry tags due to improper authorization checks.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  30. High 8.1

    CVE-2026-1322 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with a read_api scoped OAuth application to create issues and add comments to issues in private projects due to improper authorization.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  31. High 7.5

    CVE-2026-1184 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by uploading a specially crafted file due to improper validation.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  32. High 7.5

    CVE-2025-14870 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted JSON payloads due to insufficient input validation.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  33. High 7.5

    CVE-2025-14869 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted payloads on certain API endpoints.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  34. Medium 4.3

    CVE-2025-13874 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with Guest permissions to view issues in projects they were not authorized to access.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  35. Medium 5.4

    CVE-2025-12669 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to inject HTML and JavaScript into email notifications sent to other users due to improper input sanitization.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  36. High 8.3

    CVE-2026-42946 · nginx

    A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note:…

    Published 13 May 2026 · NVD
  37. Critical 9.2

    CVE-2026-42945 · nginx

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond…

    Published 13 May 2026 · NVD
  38. Medium 6.3

    CVE-2026-42934 · nginx

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited…

    Published 13 May 2026 · NVD
  39. Medium 6.3

    CVE-2026-42926 · nginx

    When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 13 May 2026 · NVD
  40. Medium 6.3

    CVE-2026-40701 · nginx

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a…

    Published 13 May 2026 · NVD
  41. Medium 6.9

    CVE-2026-40460 · nginx

    When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 13 May 2026 · NVD
  42. Medium 5.3

    CVE-2026-7168 · curl

    Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  43. Medium 5.3

    CVE-2026-7009 · curl

    When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine.

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  44. Medium 5.3

    CVE-2026-6429 · curl

    When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  45. High 7.5

    CVE-2026-6276 · curl

    Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  46. Medium 5.9

    CVE-2026-6253 · curl

    curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using…

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  47. High 7.5

    CVE-2026-5773 · curl

    libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an…

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  48. Medium 6.5

    CVE-2026-5545 · curl

    libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the…

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  49. Medium 5.9

    CVE-2026-4873 · curl

    A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  50. High 7.7

    CVE-2026-8336 · MongoDB

    After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service. This issue impacts MongoDB…

    Published 13 May 2026 · Fixed in 8.2.9, 8.3.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.