UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,074
Published in 7 days
683
Critical in 30 days
391
Actively exploited
420

Latest vulnerabilities

38,074 vulnerabilities
  1. Medium 5.4

    CVE-2025-30148 · Silverstripe CMS

    XSS vulnerability in HTML editor

    Published 10 Apr 2025 · Fixed in 5.3.23 · NVD, Project advisories (GitHub)
  2. Medium 6.8

    CVE-2025-27391 · Apache ActiveMQ Artemis

    Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users. Users are…

    Published 9 Apr 2025 · Fixed in 2.40.0 · NVD
  3. High 7.6

    CVE-2025-29189 · Flowise

    Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.

    Published 9 Apr 2025 · NVD
  4. Low 2.7

    CVE-2025-27192 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnerability to gain unauthorized access to protected resources by obtaining sensitive credential information. Exploitation of this issue does…

    Published 8 Apr 2025 · Fixed in 2.4.4 · NVD
  5. Medium 5.3

    CVE-2025-27191 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.

    Published 8 Apr 2025 · Fixed in 2.4.4 · NVD
  6. Medium 5.3

    CVE-2025-27190 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.

    Published 8 Apr 2025 · NVD
  7. Medium 4.3

    CVE-2025-27188 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.

    Published 8 Apr 2025 · Fixed in 2.4.4 · NVD
  8. Medium 6.8

    CVE-2025-30294 · Adobe ColdFusion

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security protections and gain unauthorized read access. Exploitation of this issue does not require user interaction and scope is changed.

    Published 8 Apr 2025 · NVD
  9. Medium 6.8

    CVE-2025-30293 · Adobe ColdFusion

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security protections and gain unauthorized write access. Exploitation of this issue does not require user interaction and scope is changed.

    Published 8 Apr 2025 · NVD
  10. Medium 6.1

    CVE-2025-30292 · Adobe ColdFusion

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 8 Apr 2025 · NVD
  11. Medium 5.5

    CVE-2025-30291 · Adobe ColdFusion

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. A low privileged attacker with local access could leverage this vulnerability to gain access to sensitive information which could be used to further compromise the system or bypass security mechanisms. Exploitation of this issue does not…

    Published 8 Apr 2025 · NVD
  12. High 8.7

    CVE-2025-30290 · Adobe ColdFusion

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnerability to bypass security protections and gain unauthorized write and delete access. Exploitation of this issue does not require…

    Published 8 Apr 2025 · NVD
  13. High 8.2

    CVE-2025-30289 · Adobe ColdFusion

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. A low privileged attacker with local access could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue…

    Published 8 Apr 2025 · NVD
  14. High 8.2

    CVE-2025-30288 · Adobe ColdFusion

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low privileged attacker with local access could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction in that a victim must be coerced into performing actions…

    Published 8 Apr 2025 · NVD
  15. High 8.2

    CVE-2025-30287 · Adobe ColdFusion

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. A low privileged attacker with local access could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction in that a victim must…

    Published 8 Apr 2025 · NVD
  16. High 8.4

    CVE-2025-30286 · Adobe ColdFusion

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. A high-privileged attacker could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user…

    Published 8 Apr 2025 · NVD
  17. High 8.4

    CVE-2025-30285 · Adobe ColdFusion

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction and scope is changed.

    Published 8 Apr 2025 · NVD
  18. High 8.4

    CVE-2025-30284 · Adobe ColdFusion

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction and scope is changed.

    Published 8 Apr 2025 · NVD
  19. Critical 9.1

    CVE-2025-30282 · Adobe ColdFusion

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass authentication mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

    Published 8 Apr 2025 · NVD
  20. Critical 9.1

    CVE-2025-30281 · Adobe ColdFusion

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction, and scope is changed.

    Published 8 Apr 2025 · NVD
  21. Critical 9.1

    CVE-2025-24447 · Adobe ColdFusion

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user resulting in a High impact to Confidentiality and Integrity. Exploitation of this issue does not require user interaction.

    Published 8 Apr 2025 · NVD
  22. Critical 9.1

    CVE-2025-24446 · Adobe ColdFusion

    ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution. Exploitation of this issue does not require user interaction, but admin panel privileges are required, and scope is changed.

    Published 8 Apr 2025 · NVD
  23. Critical 9.8

    CVE-2024-12556 · Kibana

    Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.

    Published 8 Apr 2025 · Fixed in 8.16.4, 8.17.2 · NVD
  24. High 7.5

    CVE-2025-26682 · .NET

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

    Published 8 Apr 2025 · Fixed in 8.0.15, 9.0.4 · NVD
  25. Medium 4.9

    CVE-2025-27085 · HPE ArubaOS

    Multiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device.

    Published 8 Apr 2025 · Fixed in 8.12.0.4, 10.4.1.7, 10.7.1.1 · NVD
  26. Medium 6.1

    CVE-2025-27084 · HPE ArubaOS

    A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack. Successful exploitation could enable the attacker to execute arbitrary script code in the victim's browser within the context of the affected interface.

    Published 8 Apr 2025 · Fixed in 8.12.0.4, 10.4.1.7, 10.7.1.1 · NVD
  27. High 7.2

    CVE-2025-27083 · HPE ArubaOS

    Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Successful exploitation of these vulnerabilities allows an Authenticated attacker to execute arbitrary commands as a privileged user on the underlying operating system.

    Published 8 Apr 2025 · Fixed in 8.12.0.4, 10.4.1.7, 10.7.1.1 · NVD
  28. High 7.2

    CVE-2025-27082 · HPE ArubaOS

    Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlying host operating system.

    Published 8 Apr 2025 · Fixed in 8.12.0.4, 10.4.1.7, 10.7.1.1 · NVD
  29. High 7.5

    CVE-2025-25227 · Joomla!

    Insufficient state checks lead to a vector that allows to bypass 2FA checks.

    Published 8 Apr 2025 · Fixed in 4.4.13, 5.2.6 · NVD
  30. Critical 9.8

    CVE-2025-25226 · Joomla!

    Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the…

    Published 8 Apr 2025 · Fixed in 2.2.0, 3.4.0 · NVD
  31. High 7.5

    CVE-2024-52981 · Elasticsearch

    An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.

    Published 8 Apr 2025 · Fixed in 7.17.24, 8.15.1 · NVD
  32. Medium 6.5

    CVE-2024-52980 · Elasticsearch

    A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.

    Published 8 Apr 2025 · Fixed in 8.15.1 · NVD
  33. Medium 6.5

    CVE-2024-52974 · Kibana

    An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permissions for Observability assigned to them.

    Published 8 Apr 2025 · Fixed in 7.17.23, 8.15.1 · NVD
  34. High 7.2

    CVE-2025-25254 · Fortinet FortiWeb

    An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, 7.2 all versions, 7.0 all versions endpoint may allow an authenticated admin to access and modify the filesystem via crafted requests.

    Published 8 Apr 2025 · Fixed in 7.4.7, 7.6.3 · NVD
  35. High 7.5

    CVE-2024-50565 · Fortinet FortiProxy, Fortinet FortiWeb, Fortinet FortiOS

    A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15 and 6.2.0 through 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.15 and 2.0.0 through 2.0.14, Fortinet FortiManager version 7.4.0 through…

    Published 8 Apr 2025 · Fixed in 7.2.10, 7.4.3, 7.4.5 · NVD
  36. High 7.2

    CVE-2024-46671 · Fortinet FortiWeb

    An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an authenticated attacker with at least read-only admin permission to perform operations on the dashboard of other administrators via crafted requests.

    Published 8 Apr 2025 · Fixed in 7.2.11, 7.4.7, 7.6.3 · NVD
  37. Medium 4.4

    CVE-2024-32122 · Fortinet FortiOS

    A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to information disclosure via modification of LDAP server IP to point to a malicious server.

    Published 8 Apr 2025 · NVD
  38. High 7.5

    CVE-2024-26013 · Fortinet FortiProxy, Fortinet FortiWeb, Fortinet FortiOS

    A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15 and before 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9 and before 7.0.15, Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0…

    Published 8 Apr 2025 · Fixed in 7.2.10, 7.4.3, 7.4.5 · NVD
  39. High 8.8

    CVE-2023-37930 · Fortinet FortiProxy, Fortinet FortiOS

    Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities vulnerability in Fortinet allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests.

    Published 8 Apr 2025 · Fixed in 7.0.13, 7.2.6, 7.2.7 · NVD
  40. High 8.3

    CVE-2025-31498 · c-ares

    Use after free in read_answers()

    Published 8 Apr 2025 · Fixed in 1.34.5 · Project advisories (GitHub)
  41. Medium 6.9

    CVE-2025-32378 · Shopware

    Default newsletter opt-in settings allow for mass sign-up abuse

    Published 8 Apr 2025 · Fixed in 6.5.8.17, 6.6.10.3 · NVD, Project advisories (GitHub)
  42. Medium 4.0

    GHSA-68wv-g3fw-pq7q · Shopware

    Broken ACL on Document retrieval to access other customers documents

    Published 8 Apr 2025 · Fixed in 6.5.8.17 · Project advisories (GitHub)
  43. Medium 5.5

    CVE-2025-30150 · Shopware

    Check for registered accounts through the store-api

    Published 8 Apr 2025 · Fixed in 6.5.8.18, 6.6.10.3 · NVD, Project advisories (GitHub)
  44. High 7.5

    CVE-2025-30151 · Shopware

    Denial Of Service via password length

    Published 8 Apr 2025 · Fixed in 6.5.8.17, 6.6.10.3 · NVD, Project advisories (GitHub)
  45. Medium 6.8

    CVE-2025-27892 · Shopware

    Blind SQL-injection in DAL aggregations

    Published 8 Apr 2025 · Fixed in 6.5.8.17, 6.5.8.18, 6.6.10.3 · NVD, Project advisories (GitHub)
  46. High 7.5

    CVE-2025-32374 · DNN Platform

    Possible Denial of Service (DoS) in DNN.PLATFORM registration

    Published 8 Apr 2025 · Fixed in 9.13.8 · NVD, Project advisories (GitHub)
  47. High 8.8

    CVE-2025-32017 · Umbraco CMS

    Management API Vulnerability to Path Traversal With Authenticated Users

    Published 8 Apr 2025 · Fixed in 14.3.4, 15.3.1 · NVD, Project advisories (GitHub)
  48. Medium 6.5

    CVE-2025-32373 · DNN Platform

    A registered user may enumerate and access files they should not have access to

    Published 8 Apr 2025 · Fixed in 9.13.8 · NVD, Project advisories (GitHub)
  49. High 7.5

    CVE-2025-32372 · DNN Platform

    Server-Side Request Forgery (SSRF) in DotNetNuke.Core

    Published 8 Apr 2025 · Fixed in 9.13.8 · NVD, Project advisories (GitHub)
  50. Medium 4.3

    CVE-2025-32371 · DNN Platform

    Unexpected external content may be displayed in ImageHandler

    Published 8 Apr 2025 · Fixed in 9.13.4 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.