UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,965
Published in 7 days
835
Critical in 30 days
413
Actively exploited
420

Latest vulnerabilities

37,965 vulnerabilities
  1. High 7.5

    CVE-2024-7586 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.

    Published 20 Jun 2025 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  2. Critical 9.9

    CVE-2025-4981 · Mattermost

    Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts…

    Published 20 Jun 2025 · Fixed in 10.5.6, 10.6.6, 10.7.3 · NVD
  3. High 8.6

    CVE-2025-52488 · DNN Platform

    NTLM hash leakage via SMB Share Interaction with malicious user input

    Published 20 Jun 2025 · Fixed in 10.0.1 · NVD, Project advisories (GitHub)
  4. High 8.8

    CVE-2025-52487 · DNN Platform

    Possibly bypass of IP Filters

    Published 20 Jun 2025 · Fixed in 10.0.1 · NVD, Project advisories (GitHub)
  5. Medium 6.1

    CVE-2025-52486 · DNN Platform

    Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects

    Published 20 Jun 2025 · Fixed in 10.0.1 · NVD, Project advisories (GitHub)
  6. Medium 5.1

    CVE-2025-52485 · DNN Platform

    Stored Cross-Site Scripting (XSS) in Activity Feed

    Published 20 Jun 2025 · Fixed in 10.0.1 · NVD, Project advisories (GitHub)
  7. High 7.5

    CVE-2025-49763 · Apache Traffic Server

    ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10. Users are recommended to upgrade to version 9.2.11 or 10.0.6, which…

    Published 19 Jun 2025 · Fixed in 9.2.11, 10.0.6 · NVD
  8. High 7.5

    CVE-2025-31698 · Apache Traffic Server

    ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol.  This issue affects undefined: from 10.0.0 through 10.0.6, from 9.0.0 through 9.2.10. Users are recommended to…

    Published 19 Jun 2025 · Fixed in 9.2.11, 10.0.6 · NVD
  9. Medium 4.9

    CVE-2025-24286 · Veeam Backup & Replication

    A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code.

    Published 19 Jun 2025 · Fixed in 12.3.2.3617 · NVD
  10. High 8.8

    CVE-2025-23121 · Veeam Backup & Replication

    A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user

    Published 19 Jun 2025 · Fixed in 12.3.2.3617 · NVD
  11. Medium 5.9

    CVE-2025-52710 · Filester (WordPress plugin)

    File Manager Pro – Filester: Cross-site Scripting

    Published 19 Jun 2025 · Fixed in 1.8.9 · WPVulnerability
  12. Medium 6.5

    CVE-2024-50555 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 19 Jun 2025 · Fixed in 3.29.1 · WPVulnerability
  13. Critical 9.8

    CVE-2025-20260 · ClamAV

    A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting…

    Published 18 Jun 2025 · Fixed in 1.0.9, 1.4.3 · NVD
  14. High 7.5

    CVE-2025-20234 · ClamAV

    A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected…

    Published 18 Jun 2025 · Fixed in 1.4.3 · NVD
  15. Medium 6.7

    CVE-2025-50200 · RabbitMQ

    Node can log Basic Auth header from an HTTP request

    Published 18 Jun 2025 · Fixed in 3.13.8, 4.0.8 · NVD, Project advisories (GitHub)
  16. Medium 6.4

    CVE-2025-6201 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Cross-site Scripting

    Published 18 Jun 2025 · Fixed in 1.49.1 · WPVulnerability
  17. High 8.8

    CVE-2025-34511 · Sitecore Experience Platform

    Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP requests, resulting in remote code execution.

    Published 17 Jun 2025 · Fixed in 10.4 · NVD
  18. High 8.8

    CVE-2025-34510 · Sitecore Experience Platform

    Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.

    Published 17 Jun 2025 · Fixed in 10.4 · NVD
  19. High 7.5

    CVE-2025-34509 · Sitecore Experience Platform

    Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.

    Published 17 Jun 2025 · Fixed in 10.4 · NVD
  20. Critical 9.3Actively exploited

    CVE-2025-5777 · NetScaler ADC and Gateway

    Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

    Published 17 Jun 2025 · Fixed in 13.1-37.235, 13.1-58.32, 14.1-43.56 · NVD
  21. High 8.7

    CVE-2025-5349 · NetScaler ADC and Gateway

    Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway

    Published 17 Jun 2025 · Fixed in 13.1-37.235, 13.1-58.32, 14.1-43.56 · NVD
  22. Medium 6.8

    CVE-2025-49593 · Portainer

    HTTP Headers May Leak to Malicious Container Registries

    Published 17 Jun 2025 · Fixed in 2.27.7 · Project advisories (GitHub)
  23. High 7.5

    CVE-2025-49125 · Apache Tomcat

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be…

    Published 16 Jun 2025 · Fixed in 9.0.106, 10.1.42, 11.0.8 · NVD
  24. High 8.4

    CVE-2025-49124 · Apache Tomcat

    Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected:…

    Published 16 Jun 2025 · Fixed in 9.0.106, 10.1.42, 11.0.8 · NVD
  25. High 7.5

    CVE-2025-48988 · Apache Tomcat

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are…

    Published 16 Jun 2025 · Fixed in 9.0.106, 10.1.42, 11.0.8 · NVD
  26. High 8.6

    CVE-2025-3594 · Liferay Portal / DXP

    Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 34, and older unsupported versions allows remote attackers to (1) add files to arbitrary locations on the server and (2) download and execute arbitrary files from the download server via the…

    Published 16 Jun 2025 · NVD
  27. High 8.7

    CVE-2025-3526 · Liferay Portal / DXP

    SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsupported versions does not restrict the saving of request parameters in the HTTP session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP requests.

    Published 16 Jun 2025 · NVD
  28. High 8.7

    CVE-2025-3602 · Liferay Portal / DXP

    Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing complex queries.

    Published 16 Jun 2025 · NVD
  29. Medium 5.3

    CVE-2025-49149 · Dify

    Dify has xss vulnerability

    Published 16 Jun 2025 · NVD, Project advisories (GitHub)
  30. High 7.5

    CVE-2025-30399 · .NET

    Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.

    Published 13 Jun 2025 · Fixed in 8.0.17, 9.0.6 · NVD
  31. High 8.6

    CVE-2025-4231 · Palo Alto Networks PAN-OS

    A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker must have network access to the management web interface and successfully authenticate to exploit this issue. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

    Published 13 Jun 2025 · Fixed in 10.2.8, 11.0.3 · NVD
  32. Medium 6.4

    CVE-2025-5238 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Cross-site Scripting

    Published 13 Jun 2025 · Fixed in 4.6.0 · WPVulnerability
  33. High 7.2

    CVE-2025-3234 · Filester (WordPress plugin)

    File Manager Pro – Filester: Unrestricted Upload of File with Dangerous Type

    Published 13 Jun 2025 · Fixed in 1.8.9 · WPVulnerability
  34. High 7.5

    CVE-2025-5982 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.

    Published 12 Jun 2025 · Fixed in 17.10.8, 17.11.4, 18.0.2 · NVD
  35. Medium 5.9

    CVE-2024-9512 · GitLab

    An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync.

    Published 12 Jun 2025 · Fixed in 17.10.8, 17.11.4, 18.0.2 · NVD
  36. High 7.5

    CVE-2025-6021 · libxml2

    A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.

    Published 12 Jun 2025 · Fixed in 2.14.4 · NVD
  37. Medium 4.3

    CVE-2025-5195 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. It was possible for authenticated users to access arbitrary compliance frameworks, leading to unauthorized data disclosure.

    Published 12 Jun 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  38. High 7.5

    CVE-2025-0673 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2, allow an attacker to trigger an infinite redirect loop, potentially leading to a denial of service condition.

    Published 12 Jun 2025 · Fixed in 17.10.8, 17.11.4, 18.0.2 · NVD
  39. Medium 6.5

    CVE-2025-5996 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. A lack of input validation in HTTP responses could allow an authenticated user to cause denial of service.

    Published 12 Jun 2025 · Fixed in 17.10.8, 17.11.4, 18.0.2 · NVD
  40. High 8.7

    CVE-2025-4278 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover.

    Published 12 Jun 2025 · Fixed in 18.0.2 · NVD
  41. Medium 6.1

    CVE-2025-2254 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper output encoding in the snipper viewer functionality lead to Cross-Site scripting attacks.

    Published 12 Jun 2025 · Fixed in 17.10.8, 17.11.4, 18.0.2 · NVD
  42. High 7.5

    CVE-2025-1516 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper input validation in Tokens Names could be used to trigger a denial of service.

    Published 12 Jun 2025 · Fixed in 17.10.8, 17.11.4, 18.0.2 · NVD
  43. High 7.5

    CVE-2025-1478 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in Board Names could be used to trigger a denial of service.

    Published 12 Jun 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  44. Medium 4.1

    CVE-2025-4573 · Mattermost

    Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute.

    Published 11 Jun 2025 · Fixed in 10.5.5, 10.6.4, 10.7.2 · NVD
  45. Medium 4.3

    CVE-2025-4128 · Mattermost

    Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/{team_id}.

    Published 11 Jun 2025 · Fixed in 9.11.14, 10.5.5 · NVD
  46. Medium 5.4

    CVE-2025-47117 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  47. Medium 5.4

    CVE-2025-47116 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  48. Medium 5.4

    CVE-2025-47115 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  49. Medium 5.4

    CVE-2025-47114 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  50. Medium 5.4

    CVE-2025-47113 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.