UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,973
Published in 7 days
818
Critical in 30 days
393
Actively exploited
420

Latest vulnerabilities

37,973 vulnerabilities
  1. Medium 6.1

    CVE-2025-48378 · DNN Platform

    Stored Cross-Site Scripting (XSS) possible with svg files rendered inline

    Published 23 May 2025 · Fixed in 9.13.9 · NVD, Project advisories (GitHub)
  2. Medium 6.0

    CVE-2025-48377 · DNN Platform

    Reflected Cross-Site Scripting (XSS) in module actions in edit mode

    Published 23 May 2025 · Fixed in 9.13.9 · NVD, Project advisories (GitHub)
  3. Low 2.4

    CVE-2025-48376 · DNN Platform

    Site Import could use an external source with a crafted request

    Published 23 May 2025 · Fixed in 9.13.9 · NVD, Project advisories (GitHub)
  4. Medium 6.5

    CVE-2025-0993 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. This could allow an authenticated attacker to cause a denial of service condition by exhausting server resources.

    Published 22 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  5. Medium 4.3

    CVE-2025-0679 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Under certain conditions un-authorised users can view full email addresses that should be partially obscured.

    Published 22 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  6. Medium 4.3

    CVE-2025-0605 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access controls could allow certain users to bypass two-factor authentication requirements.

    Published 22 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  7. Medium 6.8

    CVE-2024-12093 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 11.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Improper XPath validation allows modified SAML response to bypass 2FA requirement under specialized conditions.

    Published 22 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  8. High 7.5

    CVE-2025-4979 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to reveal masked or hidden CI variables (that they did not author) in the WebUI, by simply creating their own variable and observing the HTTP response.

    Published 22 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  9. Medium 6.5

    CVE-2025-4575 · OpenSSL

    Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Impact summary: If a user intends to make a trusted certificate rejected for a particular use it will be instead marked as trusted for that use. A copy & paste error during minor refactoring of the code introduced this issue in the OpenSSL 3.5 version. If, for…

    Published 22 May 2025 · NVD
  10. Medium 6.5

    CVE-2025-3111 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 10.2 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in the Kubernetes integration could allow an authenticated user to cause denial of service..

    Published 22 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  11. Medium 6.5

    CVE-2025-2853 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of proper validation in GitLab could allow an authenticated user to cause a denial of service condition.

    Published 22 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  12. Medium 4.3

    CVE-2025-1110 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could access Job Data via a crafted GraphQL query.

    Published 22 May 2025 · NVD
  13. Medium 6.1

    CVE-2025-4123 · Grafana

    A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is…

    Published 22 May 2025 · Fixed in 11.4.4, 11.5.4, 11.6.1 · NVD
  14. High 7.5

    CVE-2025-47947 · ModSecurity

    Possible DoS vulnerability

    Published 21 May 2025 · Fixed in 2.9.9 · NVD, Project advisories (GitHub)
  15. Medium 4.6

    CVE-2025-47291 · containerd

    containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.

    Published 21 May 2025 · Fixed in 2.0.5 · NVD, Project advisories (GitHub)
  16. Medium 6.5

    CVE-2024-42922 · aaPanel

    AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability.

    Published 21 May 2025 · NVD
  17. High 8.2

    CVE-2019-16536 · ClickHouse

    Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.

    Published 21 May 2025 · Fixed in 19.14.3.3 · NVD
  18. Medium 6.1

    CVE-2025-5062 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 21 May 2025 · Fixed in 9.3.4, 9.4.3 · NVD, WPVulnerability
  19. Medium 6.1

    CVE-2025-47854 · TeamCity

    In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page

    Published 20 May 2025 · Fixed in 2025.03.2 · NVD
  20. Medium 5.4

    CVE-2025-47853 · TeamCity

    In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible

    Published 20 May 2025 · Fixed in 2025.03.2 · NVD
  21. Medium 5.4

    CVE-2025-47852 · TeamCity

    In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible

    Published 20 May 2025 · Fixed in 2025.03.2 · NVD
  22. Medium 5.4

    CVE-2025-47851 · TeamCity

    In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible

    Published 20 May 2025 · Fixed in 2025.03.2 · NVD
  23. Critical 9.8

    CVE-2025-47277 · vLLM

    vLLM, an inference and serving engine for large language models (LLMs), has an issue in versions 0.6.5 through 0.8.4 that ONLY impacts environments using the `PyNcclPipe` KV cache transfer integration with the V0 engine. No other configurations are affected. vLLM supports the use of the `PyNcclPipe` class to establish a peer-to-peer communication domain for data transmission between distributed…

    Published 20 May 2025 · Fixed in 0.8.5 · NVD
  24. High 7.2

    CVE-2025-22157 · Jira

    This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Server 5.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Service Management Data Center and Server This PrivEsc (Privilege Escalation) vulnerability, with a CVSS Score of 7.2, allows an attacker to perform actions as a higher-privileged user.…

    Published 20 May 2025 · Fixed in 9.12.20, 10.3.5, 10.5.1 · NVD
  25. High 7.6

    CVE-2025-47290 · containerd

    Host filesystem access during image unpack

    Published 20 May 2025 · NVD, Project advisories (GitHub)
  26. High 7.2

    CVE-2025-47940 · TYPO3

    Privilege Escalation to System Maintainer

    Published 20 May 2025 · Fixed in 11.5.44, 12.4.31, 13.4.12 · NVD, Project advisories (GitHub)
  27. High 7.2

    CVE-2025-47941 · TYPO3

    Broken Authentication in Backend MFA

    Published 20 May 2025 · Fixed in 12.4.31, 13.4.12 · NVD, Project advisories (GitHub)
  28. Medium 5.4

    CVE-2025-47939 · TYPO3

    Unrestricted File Upload in File Abstraction Layer

    Published 20 May 2025 · Fixed in 11.5.44, 12.4.31, 13.4.12 · NVD, Project advisories (GitHub)
  29. Low 3.8

    CVE-2025-47938 · TYPO3

    Unverified Password Change for Backend Users

    Published 20 May 2025 · Fixed in 11.5.44, 12.4.31, 13.4.12 · NVD, Project advisories (GitHub)
  30. Medium 4.4

    CVE-2025-47936 · TYPO3

    Server-Side Request Forgery via Webhooks

    Published 20 May 2025 · Fixed in 12.4.31, 13.4.12 · NVD, Project advisories (GitHub)
  31. Medium 5.3

    CVE-2025-47937 · TYPO3

    Information Disclosure via DBAL Restriction Handling

    Published 20 May 2025 · Fixed in 11.5.44, 12.4.31, 13.4.12 · NVD, Project advisories (GitHub)
  32. Medium 5.4

    CVE-2025-2892 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting

    Published 18 May 2025 · Fixed in 4.8.2 · WPVulnerability
  33. High 7.8

    CVE-2025-4802 · GNU C Library

    Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).

    Published 16 May 2025 · NVD
  34. Medium 4.3

    CVE-2025-47794 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud running with a different user account, or run a symlink attack. Nextcloud Server versions 29.0.13,…

    Published 16 May 2025 · Fixed in 29.0.13, 30.0.7, 31.0.1 · NVD
  35. Medium 6.5

    CVE-2025-47793 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to 30.0.2 and 29.0.9, and Nextcloud Groupfolders app prior to 18.0.3, 17.0.5, and 16.0.11, the absence of quota checking on attachments…

    Published 16 May 2025 · Fixed in 28.0.12, 29.0.9, 30.0.2 · NVD
  36. Medium 5.3

    CVE-2025-47791 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests to another server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and…

    Published 16 May 2025 · Fixed in 28.0.13, 29.0.10, 30.0.3 · NVD
  37. Medium 6.4

    CVE-2025-47790 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with…

    Published 16 May 2025 · Fixed in 29.0.15, 30.0.9, 31.0.3 · NVD
  38. High 7.5

    CVE-2025-1975 · Ollama

    A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by customizing the manifest content and spoofing a service. This is due to improper validation of array index access when downloading a model via the /api/pull endpoint, which can lead to a server crash.

    Published 16 May 2025 · NVD
  39. Low 2.7

    CVE-2025-2570 · Mattermost

    Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which allows a System Manager to access `ExperimentSettings` when `RestrictSystemAdmin` is true via System Console.

    Published 15 May 2025 · Fixed in 9.11.12, 10.5.4 · NVD
  40. Medium 4.3

    CVE-2025-2527 · Mattermost

    Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows an attacker to view group information via an API request.

    Published 15 May 2025 · Fixed in 9.11.12, 10.5.3 · NVD
  41. Low 3.7

    CVE-2025-32421 · Next.js

    Next.js Race Condition to Cache Poisoning

    Published 15 May 2025 · Fixed in 14.2.24, 15.1.6 · OSV.dev and GitHub
  42. Medium 4.3

    CVE-2025-3446 · Mattermost

    Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team.

    Published 15 May 2025 · Fixed in 10.4.5, 10.5.3, 10.6.2 · NVD
  43. Medium 5.3

    CVE-2025-31947 · Mattermost

    Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.

    Published 15 May 2025 · Fixed in 10.4.5, 10.5.3, 10.6.2 · NVD
  44. Medium 6.1

    CVE-2024-45516 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient…

    Published 14 May 2025 · Fixed in 10.0.12, 10.1.4 · NVD
  45. High 7.6

    CVE-2025-33104 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

    Published 14 May 2025 · Fixed in 8.5.5.28, 9.0.5.24 · NVD
  46. High 8.2

    CVE-2025-0130 · Palo Alto Networks PAN-OS

    A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packets that causes the firewall to become unresponsive and eventually reboot. Repeated successful attempts to trigger this condition will cause the firewall to enter maintenance mode. This issue does not affect Cloud NGFW…

    Published 14 May 2025 · Fixed in 11.1.6, 11.2.5 · NVD
  47. Medium 5.4

    CVE-2024-57273 · pfSense

    Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service, allowing remote attackers to execute arbitrary JavaScript, delete backups, or leak sensitive information via an unsanitized "reason" field and a derivable device key generated from the public SSH key.

    Published 14 May 2025 · Fixed in 2.8.0 · NVD
  48. High 8.8

    CVE-2024-54780 · pfSense

    Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting arbitrary OpenVPN management commands via the remipp parameter.

    Published 14 May 2025 · Fixed in 2.8.0 · NVD
  49. Medium 5.4

    CVE-2024-54779 · pfSense

    Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php.

    Published 14 May 2025 · Fixed in 2.8.0 · NVD
  50. Medium

    CVE-2025-23167 · Node.js

    Improper HTTP header block termination in llhttp

    Published 14 May 2025 · Fixed in 20.19.2 · nodejs

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.