UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
214
Critical in 30 days
41
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. High 7.5

    CVE-2026-34651 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  2. High 7.5

    CVE-2026-34650 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  3. High 7.5

    CVE-2026-34649 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  4. High 7.5

    CVE-2026-34648 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  5. High 7.4

    CVE-2026-34647 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue requires user interaction in that a victim…

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  6. High 7.5

    CVE-2026-34646 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  7. High 7.5

    CVE-2026-34645 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

    Published 12 May 2026 · Fixed in 2.4.4, 2.4.6 · NVD
  8. High 7.5

    CVE-2026-42899 · .NET

    Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.

    Published 12 May 2026 · Fixed in 8.0.27, 9.0.16, 10.0.8 · NVD
  9. High 7.3

    CVE-2026-35433 · .NET

    Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.

    Published 12 May 2026 · Fixed in 8.0.27, 9.0.16, 10.0.8 · NVD
  10. High 7.3

    CVE-2026-32177 · .NET

    Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.

    Published 12 May 2026 · Fixed in 8.0.27, 9.0.16, 10.0.8 · NVD
  11. Medium 4.3

    CVE-2026-32175 · .NET

    A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a…

    Published 12 May 2026 · Fixed in 8.0.27, 9.0.16 · NVD
  12. Critical 9.1

    CVE-2026-43515 · Apache Tomcat

    Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which…

    Published 12 May 2026 · Fixed in 9.0.118, 10.1.55, 11.0.22 · NVD
  13. Low 3.7

    CVE-2026-43514 · Apache Tomcat

    Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118…

    Published 12 May 2026 · Fixed in 9.0.118, 10.1.55, 11.0.22 · NVD
  14. High 7.5

    CVE-2026-43513 · Apache Tomcat

    Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which…

    Published 12 May 2026 · Fixed in 9.0.118, 10.1.55, 11.0.22 · NVD
  15. Critical 9.8

    CVE-2026-43512 · Apache Tomcat

    DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also be affect Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which…

    Published 12 May 2026 · Fixed in 9.0.118, 10.1.55, 11.0.22 · NVD
  16. High 7.3

    CVE-2026-42498 · Apache Tomcat

    Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.

    Published 12 May 2026 · Fixed in 9.0.118, 10.1.55, 11.0.22 · NVD
  17. Critical 9.8

    CVE-2026-41293 · Apache Tomcat

    Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

    Published 12 May 2026 · Fixed in 9.0.118, 10.1.55, 11.0.22 · NVD
  18. High 7.5

    CVE-2026-41284 · Apache Tomcat

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

    Published 12 May 2026 · Fixed in 9.0.118, 10.1.55, 11.0.22 · NVD
  19. Medium 6.3

    CVE-2026-7210 · Python

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

    Published 11 May 2026 · Fixed in 3.13.14, 3.14.6 · NVD
  20. Unrated

    CVE-2026-34095 · MediaWiki

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    Published 11 May 2026 · Fixed in 1.43.7, 1.44.4, 1.45.2 · NVD
  21. Low 2.0

    CVE-2026-34094 · MediaWiki

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    Published 11 May 2026 · Fixed in 1.43.7, 1.44.4, 1.45.2 · NVD
  22. Low 1.1

    CVE-2026-34093 · MediaWiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    Published 11 May 2026 · Fixed in 1.43.7, 1.44.4, 1.45.2 · NVD
  23. High 7.5

    CVE-2026-45109 · Next.js

    Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

    Published 11 May 2026 · Fixed in 15.5.18, 16.2.6 · OSV.dev and GitHub
  24. Low 2.1

    CVE-2026-34092 · MediaWiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    Published 11 May 2026 · Fixed in 1.43.7, 1.44.4, 1.45.2 · NVD
  25. Medium 5.5

    CVE-2026-34091 · MediaWiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    Published 11 May 2026 · Fixed in 1.43.7, 1.44.4, 1.45.2 · NVD
  26. Low 1.3

    CVE-2026-34088 · MediaWiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    Published 11 May 2026 · Fixed in 1.43.7, 1.44.4, 1.45.2 · NVD
  27. Medium 5.1

    CVE-2026-34087 · MediaWiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.

    Published 11 May 2026 · Fixed in 1.43.7, 1.44.4, 1.45.2 · NVD
  28. Low 3.7

    CVE-2026-44572 · Next.js

    Next.js's Middleware / Proxy redirects can be cache-poisoned

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  29. Medium 4.7

    CVE-2026-44581 · Next.js

    Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  30. Low 3.7

    CVE-2026-44582 · Next.js

    Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  31. Medium 6.1

    CVE-2026-44580 · Next.js

    Next.js has cross-site scripting in beforeInteractive scripts with untrusted input

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  32. High 7.5

    CVE-2026-44579 · Next.js

    Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  33. Medium 5.9

    CVE-2026-44577 · Next.js

    Next.js has a Denial of Service in the Image Optimization API

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  34. High 8.6

    CVE-2026-44578 · Next.js

    Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  35. Medium 5.4

    CVE-2026-44576 · Next.js

    Next.js vulnerable to cache poisoning in React Server Component responses

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  36. High 7.5

    CVE-2026-44575 · Next.js

    Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  37. High 8.1

    CVE-2026-44574 · Next.js

    Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  38. High 7.5

    CVE-2026-44573 · Next.js

    Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  39. High 7.5

    GHSA-8h8q-6873-q5fj · Next.js

    Next.js Vulnerable to Denial of Service with Server Components

    Published 11 May 2026 · Fixed in 15.5.16, 16.2.5 · OSV.dev and GitHub
  40. High 7.5

    CVE-2026-23870 · react-server-dom-parcel, react-server-dom-turbopack, React

    Facebook React has a Denial of Service Vulnerability in React Server Components

    Published 11 May 2026 · Fixed in 19.0.6, 19.1.7, 19.2.6 · OSV.dev and GitHub
  41. Medium 6.3

    CVE-2026-7263 · PHP

    In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.

    Published 10 May 2026 · Fixed in 8.4.21, 8.5.6 · NVD
  42. Medium 6.3

    CVE-2026-6104 · PHP

    In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or…

    Published 10 May 2026 · Fixed in 8.4.21, 8.5.6 · NVD
  43. Medium 6.3

    CVE-2026-7568 · PHP

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds…

    Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD
  44. Low 2.9

    CVE-2026-7262 · PHP

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element.  This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP…

    Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD
  45. Medium 6.3

    CVE-2026-7261 · PHP

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which…

    Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD
  46. Low 2.1

    CVE-2026-7259 · PHP

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to  a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().

    Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD
  47. Medium 6.3

    CVE-2026-7258 · PHP

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.

    Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD
  48. High 7.3

    CVE-2026-6735 · PHP

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

    Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD
  49. Critical 9.5

    CVE-2026-6722 · PHP

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP…

    Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD
  50. High 7.4

    CVE-2025-14179 · PHP

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as…

    Published 10 May 2026 · Fixed in 8.3.31, 8.4.21, 8.5.6 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.