UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,963
Published in 7 days
849
Critical in 30 days
413
Actively exploited
420

Latest vulnerabilities

37,963 vulnerabilities
  1. High 8.6

    CVE-2025-50059 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows…

    Published 15 Jul 2025 · NVD
  2. High 7.5

    CVE-2025-30762 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to…

    Published 15 Jul 2025 · NVD
  3. Medium 4.8

    CVE-2025-30754 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows…

    Published 15 Jul 2025 · NVD
  4. Medium 6.5

    CVE-2025-30753 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 15 Jul 2025 · NVD
  5. Low 3.7

    CVE-2025-30752 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle Java SE: 24.0.1; Oracle GraalVM for JDK: 24.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK. Successful attacks of this…

    Published 15 Jul 2025 · NVD
  6. High 8.1

    CVE-2025-30749 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows…

    Published 15 Jul 2025 · NVD
  7. High 7.7

    CVE-2025-53895 · ZITADEL

    Broken authN and authZ in session API and resulting session tokens

    Published 15 Jul 2025 · Fixed in 2.70.14, 2.71.13, 3.3.1 · NVD, Project advisories (GitHub)
  8. High 7.2

    CVE-2025-6965 · SQLite

    There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.

    Published 15 Jul 2025 · Fixed in 3.50.2 · NVD
  9. Medium 6.7

    CVE-2025-24477 · Fortinet FortiOS

    A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.4 through 7.2.12 allows an attacker to escalate its privileges via a specially crafted CLI command

    Published 15 Jul 2025 · Fixed in 7.2.12, 7.4.8, 7.6.3 · NVD
  10. High

    CVE-2025-27210 · Node.js

    Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

    Published 15 Jul 2025 · Fixed in 20.19.4, 22.17.1, 24.4.1 · nodejs
  11. High

    CVE-2025-27209 · Node.js

    HashDoS in V8

    Published 15 Jul 2025 · Fixed in 24.4.1 · nodejs
  12. Critical 9.8

    CVE-2025-53101 · ImageMagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through…

    Published 14 Jul 2025 · Fixed in 6.9.13-26, 7.1.2-0 · NVD
  13. High 7.5

    CVE-2025-53019 · ImageMagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue.

    Published 14 Jul 2025 · Fixed in 6.9.13-26, 7.1.2-0 · NVD
  14. High 7.5

    CVE-2025-53015 · ImageMagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue.

    Published 14 Jul 2025 · Fixed in 7.1.2-0 · NVD
  15. Medium 6.5

    CVE-2025-53889 · Directus

    Missing permission checks for manual trigger Flows

    Published 14 Jul 2025 · Fixed in 11.9.0 · NVD, Project advisories (GitHub)
  16. Critical 9.8

    CVE-2025-53014 · ImageMagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix…

    Published 14 Jul 2025 · Fixed in 6.9.13-26, 7.1.2-0 · NVD
  17. Medium 5.3

    CVE-2025-53887 · Directus

    Directus version number disclosure

    Published 14 Jul 2025 · Fixed in 11.9.0 · NVD, Project advisories (GitHub)
  18. Medium 4.5

    CVE-2025-53886 · Directus

    Tokens are not redacted in Flow logs

    Published 14 Jul 2025 · Fixed in 11.9.0 · NVD, Project advisories (GitHub)
  19. Medium 4.2

    CVE-2025-53885 · Directus

    Sensitive user data is not being redacted when logged via event hooks

    Published 14 Jul 2025 · Fixed in 11.9.0 · NVD, Project advisories (GitHub)
  20. Critical 9.8

    CVE-2025-53825 · Dokploy

    Preview Deployments are vulnerable to Remote Code Execution

    Published 14 Jul 2025 · Fixed in 0.24.3 · NVD, Project advisories (GitHub)
  21. High 7.5

    CVE-2025-1735 · PHP

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.

    Published 13 Jul 2025 · Fixed in 8.2.29, 8.3.23, 8.4.10 · NVD
  22. Medium 5.3

    CVE-2025-1220 · PHP

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using…

    Published 13 Jul 2025 · Fixed in 8.2.29, 8.3.23, 8.4.10 · NVD
  23. Medium 5.9

    CVE-2025-6491 · PHP

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.

    Published 13 Jul 2025 · Fixed in 8.2.29, 8.3.23, 8.4.10 · NVD
  24. High 7.5

    CVE-2025-53506 · Apache Tomcat

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be…

    Published 10 Jul 2025 · NVD
  25. High 7.5

    CVE-2025-52520 · Apache Tomcat

    For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through…

    Published 10 Jul 2025 · Fixed in 9.0.107, 10.1.43, 11.0.9 · NVD
  26. High 7.5

    CVE-2025-52434 · Apache Tomcat

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be…

    Published 10 Jul 2025 · Fixed in 9.0.107 · NVD
  27. High 7.5

    CVE-2025-53020 · Apache HTTP Server

    Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  28. High 7.4

    CVE-2025-49812 · Apache HTTP Server

    In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  29. High 7.5

    CVE-2025-49630 · Apache HTTP Server

    In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  30. Medium 4.3Actively exploited

    CVE-2025-47813 · Wing FTP Server

    loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.

    Published 10 Jul 2025 · Fixed in 7.4.4 · NVD
  31. Critical 10.0Actively exploited

    CVE-2025-47812 · Wing FTP Server

    In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also…

    Published 10 Jul 2025 · Fixed in 7.4.4 · NVD
  32. Medium 6.6

    CVE-2025-47811 · Wing FTP Server

    In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application itself offers several legitimate ways to execute arbitrary system commands (i.e., through the web console or the task scheduler), and they are automatically executed in the highest possible privilege context. Because administrative users of…

    Published 10 Jul 2025 · Fixed in 7.4.4 · NVD
  33. High 8.8

    CVE-2025-27889 · Wing FTP Server

    Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker.

    Published 10 Jul 2025 · Fixed in 7.4.4 · NVD
  34. Critical 9.1

    CVE-2025-23048 · Apache HTTP Server

    In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a…

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  35. High 7.5

    CVE-2024-47252 · Apache HTTP Server

    Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or…

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  36. High 7.5

    CVE-2024-43394 · Apache HTTP Server

    Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via  mod_rewrite or apache expressions that pass unvalidated request input. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63. Note:  The Apache HTTP Server Project will be setting a higher bar for accepting vulnerability reports regarding SSRF via UNC…

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  37. High 7.5

    CVE-2024-43204 · Apache HTTP Server

    SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request. Users are recommended to upgrade to version 2.4.64 which fixes this issue.

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  38. High 7.5

    CVE-2024-42516 · Apache HTTP Server

    HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response. This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue. Users are recommended to upgrade to version 2.4.64, which…

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  39. High 8.0

    CVE-2025-6948 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.

    Published 10 Jul 2025 · Fixed in 17.11.6, 18.0.4, 18.1.2 · NVD
  40. Low 2.7

    CVE-2025-6168 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests.

    Published 10 Jul 2025 · Fixed in 18.0.4, 18.1.2 · NVD
  41. Low 2.7

    CVE-2025-4972 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated users with invitation privileges to bypass group-level user invitation restrictions by manipulating group invitation functionality.

    Published 10 Jul 2025 · Fixed in 18.0.4, 18.1.2 · NVD
  42. Medium 4.3

    CVE-2025-3396 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that could have allowed authenticated project owners to bypass group-level forking restrictions by manipulating API requests.

    Published 10 Jul 2025 · Fixed in 17.11.6, 18.0.4, 18.1.2 · NVD
  43. Medium 5.4

    CVE-2025-49547 · Adobe Experience Manager

    Adobe Experience Manager versions FP11.4 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Scope is changed.

    Published 8 Jul 2025 · NVD
  44. Medium 5.4

    CVE-2025-49534 · Adobe Experience Manager

    Adobe Experience Manager versions FP11.4 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Scope is changed.

    Published 8 Jul 2025 · NVD
  45. Critical 9.8

    CVE-2025-49533 · Adobe Experience Manager

    Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction. Scope is unchanged.

    Published 8 Jul 2025 · NVD
  46. High 8.8

    CVE-2025-49551 · Adobe ColdFusion

    ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Use of Hard-coded Credentials vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized access to sensitive systems or data. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses.

    Published 8 Jul 2025 · NVD
  47. Low 2.4

    CVE-2025-49546 · Adobe ColdFusion

    ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Access Control vulnerability that could lead to a partial application denial-of-service. A high-privileged attacker could exploit this vulnerability to partially disrupt the availability of the application. Exploitation of this issue does not require user interaction and scope is unchanged. The vulnerable…

    Published 8 Jul 2025 · NVD
  48. Medium 6.2

    CVE-2025-49545 · Adobe ColdFusion

    ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privilege authenticated attacker can force the application to make arbitrary requests via injection of URLs. Exploitation of this issue does not require user interaction and scope is changed. The vulnerable component is…

    Published 8 Jul 2025 · NVD
  49. Medium 6.8

    CVE-2025-49544 · Adobe ColdFusion

    ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or bypass security measures. Exploitation of this issue does not require user interaction and scope is…

    Published 8 Jul 2025 · NVD
  50. Medium 4.3

    CVE-2025-49543 · Adobe ColdFusion

    ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, scope is changed. The vulnerable component is…

    Published 8 Jul 2025 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.