UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,963
Published in 7 days
849
Critical in 30 days
413
Actively exploited
420

Latest vulnerabilities

37,963 vulnerabilities
  1. Medium 5.2

    CVE-2025-49542 · Adobe ColdFusion

    ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser, scope is changed. The vulnerable component is restricted to internal IP…

    Published 8 Jul 2025 · NVD
  2. Medium 4.3

    CVE-2025-49541 · Adobe ColdFusion

    ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, scope is changed. The vulnerable component is…

    Published 8 Jul 2025 · NVD
  3. Medium 4.3

    CVE-2025-49540 · Adobe ColdFusion

    ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, scope is changed. The vulnerable component is…

    Published 8 Jul 2025 · NVD
  4. Medium 4.5

    CVE-2025-49539 · Adobe ColdFusion

    ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to…

    Published 8 Jul 2025 · NVD
  5. High 7.4

    CVE-2025-49538 · Adobe ColdFusion

    ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An attacker can exploit this issue by injecting crafted XML or XPath queries to access unauthorized files or lead to denial of service. Exploitation of this issue does not require user interaction, and attack must have access to shared secrets.

    Published 8 Jul 2025 · NVD
  6. High 7.9

    CVE-2025-49537 · Adobe ColdFusion

    ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.

    Published 8 Jul 2025 · NVD
  7. High 7.3

    CVE-2025-49536 · Adobe ColdFusion

    ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP…

    Published 8 Jul 2025 · NVD
  8. Critical 9.3

    CVE-2025-49535 · Adobe ColdFusion

    ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access sensitive information or denial of service by bypassing security measures. Exploitation of this issue does not require user interaction and…

    Published 8 Jul 2025 · NVD
  9. High 7.5

    CVE-2025-49719 · Microsoft SQL Server

    Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.

    Published 8 Jul 2025 · Fixed in 15.0.4435.7, 16.0.1140.6, 16.0.4200.1 · NVD
  10. High 7.5

    CVE-2025-49718 · Microsoft SQL Server

    Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.

    Published 8 Jul 2025 · Fixed in 15.0.4435.7, 16.0.1140.6, 16.0.4200.1 · NVD
  11. High 8.5

    CVE-2025-49717 · Microsoft SQL Server

    Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

    Published 8 Jul 2025 · Fixed in 15.0.4435.7, 16.0.1140.6, 16.0.4200.1 · NVD
  12. Medium 5.5

    CVE-2025-5464 · Ivanti Connect Secure

    Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to obtain that information.

    Published 8 Jul 2025 · Fixed in 22.7 · NVD
  13. Low 2.7

    CVE-2025-0293 · Ivanti Connect Secure

    CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to write to a protected configuration file on disk.

    Published 8 Jul 2025 · Fixed in 22.7 · NVD
  14. Medium 4.9

    CVE-2025-0292 · Ivanti Connect Secure

    SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to access internal network services.

    Published 8 Jul 2025 · Fixed in 22.7 · NVD
  15. Medium 5.5

    CVE-2025-5463 · Ivanti Connect Secure

    Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a local authenticated attacker to obtain that information.

    Published 8 Jul 2025 · Fixed in 22.7 · NVD
  16. Medium 4.9

    CVE-2025-5451 · Ivanti Connect Secure

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to trigger a denial of service.

    Published 8 Jul 2025 · Fixed in 22.7 · NVD
  17. Low 2.7

    CVE-2025-5450 · Ivanti Connect Secure

    Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated admin with read-only rights to modify settings that should be restricted.

    Published 8 Jul 2025 · Fixed in 22.7 · NVD
  18. Medium 5.3

    CVE-2024-55599 · Fortinet FortiProxy, Fortinet FortiOS

    An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versions and FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions may allow a remote unauthenticated user to bypass the DNS filter via Apple devices.

    Published 8 Jul 2025 · Fixed in 7.4.8, 7.4.9, 7.6.2 · NVD
  19. High 7.2

    CVE-2024-52965 · Fortinet FortiProxy, Fortinet FortiOS

    A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.

    Published 8 Jul 2025 · Fixed in 7.4.6, 7.4.9, 7.6.2 · NVD
  20. Medium 5.3

    CVE-2025-20325 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the software potentially exposes the search head cluster [splunk.secret](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/install-splunk-enterprise-securely/deploy-secure-passwords-across-multiple-servers)…

    Published 7 Jul 2025 · Fixed in 9.2.7, 9.3.5, 9.4.3 · NVD
  21. Medium 5.4

    CVE-2025-20324 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create or overwrite [system source type](https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.2/configure-source-types/create-source-types)…

    Published 7 Jul 2025 · Fixed in 9.2.7, 9.3.5, 9.4.2 · NVD
  22. Medium 4.3

    CVE-2025-20323 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could turn off the scheduled search `Bucket Copy Trigger` within the Splunk Archiver application. This is because of missing access controls in the saved searches for this app.

    Published 7 Jul 2025 · Fixed in 9.2.7, 9.3.5, 9.4.3 · NVD
  23. Medium 4.3

    CVE-2025-20322 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, an unauthenticated attacker could send a specially-crafted SPL search command that could trigger a rolling restart in the Search Head Cluster through a Cross-Site Request Forgery (CSRF), potentially leading to a denial of service…

    Published 7 Jul 2025 · Fixed in 9.2.7, 9.3.5, 9.4.3 · NVD
  24. Medium 4.3

    CVE-2025-20321 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and 9.2.2406.119, an unauthenticated attacker can send a specially-crafted SPL search that could change the membership state in a Splunk Search Head Cluster (SHC) through a Cross-Site Request Forgery (CSRF), potentially leading to the removal of the captain or…

    Published 7 Jul 2025 · Fixed in 9.2.7, 9.3.5, 9.4.3 · NVD
  25. High 7.3

    CVE-2025-20320 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the `User Interface - Views` configuration page that could potentially lead to a denial of service (DoS).The user could cause…

    Published 7 Jul 2025 · Fixed in 9.2.7, 9.3.5, 9.4.3 · NVD
  26. Medium 6.8

    CVE-2025-20319 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a user who holds a role that contains the high-privilege capability `edit_scripted` and `list_inputs` capability , could perform a remote command execution due to improper user input sanitization on the scripted input files.<br><br>See [Define roles on the Splunk platform with…

    Published 7 Jul 2025 · Fixed in 9.2.7, 9.3.5, 9.4.3 · NVD
  27. Medium 4.3

    CVE-2025-20300 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.6, and 9.1.9 and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles, and has read-only access to a specific alert, could suppress that alert when it triggers. See [Define alert suppression groups to throttle sets of similar…

    Published 7 Jul 2025 · Fixed in 9.2.6, 9.3.5, 9.4.2 · NVD
  28. Medium 6.5

    CVE-2025-7259 · MongoDB

    An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can only be triggered by authorized users and cause Denial of Service. This issue affects MongoDB Server v8.1 version 8.1.0.

    Published 7 Jul 2025 · NVD
  29. High 7.5

    CVE-2025-48367 · Redis

    Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19.

    Published 7 Jul 2025 · Fixed in 7.2.10, 7.4.5, 8.0.3 · NVD
  30. High 7.5

    CVE-2025-6714 · MongoDB

    MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured with load balancer support. This issue affects MongoDB Server v6.0 prior to 6.0.23, MongoDB Server v7.0 prior to 7.0.20 and MongoDB Server v8.0 prior to 8.0.9 Required Configuration: This affects MongoDB sharded clusters when configured…

    Published 7 Jul 2025 · Fixed in 6.0.23, 7.0.20, 8.0.9 · NVD
  31. Medium 6.5

    CVE-2025-6713 · MongoDB

    An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This issue affects MongoDB Server MongoDB Server v8.0 versions prior to 8.0.7, MongoDB Server v7.0 versions prior to 7.0.19 and MongoDB Server…

    Published 7 Jul 2025 · Fixed in 6.0.22, 7.0.19, 8.0.7 · NVD
  32. Medium 6.5

    CVE-2025-6712 · MongoDB

    MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in memory management related to internal operations. In scenarios where certain internal processes persist longer than anticipated, memory consumption can increase, potentially impacting server stability and availability. This issue affects…

    Published 7 Jul 2025 · Fixed in 8.0.10 · NVD
  33. Medium 4.9

    CVE-2025-6711 · MongoDB

    An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered. This issue affects MongoDB Server v8.0 versions prior to 8.0.5, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v6.0 versions prior to 6.0.21.

    Published 7 Jul 2025 · Fixed in 6.0.21, 7.0.18, 8.0.5 · NVD
  34. Medium 5.4

    CVE-2025-3467 · Dify

    An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This vulnerability allows an attacker to obtain the administrator's token by sending a payload in the published chat. When the administrator views the conversation content through the monitoring/log function using Firefox, the XSS vulnerability is triggered, potentially exposing…

    Published 7 Jul 2025 · Fixed in 1.1.3 · NVD
  35. High 7.2

    CVE-2025-3466 · Dify

    langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. The vulnerability arises from the ability to override global functions in JavaScript, such as parseInt, before sandbox security restrictions are imposed. This can lead to unauthorized access to secret keys, internal network servers, and…

    Published 7 Jul 2025 · Fixed in 1.1.3 · NVD
  36. High 7.0

    GHSA-2r7g-8hpc-rpq9 · Redis

    Multi-bulk commands sent by clients can lead to DoS

    Published 6 Jul 2025 · Project advisories (GitHub)
  37. High 7.8

    CVE-2025-32023 · Redis

    Out of bounds write in hyperloglog commands leads to RCE

    Published 6 Jul 2025 · Fixed in 8.0.3, 8.2.0, 8.4.0 · NVD, Project advisories (GitHub)
  38. High 7.8

    CVE-2025-27446 · Apache APISIX

    Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0. Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.

    Published 6 Jul 2025 · NVD
  39. Low 1.3

    CVE-2025-53374 · Dokploy

    User Information Disclosure via user.one Endpoint

    Published 5 Jul 2025 · Fixed in 0.23.6, 0.23.7 · NVD, Project advisories (GitHub)
  40. Medium 4.9

    CVE-2025-53375 · Dokploy

    An authenticated attacker can read any file that the Traefik process user can access (e.g., /etc/passwd

    Published 5 Jul 2025 · Fixed in 0.23.6, 0.23.7 · NVD, Project advisories (GitHub)
  41. Medium 6.3

    CVE-2025-53376 · Dokploy

    An authenticated, low-privileged user without belonging to any organisation can run arbitrary OS commands on the Dokploy host.

    Published 5 Jul 2025 · Fixed in 0.23.6, 0.23.7 · NVD, Project advisories (GitHub)
  42. Low 3.7

    CVE-2025-49005 · Next.js

    Next.js has a Cache poisoning vulnerability due to omission of the Vary header

    Published 3 Jul 2025 · Fixed in 15.3.3 · OSV.dev and GitHub
  43. Medium 4.9

    CVE-2025-52554 · n8n

    n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n. An authenticated user can stop workflow executions that they do not own or that have not been shared with them, leading to potential business disruption. This issue has been patched in version 1.99.1. A workaround involves restricting…

    Published 3 Jul 2025 · Fixed in 1.99.1 · NVD
  44. Medium 5.4

    CVE-2025-45809 · LiteLLM

    SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints.

    Published 3 Jul 2025 · NVD
  45. Medium 4.9

    CVE-2025-49595 · n8n

    n8n is a workflow automation platform. Prior to version 1.99.0, there is a denial of Service vulnerability in /rest/binary-data endpoint when processing empty filesystem URIs (filesystem:// or filesystem-v2://). This allows authenticated attackers to cause service unavailability through malformed filesystem URI requests, effecting the /rest/binary-data endpoint and n8n.cloud instances (confirmed…

    Published 3 Jul 2025 · Fixed in 1.99.0 · NVD
  46. Medium 5.3

    CVE-2025-46647 · Apache APISIX

    A vulnerability of plugin openid-connect in Apache APISIX. This vulnerability will only have an impact if all of the following conditions are met: 1. Use the openid-connect plugin with introspection mode 2. The auth service connected to openid-connect provides services to multiple issuers 3. Multiple issuers share the same private key and relies only on the issuer being different If affected by…

    Published 2 Jul 2025 · Fixed in 3.12.0 · NVD
  47. Medium 6.5

    CVE-2025-52891 · ModSecurity

    Empty XML tag causes segmentation fault

    Published 1 Jul 2025 · Fixed in 2.9.11 · Project advisories (GitHub)
  48. High 7.8Actively exploited

    CVE-2025-32463 · sudo

    Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

    Published 30 Jun 2025 · Fixed in 1.9.17 · NVD
  49. High 8.8

    CVE-2025-32462 · sudo

    Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.

    Published 30 Jun 2025 · Fixed in 1.9.17 · NVD
  50. Medium 5.5

    CVE-2025-53099 · Sentry

    Missing Invalidation of Authorization Codes During OAuth Exchange and Revocation

    Published 30 Jun 2025 · Fixed in 25.5.0 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.