UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,973
Published in 7 days
830
Critical in 30 days
393
Actively exploited
420

Latest vulnerabilities

37,973 vulnerabilities
  1. Medium 5.6

    CVE-2025-5702 · GNU C Library

    The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the…

    Published 5 Jun 2025 · Fixed in 2.39-209, 2.40-139, 2.41-60 · NVD
  2. High 7.5

    GHSA-5px6-fx2w-459r · Uptime Kuma

    Unauthenticated file read of files that begin with `index.`

    Published 4 Jun 2025 · Fixed in 2.0.0-beta.3 · Project advisories (GitHub)
  3. High 7.7

    CVE-2025-24015 · Deno

    Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions 1.46.0 through 2.1.6 have an issue that affects AES-256-GCM and AES-128-GCM in Deno in which the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks the guarantees expected from AES-GCM. Older versions of Deno correctly threw errors in such cases, as…

    Published 3 Jun 2025 · Fixed in 2.1.7 · NVD
  4. Medium 5.3

    CVE-2024-21486 · Deno

    Exposure of sensitive information using static imports

    Published 3 Jun 2025 · Fixed in 2.0.0 · Project advisories (GitHub)
  5. Medium 5.5

    CVE-2025-48934 · Deno

    Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

    Published 3 Jun 2025 · Fixed in 2.1.13, 2.2.13 · NVD, Project advisories (GitHub)
  6. Medium 5.5

    CVE-2025-48935 · Deno

    --allow-read / --allow-write permission bypass in `node:sqlite`

    Published 3 Jun 2025 · Fixed in 2.2.5 · NVD, Project advisories (GitHub)
  7. Medium 5.5

    CVE-2025-48888 · Deno

    deno run with --allow-read and --deny-read flags results in allowed

    Published 3 Jun 2025 · Fixed in 2.1.13, 2.2.13, 2.3.2 · NVD, Project advisories (GitHub)
  8. Medium 6.5

    CVE-2025-48953 · Umbraco CMS

    Possibility to By-Pass Configured Allowed Extensions for File Uploads

    Published 3 Jun 2025 · Fixed in 15.4.2 · NVD, Project advisories (GitHub)
  9. Medium 5.4

    CVE-2025-20297 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the pdfgen/render REST endpoint that could result in execution of unauthorized JavaScript code in the browser of a user.

    Published 2 Jun 2025 · Fixed in 9.2.6, 9.3.4, 9.4.2 · NVD
  10. Medium 5.3

    CVE-2025-48941 · MyBB

    Unviewable threads title disclosure in search

    Published 2 Jun 2025 · Fixed in 1.8.39 · NVD, Project advisories (GitHub)
  11. High 7.2

    CVE-2025-48940 · MyBB

    Upgrade local file inclusion

    Published 2 Jun 2025 · Fixed in 1.8.39 · NVD, Project advisories (GitHub)
  12. High 7.5

    CVE-2025-48866 · ModSecurity

    Possible DoS vulnerability in sanitiseArg action

    Published 2 Jun 2025 · Fixed in 2.9.9, 2.9.10 · NVD, Project advisories (GitHub)
  13. High 8.8Actively exploited

    CVE-2025-49113 · Roundcube

    Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

    Published 2 Jun 2025 · Fixed in 1.5.10, 1.6.11 · NVD
  14. Medium 6.5

    CVE-2025-48944 · vLLM

    vLLM is an inference and serving engine for large language models (LLMs). In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the "pattern" and "type" fields when the tools functionality is invoked. These inputs are not validated before being compiled or parsed, causing a crash of the…

    Published 30 May 2025 · Fixed in 0.9.0 · NVD
  15. Medium 6.5

    CVE-2025-48943 · vLLM

    vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to GHSA-6qc9-v4r8-22xg/CVE-2025-48942, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.

    Published 30 May 2025 · Fixed in 0.9.0 · NVD
  16. Medium 6.5

    CVE-2025-48942 · vLLM

    vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid json_schema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-48943, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.

    Published 30 May 2025 · Fixed in 0.9.0 · NVD
  17. Medium 6.5

    CVE-2025-48887 · vLLM

    vLLM, an inference and serving engine for large language models (LLMs), has a Regular Expression Denial of Service (ReDoS) vulnerability in the file `vllm/entrypoints/openai/tool_parsers/pythonic_tool_parser.py` of versions 0.6.4 up to but excluding 0.9.0. The root cause is the use of a highly complex and nested regular expression for tool call detection, which can be exploited by an attacker to…

    Published 30 May 2025 · Fixed in 0.9.0 · NVD
  18. Medium 4.3

    CVE-2025-3611 · Mattermost

    Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console.

    Published 30 May 2025 · Fixed in 9.11.13, 10.5.4 · NVD
  19. Medium 5.4

    CVE-2025-3230 · Mattermost

    Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.

    Published 30 May 2025 · Fixed in 10.5.4, 10.6.3, 10.7.1 · NVD
  20. Medium 4.2

    CVE-2025-2571 · Mattermost

    Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow.

    Published 30 May 2025 · Fixed in 10.5.4, 10.6.3, 10.7.1 · NVD
  21. Low 3.1

    CVE-2025-1792 · Mattermost

    Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.

    Published 30 May 2025 · Fixed in 9.11.13, 10.5.4, 10.7.1 · NVD
  22. High 8.7

    CVE-2025-1763 · GitLab

    An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

    Published 30 May 2025 · Fixed in 17.9.7, 17.10.5 · NVD
  23. High 7.1

    CVE-2025-48912 · Apache Superset

    An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue.

    Published 30 May 2025 · Fixed in 4.1.2 · NVD
  24. High 7.5

    CVE-2024-54952 · MikroTik RouterOS

    MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Remote, unauthenticated attackers can exploit this issue by sending specially crafted packets, triggering a null pointer dereference. This leads to a Remote Denial of Service (DoS), rendering the SMB service unavailable.

    Published 29 May 2025 · NVD
  25. High 7.3

    CVE-2025-46701 · Apache Tomcat

    Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was…

    Published 29 May 2025 · Fixed in 9.0.105, 10.1.41, 11.0.7 · NVD
  26. High 7.3

    CVE-2025-46722 · vLLM

    vLLM is an inference and serving engine for large language models (LLMs). In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image objects using only obj.tobytes(), which returns only the raw pixel data, without including metadata…

    Published 29 May 2025 · Fixed in 0.9.0 · NVD
  27. Low 2.6

    CVE-2025-46570 · vLLM

    vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT (Time to First Token). These timing differences caused by matching chunks are significant enough to be recognized and exploited. This issue has…

    Published 29 May 2025 · Fixed in 0.9.0 · NVD
  28. Low 3.8

    CVE-2025-3913 · Mattermost

    Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly validate permissions when changing team privacy settings, allowing team administrators without the 'invite user' permission to access and modify team invite IDs via the /api/v4/teams/:teamId/privacy endpoint.

    Published 29 May 2025 · Fixed in 10.5.4, 10.6.3, 10.7.1 · NVD
  29. Low

    CVE-2025-48068 · Next.js

    Information exposure in Next.js dev server due to lack of origin verification

    Published 28 May 2025 · Fixed in 14.2.30, 15.2.2 · OSV.dev and GitHub
  30. Medium 5.4

    CVE-2025-47933 · Argo CD

    Cross-site scripting on repositories page

    Published 28 May 2025 · Fixed in 2.13.8, 2.14.13, 3.0.4 · NVD, Project advisories (GitHub)
  31. Medium 5.4

    CVE-2025-5256 · Mautic

    Open Redirect vulnerability on user unlock path.

    Published 28 May 2025 · Fixed in 4.4.16 · Project advisories (GitHub)
  32. Medium 4.3

    CVE-2024-47055 · Mautic

    Segment cloning doesn't have a proper permission check

    Published 28 May 2025 · Fixed in 5.2.6, 6.0.2 · NVD, Project advisories (GitHub)
  33. Medium 5.3

    CVE-2024-47057 · Mautic

    User name enumeration possible due to response time difference on password reset form

    Published 28 May 2025 · Fixed in 4.4.16 · Project advisories (GitHub)
  34. Medium 5.1

    CVE-2024-47056 · Mautic

    Mautic does not shield .env files from web traffic

    Published 28 May 2025 · Fixed in 4.4.16 · Project advisories (GitHub)
  35. Medium 6.5

    CVE-2025-5257 · Mautic

    Predictable Page Indexing Might Lead to Sensitive Data Exposure

    Published 28 May 2025 · Fixed in 4.4.16 · Project advisories (GitHub)
  36. High 8.8

    CVE-2025-48936 · ZITADEL

    Account Takeover via Malicious X-Forwarded-Proto Header Injection

    Published 28 May 2025 · Fixed in 2.70.12, 2.71.11, 3.2.2 · NVD, Project advisories (GitHub)
  37. Low 2.9

    CVE-2025-47952 · Traefik

    Path traversal still possible using url encoding

    Published 28 May 2025 · Fixed in 2.11.25, 3.4.1 · NVD, Project advisories (GitHub)
  38. Low 3.7

    CVE-2025-47295 · Fortinet FortiOS

    A buffer over-read in Fortinet FortiOS versions 7.4.0 through 7.4.3, versions 7.2.0 through 7.2.7, and versions 7.0.0 through 7.0.14 may allow a remote unauthenticated attacker to crash the FGFM daemon via a specially crafted request, under rare conditions that are outside of the attacker's control.

    Published 28 May 2025 · Fixed in 7.0.15, 7.2.8, 7.4.4 · NVD
  39. Medium 5.3

    CVE-2025-47294 · Fortinet FortiOS

    A integer overflow or wraparound in Fortinet FortiOS versions 7.2.0 through 7.2.7, versions 7.0.0 through 7.0.14 may allow a remote unauthenticated attacker to crash the csfd daemon via a specially crafted request.

    Published 28 May 2025 · Fixed in 7.0.15, 7.2.8 · NVD
  40. High 7.2

    CVE-2025-22252 · Fortinet FortiProxy, Fortinet FortiOS

    A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.

    Published 28 May 2025 · Fixed in 7.4.7 · NVD
  41. Medium 4.8

    CVE-2025-5025 · curl

    libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly…

    Published 28 May 2025 · Fixed in 8.14.0 · NVD
  42. Medium 6.5

    CVE-2025-4947 · curl

    libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

    Published 28 May 2025 · Fixed in 8.14.0 · NVD
  43. Critical 9.8

    CVE-2025-27151 · Redis

    redis-check-aof may lead to stack overflow and potential RCE

    Published 27 May 2025 · Fixed in 7.4.4, 8.0.2, 8.2.0 · NVD, Project advisories (GitHub)
  44. High 7.5

    CVE-2024-52588 · Strapi

    Server - Side Request Forgery in Webhook function

    Published 27 May 2025 · Fixed in 4.25.2 · NVD, Project advisories (GitHub)
  45. High 8.1

    CVE-2025-48828 · vBulletin

    Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.

    Published 27 May 2025 · NVD
  46. Critical 9.8

    CVE-2025-48827 · vBulletin

    vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.

    Published 27 May 2025 · NVD
  47. High 7.5

    CVE-2025-5196 · Wing FTP Server

    A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Lua Admin Console. The manipulation leads to execution with unnecessary privileges. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version…

    Published 26 May 2025 · Fixed in 7.4.4 · NVD
  48. High 7.5

    CVE-2024-9163 · GitLab

    A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an attacker can cause a branch name confusion in confidential MRs.

    Published 23 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  49. High 7.5

    CVE-2024-7803 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A Discord webhook integration may cause DoS.

    Published 23 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  50. Low 3.3

    CVE-2025-48708 · Ghostscript

    gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A created PDF document includes its password in cleartext.

    Published 23 May 2025 · Fixed in 10.05.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.