UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
220
Critical in 30 days
41
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. Medium 5.4

    CVE-2026-7377 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  2. Medium 4.3

    CVE-2026-6883 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 15.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to bypass merge request approval requirements due to improper cleanup of orphaned policy records.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  3. Medium 5.4

    CVE-2026-6335 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user to execute arbitrary code in another user's browser session due to improper sanitization.

    Published 14 May 2026 · Fixed in 18.11.3 · NVD
  4. Medium 5.4

    CVE-2026-6073 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  5. Medium 4.3

    CVE-2026-6063 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user with developer-role permissions to remove code owner approval rules from merge requests due to improper access control.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  6. Medium 6.5

    CVE-2026-4527 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to create unauthorized Jira subscriptions for a targeted user's namespace via a specially crafted link due to missing CSRF protection.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  7. Medium 6.5

    CVE-2026-4524 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to access confidential issue content in public projects without proper authorization due to improper authorization checks.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  8. Medium 4.3

    CVE-2026-3607 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass package protection rules due to improper access control.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  9. Medium 5.8

    CVE-2026-3160 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to view Jira issues outside the configured project scope due to an integration filter functioning only as a display control rather than enforcing access boundaries as specified.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  10. Medium 4.3

    CVE-2026-3074 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to download private debugging symbols from inaccessible projects due to improper access control.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  11. Medium 4.3

    CVE-2026-3073 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass PyPI package protection rules and upload restricted packages due to improper authorization checks.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  12. Low 2.7

    CVE-2026-2900 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-level approval rule editing prevention was enabled, could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  13. High 7.5

    CVE-2026-1659 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted requests due to insufficient input validation.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  14. Medium 4.3

    CVE-2026-1338 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to delete protected container registry tags due to improper authorization checks.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  15. High 8.1

    CVE-2026-1322 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with a read_api scoped OAuth application to create issues and add comments to issues in private projects due to improper authorization.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  16. High 7.5

    CVE-2026-1184 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by uploading a specially crafted file due to improper validation.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  17. High 7.5

    CVE-2025-14870 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted JSON payloads due to insufficient input validation.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  18. High 7.5

    CVE-2025-14869 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted payloads on certain API endpoints.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  19. Medium 4.3

    CVE-2025-13874 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with Guest permissions to view issues in projects they were not authorized to access.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  20. Medium 5.4

    CVE-2025-12669 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to inject HTML and JavaScript into email notifications sent to other users due to improper input sanitization.

    Published 14 May 2026 · Fixed in 18.9.7, 18.10.6, 18.11.3 · NVD
  21. High 8.3

    CVE-2026-42946 · nginx

    A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note:…

    Published 13 May 2026 · NVD
  22. Critical 9.2

    CVE-2026-42945 · nginx

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond…

    Published 13 May 2026 · NVD
  23. Medium 6.3

    CVE-2026-42934 · nginx

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited…

    Published 13 May 2026 · NVD
  24. Medium 6.3

    CVE-2026-42926 · nginx

    When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 13 May 2026 · NVD
  25. Medium 6.3

    CVE-2026-40701 · nginx

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a…

    Published 13 May 2026 · NVD
  26. Medium 6.9

    CVE-2026-40460 · nginx

    When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 13 May 2026 · NVD
  27. Medium 5.3

    CVE-2026-7168 · curl

    Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest** authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`.

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  28. Medium 5.3

    CVE-2026-7009 · curl

    When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine.

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  29. Medium 5.3

    CVE-2026-6429 · curl

    When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  30. High 7.5

    CVE-2026-6276 · curl

    Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  31. Medium 5.9

    CVE-2026-6253 · curl

    curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using…

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  32. High 7.5

    CVE-2026-5773 · curl

    libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an…

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  33. Medium 6.5

    CVE-2026-5545 · curl

    libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the…

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  34. Medium 5.9

    CVE-2026-4873 · curl

    A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.

    Published 13 May 2026 · Fixed in 8.20.0 · NVD
  35. High 7.7

    CVE-2026-8336 · MongoDB

    After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service. This issue impacts MongoDB…

    Published 13 May 2026 · Fixed in 8.2.9, 8.3.2 · NVD
  36. Medium 5.3

    CVE-2026-8202 · MongoDB

    Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

    Published 13 May 2026 · Fixed in 8.0.23, 8.2.9, 8.3.2 · NVD
  37. Medium 6.1

    CVE-2026-8201 · MongoDB

    A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query. This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions…

    Published 13 May 2026 · Fixed in 8.0.23, 8.2.9, 8.3.2 · NVD
  38. Medium 4.8

    CVE-2026-8200 · MongoDB

    When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted.  This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

    Published 13 May 2026 · Fixed in 8.0.23, 8.2.9, 8.3.2 · NVD
  39. High 7.1

    CVE-2026-8199 · MongoDB

    An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

    Published 13 May 2026 · Fixed in 8.0.23, 8.2.9, 8.3.2 · NVD
  40. High 8.7

    CVE-2026-8053 · MongoDB

    An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution. This issue…

    Published 13 May 2026 · Fixed in 8.0.23, 8.2.9, 8.3.2 · NVD
  41. Medium 4.3

    CVE-2026-97343 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Improper Authentication

    Published 13 May 2026 · Fixed in 3.7.2 · WPVulnerability
  42. Critical 9.8

    CVE-2026-8181 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Improper Authentication

    Published 13 May 2026 · Fixed in 3.4.2 · WPVulnerability
  43. High 8.7

    CVE-2026-34686 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,…

    Published 12 May 2026 · NVD
  44. Low 3.4

    CVE-2026-34685 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  45. Medium 4.8

    CVE-2026-34658 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  46. Medium 4.3

    CVE-2026-34656 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  47. Medium 4.8

    CVE-2026-34655 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  48. Medium 5.3

    CVE-2026-34654 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  49. High 8.7

    CVE-2026-34653 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system read and write. An authenticated attacker with administrative privileges could exploit this vulnerability to read or write files outside the…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  50. High 7.5

    CVE-2026-34652 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Dependency on Vulnerable Third-Party Component vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.