UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,081
Published in 7 days
676
Critical in 30 days
391
Actively exploited
420

Latest vulnerabilities

38,081 vulnerabilities
  1. High 8.0

    CVE-2025-29928 · authentik

    Deletion of sessions did not revoke sessions when using database session storage

    Published 28 Mar 2025 · Fixed in 2024.12.4, 2025.2.3 · NVD, Project advisories (GitHub)
  2. Medium 6.5

    CVE-2024-12619 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects.

    Published 28 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  3. Medium 5.5

    CVE-2024-10307 · GitLab

    An issue has been discovered in GitLab EE/CE affecting all versions from 12.10 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A maliciously crafted file can cause uncontrolled CPU consumption when viewing the associated merge request.

    Published 28 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  4. Low 2.1

    CVE-2025-30371 · Metabase

    It's possible to circumvent local link access protection in GeoJson endpoint

    Published 28 Mar 2025 · Fixed in 52.16.4 · Project advisories (GitHub)
  5. High 7.8

    CVE-2025-30232 · Exim

    A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges.

    Published 28 Mar 2025 · NVD
  6. Medium 6.5

    CVE-2025-2867 · GitLab

    An issue has been discovered in the GitLab Duo with Amazon Q affecting all versions from 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A specifically crafted issue could manipulate AI-assisted development features to potentially expose sensitive project data to unauthorized users.

    Published 27 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  7. Medium 5.4

    CVE-2025-2255 · GitLab

    An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks (XSS). for AppSec.

    Published 27 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  8. High 8.8

    CVE-2025-2242 · GitLab

    An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to groups and projects.

    Published 27 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  9. Medium 5.4

    CVE-2025-0811 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering of certain file types leads to cross-site scripting.

    Published 27 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  10. High 8.0

    CVE-2024-9773 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions starting from 17.10 before 17.10.1. An input validation issue in the Harbor registry integration could have allowed a maintainer to add malicious code to the CLI commands shown in the UI.

    Published 27 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  11. High 7.5

    CVE-2025-31141 · TeamCity

    In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page

    Published 27 Mar 2025 · Fixed in 2025.03 · NVD
  12. Medium 6.1

    CVE-2025-31140 · TeamCity

    In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page

    Published 27 Mar 2025 · Fixed in 2025.03 · NVD
  13. Medium 6.5

    CVE-2025-31139 · TeamCity

    In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log

    Published 27 Mar 2025 · Fixed in 2025.03 · NVD
  14. High 7.2

    CVE-2025-30773 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Deserialization of Untrusted Data

    Published 27 Mar 2025 · Fixed in 2.9.7 · WPVulnerability
  15. Medium 6.5

    CVE-2025-20230 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could edit and delete other user data in App Key Value Store (KVStore) collections that the Splunk Secure Gateway app created. This is due to missing access…

    Published 26 Mar 2025 · Fixed in 9.2.5, 9.3.3, 9.4.1 · NVD
  16. Medium 5.7

    CVE-2025-20232 · Splunk Enterprise

    In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208 and 9.1.2308.212, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on…

    Published 26 Mar 2025 · Fixed in 9.1.8, 9.2.5, 9.3.3 · NVD
  17. Medium 5.7

    CVE-2025-20231 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a search using the permissions of a higher-privileged user that could lead to disclosure of sensitive information.<br><br>The vulnerability…

    Published 26 Mar 2025 · Fixed in 9.1.8, 9.2.5, 9.3.3 · NVD
  18. High 8.0

    CVE-2025-20229 · Splunk Enterprise

    In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) through a file upload to the "$SPLUNK_HOME/var/run/splunk/apptemp" directory due to missing authorization checks.

    Published 26 Mar 2025 · Fixed in 9.1.8, 9.2.5, 9.3.3 · NVD
  19. Medium 6.5

    CVE-2025-20228 · Splunk Enterprise

    In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF).

    Published 26 Mar 2025 · Fixed in 9.1.8, 9.2.5, 9.3.3 · NVD
  20. Medium 4.3

    CVE-2025-20227 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could bypass the external content warning modal dialog box in Dashboard Studio dashboards which could lead to an information disclosure.

    Published 26 Mar 2025 · Fixed in 9.1.8, 9.2.4, 9.3.3 · NVD
  21. Medium 5.7

    CVE-2025-20226 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on the…

    Published 26 Mar 2025 · Fixed in 9.1.8, 9.2.5, 9.3.3 · NVD
  22. High 7.5

    CVE-2025-30353 · Directus

    Webhook trigger flows can leak sensitive data

    Published 26 Mar 2025 · Fixed in 11.5.0 · NVD, Project advisories (GitHub)
  23. Medium 4.3

    CVE-2025-24972 · Discourse

    Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions `3.3.4` and `3.4.0.beta5` contain a patch for the issue. A workaround is available. If a user disables chat in their…

    Published 26 Mar 2025 · Fixed in 3.3.4, 3.4.0 · NVD
  24. Medium 5.3

    CVE-2025-30352 · Directus

    `search` query parameter allows enumeration of non permitted fields

    Published 26 Mar 2025 · Fixed in 11.5.0 · NVD, Project advisories (GitHub)
  25. Medium 4.3

    CVE-2025-30351 · Directus

    Suspended user can continue to use session token to access API

    Published 26 Mar 2025 · Fixed in 11.5.0 · NVD, Project advisories (GitHub)
  26. Medium 5.3

    CVE-2025-30350 · Directus

    S3 assets become unavailable after a burst of HEAD requests

    Published 26 Mar 2025 · Fixed in 11.5.0 · NVD, Project advisories (GitHub)
  27. Medium 5.3

    CVE-2025-30225 · Directus

    S3 assets become unavailable after a burst of malformed transformations

    Published 26 Mar 2025 · Fixed in 11.5.0 · NVD, Project advisories (GitHub)
  28. Low 3.1

    CVE-2025-24808 · Discourse

    Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, someone who is about to reach the limit of users in a group DM may send requests to add new users in parallel. The requests might all go through ignoring the limit due to a race condition. The patch in versions `3.3.4` and `3.4.0.beta5` uses the `lock` step in…

    Published 26 Mar 2025 · Fixed in 3.3.3, 3.4.0 · NVD
  29. Medium 6.6

    CVE-2025-30217 · Frappe Framework

    Possibility of SQL injection due to improper validations

    Published 26 Mar 2025 · Fixed in 14.93.2, 15.55.0 · NVD, Project advisories (GitHub)
  30. Critical 9.8

    CVE-2025-27837 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gp_mswin.c and base/winrtsup.cpp.

    Published 25 Mar 2025 · Fixed in 10.05.0 · NVD
  31. Critical 9.8

    CVE-2025-27836 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c.

    Published 25 Mar 2025 · Fixed in 10.05.0 · NVD
  32. High 7.8

    CVE-2025-27835 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c.

    Published 25 Mar 2025 · Fixed in 10.05.0 · NVD
  33. High 7.8

    CVE-2025-27834 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document to pdf/pdf_func.c.

    Published 25 Mar 2025 · Fixed in 10.05.0 · NVD
  34. High 7.8

    CVE-2025-27833 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.

    Published 25 Mar 2025 · Fixed in 10.05.0 · NVD
  35. Critical 9.8

    CVE-2025-27832 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c.

    Published 25 Mar 2025 · Fixed in 10.05.0 · NVD
  36. Critical 9.8

    CVE-2025-27831 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has a text buffer overflow via long characters to devices/vector/doc_common.c.

    Published 25 Mar 2025 · Fixed in 10.05.0 · NVD
  37. High 7.8

    CVE-2025-27830 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during serialization of DollarBlend in a font, for base/write_t1.c and psi/zfapi.c.

    Published 25 Mar 2025 · Fixed in 10.05.0 · NVD
  38. Medium 6.1

    CVE-2025-30219 · RabbitMQ

    XSS Vulnerability in an Error Message in Management UI

    Published 25 Mar 2025 · Fixed in 3.13.8, 4.0.3 · Project advisories (GitHub)
  39. Medium 6.6

    CVE-2025-30212 · Frappe Framework

    Possibility of SQL injection due to improper validations

    Published 25 Mar 2025 · Fixed in 14.89.0, 15.51.0 · NVD, Project advisories (GitHub)
  40. High 8.0

    CVE-2025-30214 · Frappe Framework

    Information disclosure leading to account takeover

    Published 25 Mar 2025 · Fixed in 14.89.0, 15.51.0 · NVD, Project advisories (GitHub)
  41. Medium 6.3

    CVE-2025-30213 · Frappe Framework

    Possibility of Remote Code Execution due to improper validation

    Published 25 Mar 2025 · Fixed in 14.91.0, 15.52.0 · NVD, Project advisories (GitHub)
  42. High 7.2

    CVE-2024-13889 · Wordpress Importer (WordPress plugin)

    WordPress Importer: Deserialization of Untrusted Data

    Published 25 Mar 2025 · Fixed in 0.8.4 · WPVulnerability
  43. Critical 9.8

    CVE-2023-25610 · Fortinet FortiProxy, Fortinet FortiWeb, Fortinet FortiOS

    A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0…

    Published 24 Mar 2025 · Fixed in 7.2.2, 7.2.3, 7.2.4 · NVD
  44. High 8.8

    CVE-2021-26105 · Fortinet FortiSandbox

    A stack-based buffer overflow vulnerability (CWE-121) in the profile parser of FortiSandbox version 3.2.2 and below, version 3.1.4 and below may allow an authenticated attacker to potentially execute unauthorized code or commands via specifically crafted HTTP requests.

    Published 24 Mar 2025 · Fixed in 3.2.3 · NVD
  45. Medium 6.1

    CVE-2019-16151 · Fortinet FortiOS

    An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's browser context. This happens when the FortiGate has web filtering and category override…

    Published 21 Mar 2025 · Fixed in 6.2.10, 6.4.2 · NVD
  46. Critical 9.1

    CVE-2025-29927 · Next.js

    Authorization Bypass in Next.js Middleware

    Published 21 Mar 2025 · Fixed in 13.5.9, 14.2.25, 15.2.3 · OSV.dev and GitHub, Project advisories (GitHub)
  47. Medium 6.5

    CVE-2025-30179 · Mattermost

    Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries.

    Published 21 Mar 2025 · Fixed in 9.11.9, 10.3.4, 10.4.3 · NVD
  48. Medium 4.3

    CVE-2025-27933 · Mattermost

    Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public

    Published 21 Mar 2025 · Fixed in 9.11.9, 10.3.4, 10.4.3 · NVD
  49. Low 2.7

    CVE-2025-27715 · Mattermost

    Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them.

    Published 21 Mar 2025 · Fixed in 9.11.9 · NVD
  50. High 8.8

    CVE-2025-25274 · Mattermost

    Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels.

    Published 21 Mar 2025 · Fixed in 9.11.9, 10.3.4, 10.4.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.