UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,418
Published in 7 days
668
Critical in 30 days
391
Actively exploited
420

Latest vulnerabilities

38,418 vulnerabilities
  1. Unrated

    CVE-2022-49781 · Linux kernel

    perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling

    Published 1 May 2025 · Fixed in 6.0.10 · CVE Program
  2. Unrated

    CVE-2022-49780 · Linux kernel

    scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()

    Published 1 May 2025 · Fixed in 5.10.156, 5.15.80, 6.0.10 · CVE Program
  3. Unrated

    CVE-2022-49779 · Linux kernel

    kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case

    Published 1 May 2025 · Fixed in 5.10.156, 5.15.80, 6.0.10 · CVE Program
  4. Unrated

    CVE-2022-49776 · Linux kernel

    macvlan: enforce a consistent minimal mtu

    Published 1 May 2025 · Fixed in 5.10.156, 5.15.80, 6.0.10 · CVE Program
  5. Unrated

    CVE-2022-49774 · Linux kernel

    KVM: x86/xen: Fix eventfd error handling in kvm_xen_eventfd_assign()

    Published 1 May 2025 · Fixed in 6.0.10 · CVE Program
  6. Unrated

    CVE-2022-49773 · Linux kernel

    drm/amd/display: Fix optc2_configure warning on dcn314

    Published 1 May 2025 · Fixed in 6.0.10 · CVE Program
  7. Unrated

    CVE-2022-49772 · Linux kernel

    ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()

    Published 1 May 2025 · Fixed in 5.10.156, 5.15.80, 6.0.10 · CVE Program
  8. Unrated

    CVE-2022-49771 · Linux kernel

    dm ioctl: fix misbehavior if list_versions races with module loading

    Published 1 May 2025 · Fixed in 5.10.156, 5.15.80, 6.0.10 · CVE Program
  9. Unrated

    CVE-2022-49769 · Linux kernel

    gfs2: Check sb_bsize_shift after reading superblock

    Published 1 May 2025 · Fixed in 5.10.156, 5.15.80, 6.0.10 · CVE Program
  10. Unrated

    CVE-2022-49766 · Linux kernel

    netlink: Bounds-check struct nlmsgerr creation

    Published 1 May 2025 · Fixed in 6.0.10 · CVE Program
  11. Unrated

    CVE-2022-49764 · Linux kernel

    bpf: Prevent bpf program recursion for raw tracepoint probes

    Published 1 May 2025 · Fixed in 6.0.10 · CVE Program
  12. Medium 4.8

    CVE-2025-32376 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable version 3.4.3 and beta version 3.5.0.beta3.

    Published 30 Apr 2025 · Fixed in 3.4.3 · NVD
  13. High

    CVE-2025-3501 · Keycloak

    Keycloak hostname verification

    Published 30 Apr 2025 · Fixed in 26.2.2 · Project advisories (GitHub)
  14. Medium

    CVE-2025-3910 · Keycloak

    Two factor authentication bypass

    Published 30 Apr 2025 · Fixed in 26.2.2 · Project advisories (GitHub)
  15. High 7.5

    CVE-2025-46560 · vLLM

    vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.8.0 and prior to 0.8.5 are affected by a critical performance vulnerability in the input preprocessing logic of the multimodal tokenizer. The code dynamically replaces placeholder tokens (e.g., <|audio_|>, <|image_|>) with repeated tokens based on precomputed lengths. Due to…

    Published 30 Apr 2025 · Fixed in 0.8.5 · NVD
  16. Critical 9.8

    CVE-2025-32444 · vLLM

    vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration with mooncake, are vulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. The vulnerable sockets were set to listen on all network interfaces, increasing the likelihood that an attacker…

    Published 30 Apr 2025 · Fixed in 0.8.5 · NVD
  17. High 7.5

    CVE-2025-30202 · vLLM

    vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vulnerable to denial of service and data exposure via ZeroMQ on multi-node vLLM deployment. In a multi-node vLLM deployment, vLLM uses ZeroMQ for some multi-node communication purposes. The primary vLLM host opens an XPUB ZeroMQ socket and binds it to ALL…

    Published 30 Apr 2025 · Fixed in 0.8.5 · NVD
  18. High 8.8

    CVE-2025-32354 · Zimbra Collaboration

    In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) of Zimbra webmail due to a lack of CSRF token validation. This allows attackers to perform unauthorized GraphQL operations, such as modifying contacts, changing account settings, and accessing sensitive user data when an authenticated user…

    Published 29 Apr 2025 · Fixed in 10.1.4 · NVD
  19. Medium 5.4

    CVE-2025-46343 · n8n

    n8n is a workflow automation platform. Prior to version 1.90.0, n8n is vulnerable to stored cross-site scripting (XSS) through the attachments view endpoint. n8n workflows can store and serve binary files, which are accessible to authenticated users. However, there is no restriction on the MIME type of uploaded files, and the MIME type could be controlled via a GET parameter. This allows the…

    Published 29 Apr 2025 · Fixed in 1.90.0 · NVD
  20. Medium 4.3

    CVE-2025-0049 · GoAnywhere MFT

    When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0.

    Published 28 Apr 2025 · Fixed in 7.8.0 · NVD
  21. Medium 5.4

    CVE-2024-11922 · GoAnywhere MFT

    Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email.

    Published 28 Apr 2025 · Fixed in 7.8.0 · NVD
  22. Critical 9.8

    CVE-2025-31651 · Apache Tomcat

    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from…

    Published 28 Apr 2025 · Fixed in 9.0.104, 10.1.40, 11.0.6 · NVD
  23. High 7.5

    CVE-2025-31650 · Apache Tomcat

    Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through…

    Published 28 Apr 2025 · Fixed in 9.0.104, 10.1.40, 11.0.6 · NVD
  24. Medium 6.1

    CVE-2025-46550 · YesWiki

    Reflected XSS (Unauthenticated) in Yeswiki v4.5.1

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  25. Medium 6.1

    CVE-2025-46549 · YesWiki

    Reflected XSS (Unauthenticated) in Yeswiki v4.5.1

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  26. Medium 4.8

    CVE-2025-46350 · YesWiki

    Reflected XSS (Authenticated) in Yeswiki v4.5.1

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  27. Medium 6.1

    CVE-2025-46349 · YesWiki

    Unauthenticated reflected XSS in YesWiki <= 4.5.3

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  28. Critical 9.8

    CVE-2025-46348 · YesWiki

    Uauthenticated Site Backup Creation and Download

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  29. Medium 5.8

    CVE-2025-46347 · YesWiki

    Remote Code Execution via Arbitrary PHP File Write and Execution

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  30. Medium 6.3

    CVE-2025-46346 · YesWiki

    Stored XSS in Comments

    Published 28 Apr 2025 · Fixed in 4.5.4 · NVD, Project advisories (GitHub)
  31. Low 2.3

    CVE-2025-43854 · Dify

    DIFY vulnerable to Clickjacking Attack

    Published 28 Apr 2025 · NVD, Project advisories (GitHub)
  32. Medium 4.5

    CVE-2025-46646 · Ghostscript

    In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.

    Published 26 Apr 2025 · Fixed in 10.05.0 · NVD
  33. Medium 6.1

    CVE-2025-46618 · TeamCity

    In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab

    Published 25 Apr 2025 · Fixed in 2025.03.1 · NVD
  34. Critical 9.8

    CVE-2025-46433 · TeamCity

    In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible

    Published 25 Apr 2025 · Fixed in 2025.03.1 · NVD
  35. Medium 6.5

    CVE-2025-46432 · TeamCity

    In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs

    Published 25 Apr 2025 · Fixed in 2025.03.1 · NVD
  36. Medium 4.3

    CVE-2025-3647 · Moodle

    A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to retrieve.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  37. Medium 4.3

    CVE-2025-3645 · Moodle

    A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online statuses.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  38. Medium 4.3

    CVE-2025-3644 · Moodle

    A flaw was found in Moodle. Additional checks were required to prevent users from deleting course sections they did not have permission to modify.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  39. Medium 5.4

    CVE-2025-3643 · Moodle

    A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting (XSS) risk.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  40. High 8.8

    CVE-2025-3642 · Moodle

    A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers and managers on sites with the EQUELLA repository enabled.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  41. High 8.8

    CVE-2025-3641 · Moodle

    A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers and managers on sites with the Dropbox repository enabled.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  42. Medium 4.3

    CVE-2025-3640 · Moodle

    A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  43. High 8.8

    CVE-2025-3638 · Moodle

    A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery (CSRF) risk.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  44. Low 3.1

    CVE-2025-3637 · Moodle

    A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the mod_data module: edit and delete pages.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  45. Medium 4.3

    CVE-2025-3636 · Moodle

    A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  46. Low 3.5

    CVE-2025-3635 · Moodle

    A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery (CSRF) attacks.

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  47. Medium 4.3

    CVE-2025-3628 · Moodle

    A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities.

    Published 25 Apr 2025 · Fixed in 4.5.4 · NVD
  48. Medium 4.3

    CVE-2025-3627 · Moodle

    A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their identities using two-factor authentication (2FA).

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  49. High 7.1

    CVE-2025-3625 · Moodle

    A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA).

    Published 25 Apr 2025 · Fixed in 4.3.12, 4.4.8, 4.5.4 · NVD
  50. Critical 10.0Actively exploited

    CVE-2025-32432 · Craft CMS

    Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an…

    Published 25 Apr 2025 · Fixed in 3.9.15, 4.14.15, 5.6.17 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.