UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,071
Published in 7 days
802
Critical in 30 days
393
Actively exploited
420

Latest vulnerabilities

38,071 vulnerabilities
  1. High 8.8

    CVE-2025-3642 · Moodle

    A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers and managers on sites with the EQUELLA repository enabled.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  2. High 8.8

    CVE-2025-3641 · Moodle

    A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers and managers on sites with the Dropbox repository enabled.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  3. Medium 4.3

    CVE-2025-3640 · Moodle

    A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  4. High 8.8

    CVE-2025-3638 · Moodle

    A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery (CSRF) risk.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  5. Low 3.1

    CVE-2025-3637 · Moodle

    A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the mod_data module: edit and delete pages.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  6. Medium 4.3

    CVE-2025-3636 · Moodle

    A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  7. Low 3.5

    CVE-2025-3635 · Moodle

    A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery (CSRF) attacks.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  8. Medium 4.3

    CVE-2025-3628 · Moodle

    A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities.

    Published 25 Apr 2025 · Fixed in 4.5.4 · NVD
  9. Medium 4.3

    CVE-2025-3627 · Moodle

    A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their identities using two-factor authentication (2FA).

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  10. High 7.1

    CVE-2025-3625 · Moodle

    A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA).

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  11. Critical 10.0Actively exploited

    CVE-2025-32432 · Craft CMS

    Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an…

    Published 25 Apr 2025 · Fixed in 3.9.15, 4.14.15, 5.6.17 · NVD
  12. Medium 5.3

    CVE-2025-32045 · Moodle

    A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hidden grades.

    Published 25 Apr 2025 · Fixed in 4.3.11, 4.4.7, 4.5.3 · NVD
  13. High 7.5

    CVE-2025-32044 · Moodle

    A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites with PHP configured with zend.exception_ignore_args = 1 in the php.ini file are not affected by this vulnerability.

    Published 25 Apr 2025 · Fixed in 4.5.3 · NVD
  14. Medium 4.3

    CVE-2025-3634 · Moodle

    A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can sign up for courses prematurely, even if they haven't finished two-step verification processes.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  15. High 8.5

    CVE-2024-22031 · Rancher

    Users who can create Projects can gain access to arbitrary projects

    Published 25 Apr 2025 · Fixed in 2.9.9, 2.10.5, 2.11.1 · CVE Program, Project advisories (GitHub)
  16. High 7.6

    CVE-2025-43862 · Dify

    Unauthorized Access and Modification of APP Orchestration

    Published 25 Apr 2025 · Fixed in 0.6.12 · NVD, Project advisories (GitHub)
  17. High 7.7

    CVE-2025-1908 · GitLab

    An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

    Published 24 Apr 2025 · Fixed in 17.9.7, 17.10.5 · NVD
  18. High 7.5

    CVE-2025-0639 · GitLab

    An issue has been discovered affecting service availability via issue preview in GitLab CE/EE affecting all versions from 16.7 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

    Published 24 Apr 2025 · Fixed in 17.9.7, 17.10.5 · NVD
  19. Medium 4.3

    CVE-2024-12244 · GitLab

    An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1.

    Published 24 Apr 2025 · Fixed in 17.9.7, 17.10.5 · NVD
  20. Medium 4.3

    CVE-2025-41423 · Mattermost

    Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.

    Published 24 Apr 2025 · Fixed in 9.11.11, 10.4.3 · NVD
  21. High 7.5

    CVE-2025-41395 · Mattermost

    Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.

    Published 24 Apr 2025 · Fixed in 9.11.11, 10.4.3, 10.5.1 · NVD
  22. High 7.5

    CVE-2025-35965 · Mattermost

    Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.

    Published 24 Apr 2025 · Fixed in 9.11.11, 10.4.3 · NVD
  23. Medium 6.5

    CVE-2025-3775 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Server-Side Request Forgery (SSRF)

    Published 24 Apr 2025 · Fixed in 3.1.3 · WPVulnerability
  24. High 7.5

    CVE-2025-21605 · Valkey, Redis

    DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client

    Published 23 Apr 2025 · Fixed in 7.4.3, 8.0.3, 8.1.1 · NVD, Project advisories (GitHub)
  25. Medium 5.3

    CVE-2025-46393 · ImageMagick

    In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order).

    Published 23 Apr 2025 · Fixed in 7.1.1-44 · NVD
  26. High 7.5

    CVE-2025-43965 · ImageMagick

    In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.

    Published 23 Apr 2025 · Fixed in 7.1.1-44 · NVD
  27. Low 2.7

    CVE-2025-27907 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

    Published 22 Apr 2025 · Fixed in 8.5.5.28, 9.0.5.24 · NVD
  28. High 8.8

    CVE-2025-32431 · Traefik

    Path Matchers Vulnerability

    Published 21 Apr 2025 · Fixed in 2.11.24, 3.3.6, 3.4.0-rc2 · NVD, Project advisories (GitHub)
  29. Critical 9.1

    CVE-2025-22871 · Traefik

    Security Vulnerability: Go 1.23.x < 1.23.8 - HTTP Request Smuggling Vulnerability - 1.23.8

    Published 18 Apr 2025 · Fixed in 1.23.8 · Project advisories (GitHub)
  30. High 7.5

    CVE-2025-22868 · Traefik

    Fix CVE-2025-22868

    Published 18 Apr 2025 · Fixed in 0.27.0 · Project advisories (GitHub)
  31. Medium 6.5

    CVE-2025-32795 · Dify

    Insecure User Role Access Control for APP Editing

    Published 18 Apr 2025 · Fixed in 0.6.12 · NVD, Project advisories (GitHub)
  32. Medium 6.5

    CVE-2025-32796 · Dify

    Unauthorized APP Enable/Disable via API

    Published 18 Apr 2025 · NVD, Project advisories (GitHub)
  33. High 7.6

    CVE-2025-29460 · MyBB

    An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.

    Published 17 Apr 2025 · NVD
  34. High 7.6

    CVE-2025-29459 · MyBB

    An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.

    Published 17 Apr 2025 · NVD
  35. High 7.6

    CVE-2025-29458 · MyBB

    An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.

    Published 17 Apr 2025 · NVD
  36. High 7.6

    CVE-2025-29457 · MyBB

    An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.

    Published 17 Apr 2025 · NVD
  37. High 7.5

    CVE-2025-32415 · libxml2

    In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

    Published 17 Apr 2025 · Fixed in 2.13.8, 2.14.2 · NVD
  38. Medium 4.8

    CVE-2025-3760 · Liferay Portal / DXP

    A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA…

    Published 17 Apr 2025 · Fixed in 2024.Q1.13, 2024.q3.10, 2025.q1.0 · NVD
  39. Medium 4.3

    CVE-2025-32790 · Dify

    Insecure User Role Access Control for APP DSL Exporting

    Published 17 Apr 2025 · Fixed in 0.6.13 · NVD, Project advisories (GitHub)
  40. Critical 10.0Actively exploited

    CVE-2025-32433 · Erlang/OTP

    Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid…

    Published 16 Apr 2025 · Fixed in 25.3.2.20, 26.2.5.11, 27.3.3 · NVD
  41. Medium 4.3

    CVE-2025-2564 · Mattermost

    Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting, which allows authenticated users to view members and member information of archived channels even when this setting is disabled.

    Published 16 Apr 2025 · Fixed in 9.11.10, 10.4.4, 10.5.2 · NVD
  42. Medium 6.5

    CVE-2025-31363 · Mattermost

    Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool.

    Published 16 Apr 2025 · Fixed in 9.11.10, 10.4.3 · NVD
  43. Medium 5.9

    CVE-2025-27936 · Mattermost

    Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison.

    Published 16 Apr 2025 · Fixed in 10.5.2 · NVD
  44. Medium 4.3

    CVE-2025-27571 · Mattermost

    Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived.

    Published 16 Apr 2025 · Fixed in 9.11.10, 10.4.4, 10.5.2 · NVD
  45. Low 2.7

    CVE-2025-27538 · Mattermost

    Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with edit_other_users permission to activate or deactivate MFA for other users, even if those users have not set up MFA.

    Published 16 Apr 2025 · Fixed in 9.11.10, 10.5.2 · NVD
  46. Medium 4.3

    CVE-2025-24839 · Mattermost

    Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows users without access to the AI bot to activate it by attaching the activate_ai override property to a post via the Wrangler plugin, provided both the AI and Wrangler plugins are enabled.

    Published 16 Apr 2025 · Fixed in 9.11.10, 10.4.4, 10.5.2 · NVD
  47. Medium 6.5

    CVE-2025-39563 · Conditional Payments For Woocommerce (WordPress plugin)

    Conditional Payments for WooCommerce: Cross-Site Request Forgery (CSRF)

    Published 16 Apr 2025 · Fixed in 3.3.1 · WPVulnerability
  48. Medium 4.0

    CVE-2025-30721 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the…

    Published 15 Apr 2025 · NVD
  49. Medium 4.9

    CVE-2025-30715 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 15 Apr 2025 · NVD
  50. Medium 4.9

    CVE-2025-30705 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Apr 2025 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.