UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,024
Published in 7 days
806
Critical in 30 days
393
Actively exploited
420

Latest vulnerabilities

38,024 vulnerabilities
  1. High 8.7

    CVE-2025-36504 · F5 BIG-IP

    When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 7 May 2025 · Fixed in 16.1.6, 17.1.2 · NVD
  2. High 8.5

    CVE-2025-31644 · F5 BIG-IP

    When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical…

    Published 7 May 2025 · Fixed in 15.1.10.7, 16.1.6, 17.1.2.2 · NVD
  3. Medium 5.3

    CVE-2025-46821 · Envoy

    Bypass of RBAC uri_template permission

    Published 7 May 2025 · Fixed in 1.31.8, 1.32.6, 1.33.3 · NVD, Project advisories (GitHub)
  4. High 8.6

    CVE-2025-20182 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Internet Key Exchange version 2 (IKEv2) protocol processing of Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense (FTD) Software, Cisco IOS Software, and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input…

    Published 7 May 2025 · NVD
  5. Medium 6.9

    CVE-2025-27533 · Apache ActiveMQ

    Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker…

    Published 7 May 2025 · Fixed in 5.17.7, 5.18.7, 6.1.6 · NVD
  6. Critical 9.8

    CVE-2025-47688 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Missing Authorization

    Published 7 May 2025 · Fixed in 5.3.2 · WPVulnerability
  7. Medium 6.4

    CVE-2025-47437 · LiteSpeed Cache

    LiteSpeed Cache: Server-Side Request Forgery (SSRF)

    Published 7 May 2025 · Fixed in 7.1 · WPVulnerability
  8. Medium 6.9

    CVE-2025-4388 · Liferay Portal / DXP

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.

    Published 6 May 2025 · Fixed in 7.4.3.132, 2024.Q1.13, 2024.q4.6 · NVD
  9. Critical 9.8

    CVE-2025-25014 · Kibana

    A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

    Published 6 May 2025 · Fixed in 8.17.6 · NVD
  10. High 8.0

    CVE-2025-30165 · vLLM

    vLLM is an inference and serving engine for large language models. In a multi-node vLLM deployment using the V0 engine, vLLM uses ZeroMQ for some multi-node communication purposes. The secondary vLLM hosts open a `SUB` ZeroMQ socket and connect to an `XPUB` socket on the primary vLLM host. When data is received on this `SUB` socket, it is deserialized with `pickle`. This is unsafe, as it can be…

    Published 6 May 2025 · NVD
  11. Low

    GHSA-x2rc-v5wx-g3m5 · Mastodon

    Lack of sanitization of user-facing URLs for remote objects can lead to XSS in misconfigured servers

    Published 6 May 2025 · Fixed in 4.2.21 · Project advisories (GitHub)
  12. High 8.0

    CVE-2025-46815 · ZITADEL

    IdP Intent Token Reuse

    Published 6 May 2025 · Fixed in 2.70.10, 2.71.9 · NVD, Project advisories (GitHub)
  13. Medium 5.3

    CVE-2025-46736 · Umbraco CMS

    User Enumeration Feasible Based on Timing of Login Response

    Published 6 May 2025 · Fixed in 10.8.10, 13.8.1 · NVD, Project advisories (GitHub)
  14. High 7.5

    CVE-2025-46813 · Discourse

    Discourse is an open-source community platform. A data leak vulnerability affects sites deployed between commits 10df7fdee060d44accdee7679d66d778d1136510 and 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b. On login-required sites, the leak meant that some content on the site's homepage could be visible to unauthenticated users. Only login-required sites that got deployed during this timeframe are…

    Published 5 May 2025 · Fixed in 3.5.0 · NVD
  15. High 7.3

    CVE-2025-46731 · Craft CMS

    Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and `ALLOW_ADMIN_CHANGES` must be enabled for this to work. Users should update to the patched versions 4.14.13 or 5.6.15 to mitigate the issue.

    Published 5 May 2025 · Fixed in 4.14.13, 5.6.15 · NVD
  16. Medium 5.4

    CVE-2025-46719 · Open WebUI

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, a vulnerability in the way certain html tags in chat messages are rendered allows attackers to inject JavaScript code into a chat transcript. The JavaScript code will be executed in the user's browser every time that chat transcript is opened, allowing attackers to retrieve…

    Published 5 May 2025 · Fixed in 0.6.6 · NVD
  17. Medium 5.3

    CVE-2025-46571 · Open WebUI

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, low privileged users can upload HTML files which contain JavaScript code via the `/api/v1/files/` backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default…

    Published 5 May 2025 · Fixed in 0.6.6 · NVD
  18. Low 1.1

    CVE-2024-51991 · October CMS

    Unprotected SVG Rename in Media Manager

    Published 3 May 2025 · Fixed in 3.5.2, 3.7.5 · NVD, Project advisories (GitHub)
  19. Medium 5.3

    CVE-2024-55069 · FFmpeg

    ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c.

    Published 2 May 2025 · NVD
  20. Low 3.3

    CVE-2025-47226 · Snipe-IT

    Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.

    Published 2 May 2025 · Fixed in 8.1.0 · NVD
  21. High 8.8

    CVE-2025-3879 · HashiCorp Vault

    Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.

    Published 2 May 2025 · Fixed in 1.17.14, 1.18.7, 1.19.1 · NVD
  22. Medium 6.5

    CVE-2025-4166 · HashiCorp Vault, OpenBao

    Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.

    Published 2 May 2025 · Fixed in 1.18.9, 1.19.3, 2.2.2 · NVD
  23. Medium 4.3

    CVE-2025-25016 · Kibana

    Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.

    Published 1 May 2025 · Fixed in 7.17.19, 8.13.0 · NVD
  24. High 7.5

    CVE-2024-52979 · Elasticsearch

    Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.

    Published 1 May 2025 · Fixed in 7.17.25, 8.16.0 · NVD
  25. Medium 5.4

    CVE-2024-11390 · Kibana

    Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.

    Published 1 May 2025 · Fixed in 7.17.24, 8.12.0 · NVD
  26. Medium 4.8

    CVE-2025-32376 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable version 3.4.3 and beta version 3.5.0.beta3.

    Published 30 Apr 2025 · Fixed in 3.4.3 · NVD
  27. High

    CVE-2025-3501 · Keycloak

    Keycloak hostname verification

    Published 30 Apr 2025 · Fixed in 26.2.2 · Project advisories (GitHub)
  28. Medium

    CVE-2025-3910 · Keycloak

    Two factor authentication bypass

    Published 30 Apr 2025 · Fixed in 26.2.2 · Project advisories (GitHub)
  29. High 7.5

    CVE-2025-46560 · vLLM

    vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.8.0 and prior to 0.8.5 are affected by a critical performance vulnerability in the input preprocessing logic of the multimodal tokenizer. The code dynamically replaces placeholder tokens (e.g., <|audio_|>, <|image_|>) with repeated tokens based on precomputed lengths. Due to…

    Published 30 Apr 2025 · Fixed in 0.8.5 · NVD
  30. Critical 9.8

    CVE-2025-32444 · vLLM

    vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration with mooncake, are vulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. The vulnerable sockets were set to listen on all network interfaces, increasing the likelihood that an attacker…

    Published 30 Apr 2025 · Fixed in 0.8.5 · NVD
  31. High 7.5

    CVE-2025-30202 · vLLM

    vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vulnerable to denial of service and data exposure via ZeroMQ on multi-node vLLM deployment. In a multi-node vLLM deployment, vLLM uses ZeroMQ for some multi-node communication purposes. The primary vLLM host opens an XPUB ZeroMQ socket and binds it to ALL…

    Published 30 Apr 2025 · Fixed in 0.8.5 · NVD
  32. High 8.8

    CVE-2025-32354 · Zimbra Collaboration

    In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) of Zimbra webmail due to a lack of CSRF token validation. This allows attackers to perform unauthorized GraphQL operations, such as modifying contacts, changing account settings, and accessing sensitive user data when an authenticated user…

    Published 29 Apr 2025 · Fixed in 10.1.4 · NVD
  33. Medium 5.4

    CVE-2025-46343 · n8n

    n8n is a workflow automation platform. Prior to version 1.90.0, n8n is vulnerable to stored cross-site scripting (XSS) through the attachments view endpoint. n8n workflows can store and serve binary files, which are accessible to authenticated users. However, there is no restriction on the MIME type of uploaded files, and the MIME type could be controlled via a GET parameter. This allows the…

    Published 29 Apr 2025 · Fixed in 1.90.0 · NVD
  34. Medium 4.3

    CVE-2025-0049 · GoAnywhere MFT

    When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0.

    Published 28 Apr 2025 · Fixed in 7.8.0 · NVD
  35. Medium 5.4

    CVE-2024-11922 · GoAnywhere MFT

    Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email.

    Published 28 Apr 2025 · Fixed in 7.8.0 · NVD
  36. Critical 9.8

    CVE-2025-31651 · Apache Tomcat

    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from…

    Published 28 Apr 2025 · Fixed in 9.0.104, 10.1.40, 11.0.6 · NVD
  37. High 7.5

    CVE-2025-31650 · Apache Tomcat

    Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through…

    Published 28 Apr 2025 · Fixed in 9.0.104, 10.1.40, 11.0.6 · NVD
  38. Medium 6.1

    CVE-2025-46550 · YesWiki

    Reflected XSS (Unauthenticated) in Yeswiki v4.5.1

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  39. Medium 6.1

    CVE-2025-46549 · YesWiki

    Reflected XSS (Unauthenticated) in Yeswiki v4.5.1

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  40. Medium 4.8

    CVE-2025-46350 · YesWiki

    Reflected XSS (Authenticated) in Yeswiki v4.5.1

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  41. Medium 6.1

    CVE-2025-46349 · YesWiki

    Unauthenticated reflected XSS in YesWiki <= 4.5.3

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  42. Critical 9.8

    CVE-2025-46348 · YesWiki

    Uauthenticated Site Backup Creation and Download

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  43. Medium 5.8

    CVE-2025-46347 · YesWiki

    Remote Code Execution via Arbitrary PHP File Write and Execution

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  44. Medium 6.3

    CVE-2025-46346 · YesWiki

    Stored XSS in Comments

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  45. Low 2.3

    CVE-2025-43854 · Dify

    DIFY vulnerable to Clickjacking Attack

    Published 28 Apr 2025 · NVD, Project advisories (GitHub)
  46. Medium 4.5

    CVE-2025-46646 · Ghostscript

    In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.

    Published 26 Apr 2025 · Fixed in 10.05.0 · NVD
  47. Medium 6.1

    CVE-2025-46618 · TeamCity

    In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab

    Published 25 Apr 2025 · Fixed in 2025.03.1 · NVD
  48. Critical 9.8

    CVE-2025-46433 · TeamCity

    In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible

    Published 25 Apr 2025 · Fixed in 2025.03.1 · NVD
  49. Medium 6.5

    CVE-2025-46432 · TeamCity

    In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs

    Published 25 Apr 2025 · Fixed in 2025.03.1 · NVD
  50. Medium 4.3

    CVE-2025-3647 · Moodle

    A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to retrieve.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.