UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,077
Published in 7 days
681
Critical in 30 days
391
Actively exploited
420

Latest vulnerabilities

38,077 vulnerabilities
  1. Medium 6.5

    CVE-2025-32373 · DNN Platform

    A registered user may enumerate and access files they should not have access to

    Published 8 Apr 2025 · Fixed in 9.13.8 · NVD, Project advisories (GitHub)
  2. High 7.5

    CVE-2025-32372 · DNN Platform

    Server-Side Request Forgery (SSRF) in DotNetNuke.Core

    Published 8 Apr 2025 · Fixed in 9.13.8 · NVD, Project advisories (GitHub)
  3. Medium 4.3

    CVE-2025-32371 · DNN Platform

    Unexpected external content may be displayed in ImageHandler

    Published 8 Apr 2025 · Fixed in 9.13.4 · NVD, Project advisories (GitHub)
  4. Medium 6.5

    CVE-2025-32036 · DNN Platform

    The possibility of bypassing Captcha

    Published 8 Apr 2025 · Fixed in 9.13.8 · NVD, Project advisories (GitHub)
  5. High 7.5

    CVE-2025-32414 · libxml2

    In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.

    Published 8 Apr 2025 · Fixed in 2.13.8, 2.14.2 · NVD
  6. High 7.5

    CVE-2025-32035 · DNN Platform

    File contents aren't checked when uploading files

    Published 8 Apr 2025 · Fixed in 9.13.2 · NVD, Project advisories (GitHub)
  7. High 7.5

    CVE-2025-29087 · SQLite

    In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.

    Published 7 Apr 2025 · Fixed in 3.49.1 · NVD
  8. High 8.5

    CVE-2025-29769 · libvips

    Potential heap-based buffer overflow when attempting to convert multiband TIFF input to HEIF output

    Published 7 Apr 2025 · Fixed in 8.16.1 · NVD, Project advisories (GitHub)
  9. Critical 9.8Actively exploited

    CVE-2025-3248 · Langflow

    Langflow Unauth RCE

    Published 7 Apr 2025 · Fixed in 1.3.0 · NVD, Project advisories (GitHub)
  10. Critical 9.2

    CVE-2024-11235 · PHP

    In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.

    Published 4 Apr 2025 · Fixed in 8.3.19, 8.4.5 · NVD
  11. Critical 9.8Actively exploited

    CVE-2025-31161 · CrushFTP

    CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies…

    Published 3 Apr 2025 · Fixed in 10.8.4, 11.3.1 · NVD
  12. Critical 9.8Actively exploited

    CVE-2025-22457 · Ivanti Connect Secure

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

    Published 3 Apr 2025 · Fixed in 22.7 · NVD
  13. High 8.8

    CVE-2024-4877 · OpenVPN

    OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges

    Published 3 Apr 2025 · Fixed in 2.6.11 · NVD
  14. Medium 6.1

    CVE-2025-2946 · pgAdmin

    pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.

    Published 3 Apr 2025 · NVD
  15. High 8.8

    CVE-2025-2945 · pgAdmin

    Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects…

    Published 3 Apr 2025 · Fixed in 9.2 · NVD
  16. High 7.5

    CVE-2024-53868 · Apache Traffic Server

    Apache Traffic Server allows request smuggling if chunked messages are malformed.  This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through 10.0.4. Users are recommended to upgrade to version 9.2.10 or 10.0.5, which fixes the issue.

    Published 3 Apr 2025 · Fixed in 9.2.10, 10.0.5 · NVD
  17. Medium 5.1

    CVE-2025-3153 · Concrete CMS

    Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not properly sanitized in the output when a country is not specified.  Attackers are limited to individuals whom a site administrator has granted the ability to fill in an address attribute. It is possible for the attacker to glean limited…

    Published 3 Apr 2025 · Fixed in 8.5.20, 9.4.0 · NVD
  18. High 7.5

    CVE-2025-2704 · OpenVPN

    OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase

    Published 2 Apr 2025 · NVD
  19. Low

    CVE-2025-30218 · Next.js

    x-middleware-subrequest-id may be leaked to external hosts

    Published 2 Apr 2025 · Fixed in 12.3.6 · Project advisories (GitHub)
  20. Medium 4.3

    CVE-2025-31721 · Jenkins

    A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration.

    Published 2 Apr 2025 · Fixed in 2.492.3, 2.504 · NVD
  21. Medium 4.3

    CVE-2025-31720 · Jenkins

    A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration.

    Published 2 Apr 2025 · Fixed in 2.492.3, 2.504 · NVD
  22. Medium 6.0

    CVE-2024-45700 · Zabbix

    Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an excessive amount of memory and perform CPU-intensive decompression operations, ultimately leading to a service crash.

    Published 2 Apr 2025 · Fixed in 6.0.39, 7.0.10, 7.2.4 · NVD
  23. High 7.5

    CVE-2024-45699 · Zabbix

    The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.

    Published 2 Apr 2025 · Fixed in 6.0.37, 6.4.21, 7.0.7 · NVD
  24. Low 2.1

    CVE-2024-42325 · Zabbix

    Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.

    Published 2 Apr 2025 · Fixed in 6.0.38, 7.0.9, 7.2.3 · NVD
  25. Low 2.3

    CVE-2024-36469 · Zabbix

    Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.

    Published 2 Apr 2025 · Fixed in 6.0.38, 7.0.9, 7.2.3 · NVD
  26. High 8.6

    CVE-2024-36465 · Zabbix

    A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter.

    Published 2 Apr 2025 · Fixed in 7.2.2 · NVD
  27. Medium 6.1

    CVE-2025-30676 · Apache OFBiz

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19. Users are recommended to upgrade to version 18.12.19, which fixes the issue.

    Published 1 Apr 2025 · Fixed in 18.12.19 · NVD
  28. Critical 9.8

    CVE-2025-3085 · MongoDB

    A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to improper authentication. This issue may also affect intra-cluster authentication. This issue affects…

    Published 1 Apr 2025 · Fixed in 6.0.20, 7.0.16, 8.0.4 · NVD
  29. Medium 6.5

    CVE-2025-3084 · MongoDB

    When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Server v8.0 prior to 8.0.4

    Published 1 Apr 2025 · Fixed in 6.0.20, 7.0.16, 8.0.4 · NVD
  30. High 7.5

    CVE-2025-3083 · MongoDB

    Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31,  MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to 7.0.16

    Published 1 Apr 2025 · Fixed in 5.0.31, 6.0.20, 7.0.16 · NVD
  31. Medium 5.4

    CVE-2025-3082 · MongoDB

    A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, MongoDB Server v7.0 version prior to 7.0.14 and MongoDB Server v7.3 versions prior to 7.3.4.

    Published 1 Apr 2025 · Fixed in 6.0.20, 7.0.14, 7.3.4 · NVD
  32. High 7.5

    CVE-2025-31131 · YesWiki

    Path Traversal allowing arbitrary read of files in Yeswiki v4.5.1

    Published 1 Apr 2025 · Fixed in 4.5.2 · NVD, Project advisories (GitHub)
  33. Low 2.3

    CVE-2025-27427 · Apache ActiveMQ Artemis

    A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message…

    Published 1 Apr 2025 · Fixed in 2.40.0 · NVD
  34. Medium 6.1

    CVE-2025-3057 · Drupal

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

    Published 31 Mar 2025 · Fixed in 10.4.3, 11.0.12, 11.1.3 · NVD
  35. Medium 5.4

    CVE-2025-31675 · Drupal

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12.

    Published 31 Mar 2025 · Fixed in 10.4.5, 11.0.13, 11.1.5 · NVD
  36. High 7.5

    CVE-2025-31674 · Drupal

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

    Published 31 Mar 2025 · Fixed in 10.4.3, 11.0.12, 11.1.3 · NVD
  37. Medium 4.6

    CVE-2025-31673 · Drupal

    Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

    Published 31 Mar 2025 · Fixed in 10.4.3, 11.0.12, 11.1.3 · NVD
  38. Medium 5.3

    CVE-2025-31124 · ZITADEL

    User Enumeration by loginname attribute normalization

    Published 31 Mar 2025 · Fixed in 2.69.9, 2.70.8, 2.71.6 · NVD, Project advisories (GitHub)
  39. High 8.7

    CVE-2025-31123 · ZITADEL

    Expired JWT Keys Usable for Authorization Grants

    Published 31 Mar 2025 · Fixed in 2.69.9, 2.70.8, 2.71.6 · NVD, Project advisories (GitHub)
  40. Critical 9.1

    CVE-2025-23391 · Rancher

    Restricted Administrator can change Administrator's passwords

    Published 31 Mar 2025 · Fixed in 2.9.8, 2.10.4, 2.11.0 · Project advisories (GitHub)
  41. Medium 6.3

    CVE-2025-1861 · PHP

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting…

    Published 30 Mar 2025 · Fixed in 8.2.26, 8.3.14, 8.4.5 · NVD
  42. Medium 6.3

    CVE-2025-1736 · PHP

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.

    Published 30 Mar 2025 · Fixed in 8.2.28, 8.3.19, 8.4.5 · NVD
  43. Medium 6.3

    CVE-2025-1734 · PHP

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

    Published 30 Mar 2025 · Fixed in 8.2.28, 8.3.19, 8.4.5 · NVD
  44. Medium 6.3

    CVE-2025-1219 · PHP

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.

    Published 30 Mar 2025 · Fixed in 8.2.28, 8.3.19, 8.4.5 · NVD
  45. Medium 6.3

    CVE-2025-1217 · PHP

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.

    Published 29 Mar 2025 · Fixed in 8.2.28, 8.3.19, 8.4.5 · NVD
  46. Medium 6.7

    GHSA-hx7h-9vf7-5xhg · Uptime Kuma

    Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

    Published 29 Mar 2025 · Project advisories (GitHub)
  47. High 8.0

    CVE-2025-29928 · authentik

    Deletion of sessions did not revoke sessions when using database session storage

    Published 28 Mar 2025 · Fixed in 2024.12.4, 2025.2.3 · NVD, Project advisories (GitHub)
  48. Medium 6.5

    CVE-2024-12619 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects.

    Published 28 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  49. Medium 5.5

    CVE-2024-10307 · GitLab

    An issue has been discovered in GitLab EE/CE affecting all versions from 12.10 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A maliciously crafted file can cause uncontrolled CPU consumption when viewing the associated merge request.

    Published 28 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  50. Low 2.1

    CVE-2025-30371 · Metabase

    It's possible to circumvent local link access protection in GeoJson endpoint

    Published 28 Mar 2025 · Fixed in 52.16.4 · Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.