UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,024
Published in 7 days
811
Critical in 30 days
393
Actively exploited
420

Latest vulnerabilities

38,024 vulnerabilities
  1. Medium 5.3

    CVE-2025-47937 · TYPO3

    Information Disclosure via DBAL Restriction Handling

    Published 20 May 2025 · Fixed in 11.5.44, 12.4.31, 13.4.12 · NVD, Project advisories (GitHub)
  2. Medium 5.4

    CVE-2025-2892 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting

    Published 18 May 2025 · Fixed in 4.8.2 · WPVulnerability
  3. High 7.8

    CVE-2025-4802 · GNU C Library

    Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).

    Published 16 May 2025 · NVD
  4. Medium 4.3

    CVE-2025-47794 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud running with a different user account, or run a symlink attack. Nextcloud Server versions 29.0.13,…

    Published 16 May 2025 · Fixed in 29.0.13, 30.0.7, 31.0.1 · NVD
  5. Medium 6.5

    CVE-2025-47793 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to 30.0.2 and 29.0.9, and Nextcloud Groupfolders app prior to 18.0.3, 17.0.5, and 16.0.11, the absence of quota checking on attachments…

    Published 16 May 2025 · Fixed in 28.0.12, 29.0.9, 30.0.2 · NVD
  6. Medium 5.3

    CVE-2025-47791 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests to another server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and…

    Published 16 May 2025 · Fixed in 28.0.13, 29.0.10, 30.0.3 · NVD
  7. Medium 6.4

    CVE-2025-47790 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with…

    Published 16 May 2025 · Fixed in 29.0.15, 30.0.9, 31.0.3 · NVD
  8. High 7.5

    CVE-2025-1975 · Ollama

    A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by customizing the manifest content and spoofing a service. This is due to improper validation of array index access when downloading a model via the /api/pull endpoint, which can lead to a server crash.

    Published 16 May 2025 · NVD
  9. Low 2.7

    CVE-2025-2570 · Mattermost

    Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which allows a System Manager to access `ExperimentSettings` when `RestrictSystemAdmin` is true via System Console.

    Published 15 May 2025 · Fixed in 9.11.12, 10.5.4 · NVD
  10. Medium 4.3

    CVE-2025-2527 · Mattermost

    Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows an attacker to view group information via an API request.

    Published 15 May 2025 · Fixed in 9.11.12, 10.5.3 · NVD
  11. Low 3.7

    CVE-2025-32421 · Next.js

    Next.js Race Condition to Cache Poisoning

    Published 15 May 2025 · Fixed in 14.2.24, 15.1.6 · OSV.dev and GitHub
  12. Medium 4.3

    CVE-2025-3446 · Mattermost

    Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team.

    Published 15 May 2025 · Fixed in 10.4.5, 10.5.3, 10.6.2 · NVD
  13. Medium 5.3

    CVE-2025-31947 · Mattermost

    Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.

    Published 15 May 2025 · Fixed in 10.4.5, 10.5.3, 10.6.2 · NVD
  14. Medium 6.1

    CVE-2024-45516 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient…

    Published 14 May 2025 · Fixed in 10.0.12, 10.1.4 · NVD
  15. High 7.6

    CVE-2025-33104 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

    Published 14 May 2025 · Fixed in 8.5.5.28, 9.0.5.24 · NVD
  16. High 8.2

    CVE-2025-0130 · Palo Alto Networks PAN-OS

    A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packets that causes the firewall to become unresponsive and eventually reboot. Repeated successful attempts to trigger this condition will cause the firewall to enter maintenance mode. This issue does not affect Cloud NGFW…

    Published 14 May 2025 · Fixed in 11.1.6, 11.2.5 · NVD
  17. Medium 5.4

    CVE-2024-57273 · pfSense

    Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service, allowing remote attackers to execute arbitrary JavaScript, delete backups, or leak sensitive information via an unsanitized "reason" field and a derivable device key generated from the public SSH key.

    Published 14 May 2025 · Fixed in 2.8.0 · NVD
  18. High 8.8

    CVE-2024-54780 · pfSense

    Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting arbitrary OpenVPN management commands via the remipp parameter.

    Published 14 May 2025 · Fixed in 2.8.0 · NVD
  19. Medium 5.4

    CVE-2024-54779 · pfSense

    Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php.

    Published 14 May 2025 · Fixed in 2.8.0 · NVD
  20. Medium

    CVE-2025-23167 · Node.js

    Improper HTTP header block termination in llhttp

    Published 14 May 2025 · Fixed in 20.19.2 · nodejs
  21. High

    CVE-2025-23166 · Node.js

    Improper error handling in async cryptographic operations crashes process

    Published 14 May 2025 · Fixed in 22.15.1, 23.11.1, 24.0.2 · nodejs
  22. Low

    CVE-2025-23165 · Node.js

    Corrupted pointer in `node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args)` when `args[0]` is a string.

    Published 14 May 2025 · Fixed in 20.19.2, 22.15.1 · nodejs
  23. High 8.0

    CVE-2025-26646 · .NET

    External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.

    Published 13 May 2025 · Fixed in 8.0.16, 9.0.5 · NVD
  24. Medium 6.8

    CVE-2025-43566 · Adobe ColdFusion

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A high-privileged attacker could leverage this vulnerability to bypass security protections and gain unauthorized read access. Exploitation of this issue does not require user…

    Published 13 May 2025 · NVD
  25. High 8.4

    CVE-2025-43565 · Adobe ColdFusion

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could lead to arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction and scope is changed.

    Published 13 May 2025 · NVD
  26. Critical 9.1

    CVE-2025-43564 · Adobe ColdFusion

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction, and scope is changed

    Published 13 May 2025 · NVD
  27. Critical 9.1

    CVE-2025-43563 · Adobe ColdFusion

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction, and scope is changed.

    Published 13 May 2025 · NVD
  28. Critical 9.1

    CVE-2025-43562 · Adobe ColdFusion

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue…

    Published 13 May 2025 · NVD
  29. Critical 9.1

    CVE-2025-43561 · Adobe ColdFusion

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass authentication mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

    Published 13 May 2025 · NVD
  30. Critical 9.1

    CVE-2025-43560 · Adobe ColdFusion

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

    Published 13 May 2025 · NVD
  31. Critical 9.1

    CVE-2025-43559 · Adobe ColdFusion

    ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

    Published 13 May 2025 · NVD
  32. Low 1.8

    CVE-2025-47278 · Flask

    fallback key is used instead of current signing key

    Published 13 May 2025 · Project advisories (GitHub)
  33. Low 2.3

    CVE-2025-30207 · Kirby

    Path traversal in the router for PHP's built-in server

    Published 13 May 2025 · Fixed in 3.9.8.3, 3.10.1.2, 4.7.1 · NVD, Project advisories (GitHub)
  34. Medium 6.3

    CVE-2025-31493 · Kirby

    Path traversal of collection names during file system lookup

    Published 13 May 2025 · Fixed in 3.9.8.3, 3.10.1.2, 4.7.1 · NVD, Project advisories (GitHub)
  35. Medium 6.3

    CVE-2025-30159 · Kirby

    Path traversal of snippet names during file system lookup

    Published 13 May 2025 · Fixed in 3.9.8.3, 3.10.1.2, 4.7.1 · NVD, Project advisories (GitHub)
  36. Medium 5.3

    CVE-2025-27696 · Apache Superset

    Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.

    Published 13 May 2025 · Fixed in 4.1.2 · NVD
  37. Medium 4.1

    CVE-2025-3951 · WP Optimize (WordPress plugin)

    WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance: SQL Injection

    Published 12 May 2025 · Fixed in 4.2.0 · WPVulnerability
  38. High 7.5

    CVE-2025-1278 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.

    Published 9 May 2025 · Fixed in 17.9.8, 17.10.6, 17.11.2 · NVD
  39. Medium 6.8

    CVE-2025-0549 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.3 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17.11.2. A security vulnerability allows attackers to bypass Device OAuth flow protections, enabling authorization form submission through minimal user interaction.

    Published 9 May 2025 · Fixed in 17.9.8, 17.10.6, 17.11.2 · NVD
  40. High 7.5

    CVE-2024-8973 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17.11.2. It was possible to cause a DoS condition via GitHub import requests using a malicious crafted payload.

    Published 9 May 2025 · Fixed in 17.9.8, 17.10.6, 17.11.2 · NVD
  41. Medium 5.4

    CVE-2025-3794 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 9 May 2025 · Fixed in 1.9.5.1 · WPVulnerability
  42. High 7.5

    CVE-2025-1948 · Eclipse Jetty

    In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process…

    Published 8 May 2025 · Fixed in 12.0.17 · NVD
  43. High 7.2

    CVE-2024-13009 · Eclipse Jetty

    In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.

    Published 8 May 2025 · Fixed in 9.4.57 · NVD
  44. Medium 6.9Actively exploited

    CVE-2025-35939 · Craft CMS

    Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where…

    Published 7 May 2025 · Fixed in 4.15.3, 5.7.5 · NVD
  45. High 8.7

    CVE-2025-41433 · F5 BIG-IP

    When a Session Initiation Protocol (SIP) message routing framework (MRF) application layer gateway (ALG) profile is configured on a Message Routing virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 7 May 2025 · Fixed in 16.1.5, 17.1.2 · NVD
  46. High 8.7

    CVE-2025-41431 · F5 BIG-IP

    When connection mirroring is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate in the standby BIG-IP systems in a traffic group. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 7 May 2025 · NVD
  47. High 8.7

    CVE-2025-41414 · F5 BIG-IP

    When HTTP/2 client and server profile is configured on a virtual server, undisclosed requests can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    Published 7 May 2025 · Fixed in 16.1.5, 17.1.2 · NVD
  48. High 8.7

    CVE-2025-41399 · F5 BIG-IP

    When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 7 May 2025 · Fixed in 15.1.9, 16.1.4 · NVD
  49. High 8.7

    CVE-2025-36557 · F5 BIG-IP

    When an HTTP profile with the Enforce RFC Compliance option is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 7 May 2025 · Fixed in 16.1.5, 17.1.2 · NVD
  50. High 8.7

    CVE-2025-36525 · F5 BIG-IP

    When a BIG-IP APM virtual server is configured to use a PingAccess profile, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 7 May 2025 · Fixed in 15.1.10.7.0.4.5, 16.1.6, 17.1.2.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.