UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,037
Published in 7 days
805
Critical in 30 days
393
Actively exploited
420

Latest vulnerabilities

38,037 vulnerabilities
  1. Medium 6.1

    CVE-2025-46550 · YesWiki

    Reflected XSS (Unauthenticated) in Yeswiki v4.5.1

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  2. Medium 6.1

    CVE-2025-46549 · YesWiki

    Reflected XSS (Unauthenticated) in Yeswiki v4.5.1

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  3. Medium 4.8

    CVE-2025-46350 · YesWiki

    Reflected XSS (Authenticated) in Yeswiki v4.5.1

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  4. Medium 6.1

    CVE-2025-46349 · YesWiki

    Unauthenticated reflected XSS in YesWiki <= 4.5.3

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  5. Critical 9.8

    CVE-2025-46348 · YesWiki

    Uauthenticated Site Backup Creation and Download

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  6. Medium 5.8

    CVE-2025-46347 · YesWiki

    Remote Code Execution via Arbitrary PHP File Write and Execution

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  7. Medium 6.3

    CVE-2025-46346 · YesWiki

    Stored XSS in Comments

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  8. Low 2.3

    CVE-2025-43854 · Dify

    DIFY vulnerable to Clickjacking Attack

    Published 28 Apr 2025 · NVD, Project advisories (GitHub)
  9. Medium 4.5

    CVE-2025-46646 · Ghostscript

    In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.

    Published 26 Apr 2025 · Fixed in 10.05.0 · NVD
  10. Medium 6.1

    CVE-2025-46618 · TeamCity

    In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab

    Published 25 Apr 2025 · Fixed in 2025.03.1 · NVD
  11. Critical 9.8

    CVE-2025-46433 · TeamCity

    In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible

    Published 25 Apr 2025 · Fixed in 2025.03.1 · NVD
  12. Medium 6.5

    CVE-2025-46432 · TeamCity

    In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs

    Published 25 Apr 2025 · Fixed in 2025.03.1 · NVD
  13. Medium 4.3

    CVE-2025-3647 · Moodle

    A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to retrieve.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  14. Medium 4.3

    CVE-2025-3645 · Moodle

    A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online statuses.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  15. Medium 4.3

    CVE-2025-3644 · Moodle

    A flaw was found in Moodle. Additional checks were required to prevent users from deleting course sections they did not have permission to modify.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  16. Medium 5.4

    CVE-2025-3643 · Moodle

    A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting (XSS) risk.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  17. High 8.8

    CVE-2025-3642 · Moodle

    A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers and managers on sites with the EQUELLA repository enabled.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  18. High 8.8

    CVE-2025-3641 · Moodle

    A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers and managers on sites with the Dropbox repository enabled.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  19. Medium 4.3

    CVE-2025-3640 · Moodle

    A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  20. High 8.8

    CVE-2025-3638 · Moodle

    A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery (CSRF) risk.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  21. Low 3.1

    CVE-2025-3637 · Moodle

    A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the mod_data module: edit and delete pages.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  22. Medium 4.3

    CVE-2025-3636 · Moodle

    A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  23. Low 3.5

    CVE-2025-3635 · Moodle

    A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery (CSRF) attacks.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  24. Medium 4.3

    CVE-2025-3628 · Moodle

    A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities.

    Published 25 Apr 2025 · Fixed in 4.5.4 · NVD
  25. Medium 4.3

    CVE-2025-3627 · Moodle

    A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their identities using two-factor authentication (2FA).

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  26. High 7.1

    CVE-2025-3625 · Moodle

    A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA).

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  27. Critical 10.0Actively exploited

    CVE-2025-32432 · Craft CMS

    Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an…

    Published 25 Apr 2025 · Fixed in 3.9.15, 4.14.15, 5.6.17 · NVD
  28. Medium 5.3

    CVE-2025-32045 · Moodle

    A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hidden grades.

    Published 25 Apr 2025 · Fixed in 4.3.11, 4.4.7, 4.5.3 · NVD
  29. High 7.5

    CVE-2025-32044 · Moodle

    A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites with PHP configured with zend.exception_ignore_args = 1 in the php.ini file are not affected by this vulnerability.

    Published 25 Apr 2025 · Fixed in 4.5.3 · NVD
  30. Medium 4.3

    CVE-2025-3634 · Moodle

    A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can sign up for courses prematurely, even if they haven't finished two-step verification processes.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  31. High 8.5

    CVE-2024-22031 · Rancher

    Users who can create Projects can gain access to arbitrary projects

    Published 25 Apr 2025 · Fixed in 2.9.9, 2.10.5, 2.11.1 · CVE Program, Project advisories (GitHub)
  32. High 7.6

    CVE-2025-43862 · Dify

    Unauthorized Access and Modification of APP Orchestration

    Published 25 Apr 2025 · Fixed in 0.6.12 · NVD, Project advisories (GitHub)
  33. High 7.7

    CVE-2025-1908 · GitLab

    An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

    Published 24 Apr 2025 · Fixed in 17.9.7, 17.10.5 · NVD
  34. High 7.5

    CVE-2025-0639 · GitLab

    An issue has been discovered affecting service availability via issue preview in GitLab CE/EE affecting all versions from 16.7 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

    Published 24 Apr 2025 · Fixed in 17.9.7, 17.10.5 · NVD
  35. Medium 4.3

    CVE-2024-12244 · GitLab

    An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1.

    Published 24 Apr 2025 · Fixed in 17.9.7, 17.10.5 · NVD
  36. Medium 4.3

    CVE-2025-41423 · Mattermost

    Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.

    Published 24 Apr 2025 · Fixed in 9.11.11, 10.4.3 · NVD
  37. High 7.5

    CVE-2025-41395 · Mattermost

    Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.

    Published 24 Apr 2025 · Fixed in 9.11.11, 10.4.3, 10.5.1 · NVD
  38. High 7.5

    CVE-2025-35965 · Mattermost

    Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.

    Published 24 Apr 2025 · Fixed in 9.11.11, 10.4.3 · NVD
  39. Medium 6.5

    CVE-2025-3775 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Server-Side Request Forgery (SSRF)

    Published 24 Apr 2025 · Fixed in 3.1.3 · WPVulnerability
  40. High 7.5

    CVE-2025-21605 · Valkey, Redis

    DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client

    Published 23 Apr 2025 · Fixed in 7.4.3, 8.0.3, 8.1.1 · NVD, Project advisories (GitHub)
  41. Medium 5.3

    CVE-2025-46393 · ImageMagick

    In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).

    Published 23 Apr 2025 · Fixed in 7.1.1-44 · NVD
  42. High 7.5

    CVE-2025-43965 · ImageMagick

    In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.

    Published 23 Apr 2025 · Fixed in 7.1.1-44 · NVD
  43. Low 2.7

    CVE-2025-27907 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

    Published 22 Apr 2025 · Fixed in 8.5.5.28, 9.0.5.24 · NVD
  44. High 8.8

    CVE-2025-32431 · Traefik

    Path Matchers Vulnerability

    Published 21 Apr 2025 · Fixed in 2.11.24, 3.3.6, 3.4.0-rc2 · NVD, Project advisories (GitHub)
  45. Critical 9.1

    CVE-2025-22871 · Traefik

    Security Vulnerability: Go 1.23.x < 1.23.8 - HTTP Request Smuggling Vulnerability - 1.23.8

    Published 18 Apr 2025 · Fixed in 1.23.8 · Project advisories (GitHub)
  46. High 7.5

    CVE-2025-22868 · Traefik

    Fix CVE-2025-22868

    Published 18 Apr 2025 · Fixed in 0.27.0 · Project advisories (GitHub)
  47. Medium 6.5

    CVE-2025-32795 · Dify

    Insecure User Role Access Control for APP Editing

    Published 18 Apr 2025 · Fixed in 0.6.12 · NVD, Project advisories (GitHub)
  48. Medium 6.5

    CVE-2025-32796 · Dify

    Unauthorized APP Enable/Disable via API

    Published 18 Apr 2025 · NVD, Project advisories (GitHub)
  49. High 7.6

    CVE-2025-29460 · MyBB

    An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.

    Published 17 Apr 2025 · NVD
  50. High 7.6

    CVE-2025-29459 · MyBB

    An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.

    Published 17 Apr 2025 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.