UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,965
Published in 7 days
843
Critical in 30 days
413
Actively exploited
420

Latest vulnerabilities

37,965 vulnerabilities
  1. High 8.8

    CVE-2025-32462 · sudo

    Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.

    Published 30 Jun 2025 · Fixed in 1.9.17 · NVD
  2. Medium 5.5

    CVE-2025-53099 · Sentry

    Missing Invalidation of Authorization Codes During OAuth Exchange and Revocation

    Published 30 Jun 2025 · Fixed in 25.5.0 · NVD, Project advisories (GitHub)
  3. Medium 5.4

    CVE-2025-47871 · Mattermost

    Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly validate channel membership when retrieving playbook run metadata, allowing authenticated users who are playbook members but not channel members to access sensitive information about linked private channels including channel name, display name, and participant count…

    Published 30 Jun 2025 · Fixed in 10.5.6, 10.6.6, 10.7.3 · NVD
  4. Medium 5.4

    CVE-2025-46702 · Mattermost

    Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions when adding participants to playbook runs. This allows authenticated users with member-level permissions to bypass system admin restrictions and add or remove users to/from private channels via the playbook run participants…

    Published 30 Jun 2025 · Fixed in 10.5.6, 10.6.6, 10.7.3 · NVD
  5. High 8.7

    CVE-2025-52898 · Frappe Framework

    Account takeover via password reset token leakage

    Published 30 Jun 2025 · Fixed in 14.94.3, 15.58.0 · NVD, Project advisories (GitHub)
  6. High 8.6

    CVE-2025-52896 · Frappe Framework

    Authenticated XSS via data import

    Published 30 Jun 2025 · Fixed in 14.94.2, 15.57.0 · NVD, Project advisories (GitHub)
  7. High 8.7

    CVE-2025-52895 · Frappe Framework

    Possibility of SQL injection due to improper validations

    Published 30 Jun 2025 · Fixed in 14.94.3, 15.58.0 · NVD, Project advisories (GitHub)
  8. Medium 5.5

    CVE-2025-52553 · authentik

    Insufficient Session verification for Remote Access Control endpoint access

    Published 27 Jun 2025 · Fixed in 2025.4.3, 2025.6.3 · NVD, Project advisories (GitHub)
  9. Medium 4.3

    CVE-2025-53193 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Cross-Site Request Forgery (CSRF)

    Published 27 Jun 2025 · Fixed in 2.0.8 · WPVulnerability
  10. Medium 5.4

    CVE-2025-49592 · n8n

    n8n is a workflow automation platform. Versions prior to 1.98.0 have an Open Redirect vulnerability in the login flow. Authenticated users can be redirected to untrusted, attacker-controlled domains after logging in, by crafting malicious URLs with a misleading redirect query parameter. This may lead to phishing attacks by impersonating the n8n UI on lookalike domains (e.g., n8n.local.evil.com),…

    Published 26 Jun 2025 · Fixed in 1.98.0 · NVD
  11. Medium 6.1

    CVE-2025-44141 · Backdrop CMS

    A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.

    Published 26 Jun 2025 · NVD
  12. High 7.5

    CVE-2025-6710 · MongoDB

    MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the server to crash which could occur pre-authorisation. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and…

    Published 26 Jun 2025 · Fixed in 6.0.21, 7.0.17, 8.0.5 · NVD
  13. High 7.5

    CVE-2025-6709 · MongoDB

    The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using the mongo shell to send a malicious JSON payload leading to an invariant failure and server crash. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior…

    Published 26 Jun 2025 · Fixed in 6.0.21, 7.0.17, 8.0.5 · NVD
  14. Medium 5.4

    CVE-2025-6707 · MongoDB

    Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5.

    Published 26 Jun 2025 · Fixed in 6.0.24, 7.0.21, 8.0.5 · NVD
  15. High 8.8

    CVE-2025-6706 · MongoDB

    An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific combination of rarely-used aggregation pipeline expressions. This issue affects MongoDB Server v6.0…

    Published 26 Jun 2025 · Fixed in 6.0.21, 7.0.17, 8.0.4 · NVD
  16. Medium 4.3

    CVE-2025-5846 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to assign unrelated compliance frameworks to projects by sending crafted GraphQL mutations that bypassed framework-specific permission checks.

    Published 26 Jun 2025 · Fixed in 17.11.5, 18.0.3 · NVD
  17. Medium 4.3

    CVE-2025-5315 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users with Guest role permissions to add child items to incident work items by sending crafted API requests that bypassed UI-enforced role restrictions.

    Published 26 Jun 2025 · Fixed in 17.11.5, 18.0.3 · NVD
  18. Medium 6.5

    CVE-2025-3279 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated attackers to create a DoS condition by sending crafted GraphQL requests.

    Published 26 Jun 2025 · Fixed in 17.11.5, 18.0.3 · NVD
  19. High 8.8

    CVE-2025-2938 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants.

    Published 26 Jun 2025 · Fixed in 17.11.5, 18.0.3 · NVD
  20. Medium 5.3

    CVE-2025-1754 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed unauthenticated attackers to upload arbitrary files to public projects by sending crafted API requests, potentially leading to resource abuse and unauthorized content storage.

    Published 26 Jun 2025 · Fixed in 17.11.5, 18.0.3 · NVD
  21. High 7.2

    CVE-2025-6443 · MikroTik RouterOS

    Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of remote IP addresses when processing VXLAN traffic. The issue results from the lack of…

    Published 25 Jun 2025 · Fixed in 7.20 · NVD
  22. Critical 9.8

    CVE-2025-36038 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.

    Published 25 Jun 2025 · Fixed in 8.5.5.28, 9.0.5.25 · NVD
  23. Medium 4.3

    CVE-2025-49550 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access. Exploitation of this issue requires user interaction.

    Published 25 Jun 2025 · Fixed in 2.4.4, 2.4.5 · NVD
  24. Low 2.7

    CVE-2025-49549 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access. Exploitation of this issue does not require user interaction.

    Published 25 Jun 2025 · Fixed in 2.4.4, 2.4.5 · NVD
  25. Low 3.1

    CVE-2025-4656 · HashiCorp Vault

    Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.

    Published 25 Jun 2025 · Fixed in 1.18.11, 1.19.6, 1.20.0 · NVD
  26. Medium 6.3

    CVE-2025-49845 · Discourse

    Discourse is an open-source discussion platform. The visibility of posts typed `whisper` is controlled via the `whispers_allowed_groups` site setting. Only users that belong to groups specified in the site setting are allowed to view posts typed `whisper`. However, it has been discovered that users of versions prior to 3.4.6 on the `stable` branch and prior to 3.5.0.beta8-dev on the…

    Published 25 Jun 2025 · Fixed in 3.4.6 · NVD
  27. Medium 4.5

    CVE-2025-52893 · OpenBao

    May Leak Sensitive Information in Logs When Processing Malformed Data

    Published 25 Jun 2025 · Fixed in 2.3.0 · NVD, Project advisories (GitHub)
  28. Medium 6.9

    CVE-2025-52894 · OpenBao

    Unauthenticated Rekey Operation Cancellation

    Published 25 Jun 2025 · Fixed in 2.3.0 · NVD, Project advisories (GitHub)
  29. Medium 6.1

    CVE-2025-48954 · Discourse

    Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled.

    Published 25 Jun 2025 · Fixed in 3.5.0 · NVD
  30. Low 3.4

    CVE-2025-52889 · Incus

    DoS through antispoofing nftables firewall rule bypass on bridge networks with ACLs

    Published 25 Jun 2025 · Fixed in 6.14.0 · Project advisories (GitHub)
  31. High 8.1

    CVE-2025-52890 · Incus

    Antispoofing nftables firewall rule bypass on bridge networks with ACLs

    Published 25 Jun 2025 · Project advisories (GitHub)
  32. Critical 9.2Actively exploited

    CVE-2025-6543 · NetScaler ADC and Gateway

    Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

    Published 25 Jun 2025 · Fixed in 13.1-37.236, 13.1-59.19, 14.1-47.46 · NVD
  33. Medium 5.4

    CVE-2025-25012 · Kibana

    URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.

    Published 25 Jun 2025 · Fixed in 8.17.8, 8.18.3, 9.0.3 · NVD
  34. Medium 4.2

    CVE-2025-53021 · Moodle

    A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases…

    Published 24 Jun 2025 · NVD
  35. Medium 5.3

    CVE-2025-49147 · Umbraco CMS

    Disclosure of Configured Password Requirements

    Published 24 Jun 2025 · Fixed in 10.8.11, 13.9.2 · NVD, Project advisories (GitHub)
  36. Critical 9.8

    CVE-2024-56731 · Gogs

    Deletion of internal files allows remote command execution

    Published 24 Jun 2025 · Fixed in 0.13.3 · NVD, Project advisories (GitHub)
  37. Medium 6.3

    CVE-2025-47943 · Gogs

    Stored XSS in PDF renderer

    Published 24 Jun 2025 · Fixed in 0.13.3 · Project advisories (GitHub)
  38. Medium 4.8

    CVE-2025-52879 · TeamCity

    In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible

    Published 23 Jun 2025 · Fixed in 2025.03.3 · NVD
  39. Medium 4.3

    CVE-2025-52878 · TeamCity

    In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions

    Published 23 Jun 2025 · Fixed in 2025.03.3 · NVD
  40. Medium 4.8

    CVE-2025-52877 · TeamCity

    In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible

    Published 23 Jun 2025 · Fixed in 2025.03.3 · NVD
  41. Medium 5.4

    CVE-2025-52876 · TeamCity

    In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible

    Published 23 Jun 2025 · Fixed in 2025.03.3 · NVD
  42. Medium 5.4

    CVE-2025-52875 · TeamCity

    In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible

    Published 23 Jun 2025 · Fixed in 2025.03.3 · NVD
  43. Medium 6.1Actively exploited

    CVE-2025-48700 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted…

    Published 23 Jun 2025 · Fixed in 10.0.12, 10.1.4 · NVD
  44. Low 3.1

    CVE-2023-5600 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. Arbitrary access to the titles of an private specific references could be leaked through the service-desk custom email template.

    Published 20 Jun 2025 · Fixed in 16.3.6, 16.4.2 · NVD
  45. High 8.1

    CVE-2024-4994 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions starting from 17.1.0 before 17.1.1 which allowed for a CSRF attack on GitLab's GraphQL API leading to the execution of arbitrary GraphQL mutations.

    Published 20 Jun 2025 · Fixed in 16.11.5, 17.0.3 · NVD
  46. High 7.5

    CVE-2024-4025 · GitLab

    A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions from 7.10 prior before 16.11.5, version 17.0 before 17.0.3, and 17.1 before 17.1.1. It is possible for an attacker to cause a denial of service using a crafted markdown page.

    Published 20 Jun 2025 · Fixed in 16.11.5, 17.0.3 · NVD
  47. Critical 9.9

    CVE-2025-5121 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.4 and 18.0 before 18.0.2. A missing authorization check may have allowed compliance frameworks to be applied to projects outside the compliance framework's group.

    Published 20 Jun 2025 · Fixed in 17.11.4, 18.0.2 · NVD
  48. Medium 6.1

    CVE-2025-2443 · GitLab

    An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

    Published 20 Jun 2025 · Fixed in 17.9.7, 17.10.5 · NVD
  49. Medium 4.3

    CVE-2025-3228 · Mattermost

    Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from playbooks handler for guest users which allows an attacker access to the playbook run.

    Published 20 Jun 2025 · Fixed in 10.5.6, 10.6.6, 10.7.3 · NVD
  50. Medium 4.3

    CVE-2025-3227 · Mattermost

    Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a…

    Published 20 Jun 2025 · Fixed in 10.5.6, 10.6.6, 10.7.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.