UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,962
Published in 7 days
848
Critical in 30 days
414
Actively exploited
420

Latest vulnerabilities

37,962 vulnerabilities
  1. Medium 6.9

    CVE-2025-7458 · SQLite

    An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a large number of expressions in the ORDER BY clause.

    Published 29 Jul 2025 · Fixed in 3.41.2 · NVD
  2. Medium 5.1

    CVE-2025-54388 · Docker Engine

    Firewalld reload makes published container ports accessible from remote hosts

    Published 29 Jul 2025 · Fixed in 28.3.3 · NVD, Project advisories (GitHub)
  3. Medium 5.2

    CVE-2025-54410 · Docker Engine

    Firewalld reload removes bridge network isolation

    Published 29 Jul 2025 · Fixed in 25.0.13 · NVD, Project advisories (GitHub)
  4. Medium 5.3

    CVE-2025-54425 · Umbraco CMS

    Delivery API allows for cached requests to be returned with an invalid API key

    Published 29 Jul 2025 · Fixed in 13.9.3, 15.4.4, 16.1.1 · NVD, Project advisories (GitHub)
  5. Medium 5.5

    CVE-2025-54538 · TeamCity

    In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command

    Published 28 Jul 2025 · Fixed in 2025.07 · NVD
  6. Medium 5.5

    CVE-2025-54537 · TeamCity

    In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots

    Published 28 Jul 2025 · Fixed in 2025.07 · NVD
  7. High 8.8

    CVE-2025-54536 · TeamCity

    In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint

    Published 28 Jul 2025 · Fixed in 2025.07 · NVD
  8. High 7.5

    CVE-2025-54535 · TeamCity

    In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms

    Published 28 Jul 2025 · Fixed in 2025.07 · NVD
  9. Medium 4.8

    CVE-2025-54534 · TeamCity

    In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page

    Published 28 Jul 2025 · Fixed in 2025.07 · NVD
  10. Medium 4.3

    CVE-2025-54533 · TeamCity

    In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration

    Published 28 Jul 2025 · Fixed in 2025.07 · NVD
  11. Medium 4.3

    CVE-2025-54532 · TeamCity

    In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies

    Published 28 Jul 2025 · Fixed in 2025.07 · NVD
  12. Critical 9.4

    CVE-2025-54531 · TeamCity

    In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows

    Published 28 Jul 2025 · Fixed in 2025.07 · NVD
  13. Critical 9.8

    CVE-2025-54530 · TeamCity

    In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions

    Published 28 Jul 2025 · Fixed in 2025.07 · NVD
  14. High 7.5

    CVE-2025-54529 · TeamCity

    In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration

    Published 28 Jul 2025 · Fixed in 2025.07 · NVD
  15. High 8.8

    CVE-2025-54528 · TeamCity

    In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow

    Published 28 Jul 2025 · Fixed in 2025.07 · NVD
  16. Medium 6.4

    CVE-2025-4566 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 28 Jul 2025 · Fixed in 3.30.3 · WPVulnerability
  17. Medium 5.4

    CVE-2025-3075 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 28 Jul 2025 · Fixed in 3.29.1 · NVD, WPVulnerability
  18. High 8.8

    CVE-2025-46198 · Grav

    Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img element

    Published 25 Jul 2025 · NVD
  19. Critical 9.8

    CVE-2025-46199 · Grav

    Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields

    Published 25 Jul 2025 · NVD
  20. Medium 6.1

    CVE-2025-45893 · OpenCart

    OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded JavaScript

    Published 25 Jul 2025 · NVD
  21. Medium 6.1

    CVE-2025-45892 · OpenCart

    OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor. The vulnerability arises because input in the blog's editor is not properly sanitized or escaped before being rendered. This allows attackers to inject malicious JavaScript code

    Published 25 Jul 2025 · NVD
  22. Medium 6.1

    CVE-2025-53084 · AVideo

    A cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

    Published 24 Jul 2025 · NVD
  23. Medium 6.1

    CVE-2025-50128 · AVideo

    A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

    Published 24 Jul 2025 · NVD
  24. Critical 9.8

    CVE-2025-48732 · AVideo

    An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can request a .phar file to trigger this vulnerability.

    Published 24 Jul 2025 · NVD
  25. Medium 5.4

    CVE-2025-47061 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 24 Jul 2025 · Fixed in 6.5.23.0, 2025.5 · NVD
  26. Medium 5.4

    CVE-2025-46996 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 24 Jul 2025 · Fixed in 6.5.23.0, 2025.5 · NVD
  27. Medium 5.4

    CVE-2025-46993 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 24 Jul 2025 · Fixed in 6.5.23.0, 2025.5 · NVD
  28. Medium 6.1

    CVE-2025-46410 · AVideo

    A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

    Published 24 Jul 2025 · NVD
  29. Critical 9.6

    CVE-2025-41420 · AVideo

    A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

    Published 24 Jul 2025 · NVD
  30. Critical 9.6

    CVE-2025-36548 · AVideo

    A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

    Published 24 Jul 2025 · NVD
  31. High 7.5

    CVE-2025-25214 · AVideo

    A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A series of specially crafted HTTP request can lead to arbitrary code execution.

    Published 24 Jul 2025 · NVD
  32. Low 2.7

    CVE-2025-7001 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed priviledged users to access certain resource_group information through the API which should have been unavailable.

    Published 24 Jul 2025 · Fixed in 18.0.5, 18.1.3 · NVD
  33. Medium 5.3

    CVE-2025-4976 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 17.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under certain circumstances, could have allowed an attacker to access internal notes in GitLab Duo responses.

    Published 24 Jul 2025 · Fixed in 18.0.5, 18.1.3 · NVD
  34. Medium 4.3

    CVE-2025-1299 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 18.0.5, all versions starting from 18.1 before 18.1.3, all versions starting from 18.2 before 18.2.1 that, under circumstances, could have allowed an unauthorized user to read deployment job logs by sending a crafted request.

    Published 24 Jul 2025 · Fixed in 18.0.5, 18.1.3 · NVD
  35. Medium 4.3

    CVE-2025-0765 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an unauthorized user to access custom service desk email addresses.

    Published 24 Jul 2025 · Fixed in 18.0.5, 18.1.3 · NVD
  36. Medium 6.1

    CVE-2025-4700 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under specific circumstances, could have potentially allowed a successful attacker to trigger unintended content rendering leading to XSS.

    Published 23 Jul 2025 · Fixed in 18.0.5, 18.1.3 · NVD
  37. Medium 5.4

    CVE-2025-4439 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an authenticated user to perform cross-site scripting attacks when the instance is served through certain content delivery networks.

    Published 23 Jul 2025 · Fixed in 18.0.5, 18.1.3 · NVD
  38. Medium 5.4

    CVE-2025-46171 · vBulletin

    vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum.

    Published 23 Jul 2025 · NVD
  39. Medium 6.3

    CVE-2025-54090 · Apache HTTP Server

    A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue.

    Published 23 Jul 2025 · NVD
  40. Medium 4.9

    CVE-2025-30086 · Harbor

    Possible ORM Leak Vulnerability in the Harbor

    Published 23 Jul 2025 · Fixed in 2.12.4 · Project advisories (GitHub)
  41. Medium 4.1

    CVE-2025-32019 · Harbor

    XSS vulnerability in the Harbor repository description

    Published 23 Jul 2025 · Fixed in 2.13.1 · Project advisories (GitHub)
  42. Medium 6.9

    CVE-2025-51471 · Ollama

    Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.

    Published 22 Jul 2025 · NVD
  43. High 7.1

    CVE-2025-53942 · authentik

    Insufficient check for account active status when authenticating with OAuth/SAML Sources

    Published 22 Jul 2025 · Fixed in 2025.4.4, 2025.6.4 · NVD, Project advisories (GitHub)
  44. Medium 5.3

    CVE-2025-7900 · TYPO3

    The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0

    Published 22 Jul 2025 · NVD
  45. Medium 6.7

    GHSA-49xw-hw94-fmv2 · Dolibarr ERP CRM

    Dolibarr has Remote Code Execution Vulnerability (Bypass)

    Published 19 Jul 2025 · Project advisories (GitHub)
  46. Critical 9.8Actively exploited

    CVE-2025-54309 · CrushFTP

    CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

    Published 18 Jul 2025 · Fixed in 10.8.5, 11.3.4_23 · NVD
  47. Low 3.1

    CVE-2025-6227 · Mattermost

    Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.

    Published 18 Jul 2025 · Fixed in 9.11.17, 10.5.8 · NVD
  48. Medium 4.9

    CVE-2025-6233 · Mattermost

    Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal.

    Published 18 Jul 2025 · Fixed in 10.5.8, 10.7.4, 10.8.2 · NVD
  49. Medium 6.5

    CVE-2025-6226 · Mattermost

    Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.

    Published 18 Jul 2025 · Fixed in 10.5.7, 10.7.4, 10.8.2 · NVD
  50. Medium 6.7

    CVE-2024-27779 · Fortinet FortiSandbox

    An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a remote attacker in possession of an admin session cookie to keep using that admin's…

    Published 18 Jul 2025 · Fixed in 4.2.7, 4.4.5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.