UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,083
Published in 7 days
650
Critical in 30 days
390
Actively exploited
420

Latest vulnerabilities

38,083 vulnerabilities
  1. Medium 5.4

    CVE-2025-0604 · Keycloak

    Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak

    Published 10 Mar 2025 · Fixed in 26.0.10 · Project advisories (GitHub)
  2. Low 3.5

    CVE-2025-26865 · Apache OFBiz

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18.12.18.   It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which is not recommended! For security, only official releases should be used. In other words, if you use 18.12.17 you are still safe. The…

    Published 10 Mar 2025 · NVD
  3. Medium 4.3

    CVE-2025-2045 · GitLab

    Improper authorization in GitLab EE affecting all versions from 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, 17.9 prior to 17.9.1 allow users with limited permissions to access to potentially sensitive project analytics data.

    Published 6 Mar 2025 · Fixed in 17.7.6, 17.8.4 · NVD
  4. Medium 6.3

    CVE-2024-56196 · Apache Traffic Server

    Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 10.0.4, which fixes the issue.

    Published 6 Mar 2025 · Fixed in 10.0.4 · NVD
  5. Medium 6.3

    CVE-2024-56195 · Apache Traffic Server

    Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.

    Published 6 Mar 2025 · Fixed in 9.2.9, 10.0.4 · NVD
  6. Medium 6.3

    CVE-2024-38311 · Apache Traffic Server

    Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.

    Published 6 Mar 2025 · Fixed in 9.2.9, 10.0.4 · NVD
  7. Medium 4.3

    CVE-2024-56202 · Apache Traffic Server

    Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue.

    Published 6 Mar 2025 · Fixed in 9.2.9, 10.0.4 · NVD
  8. Medium 4.2

    CVE-2025-1540 · GitLab

    An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. It was possible for a user added as an External to read and clone internal projects under certain circumstances."

    Published 6 Mar 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  9. Medium 6.4

    CVE-2024-13805 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Cross-site Scripting

    Published 6 Mar 2025 · Fixed in 5.3.0 · WPVulnerability
  10. Medium 4.3

    CVE-2025-27625 · Jenkins

    In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers interpret these characters as part of scheme-relative redirects.

    Published 5 Mar 2025 · Fixed in 2.492.2, 2.500 · NVD
  11. Medium 5.4

    CVE-2025-27624 · Jenkins

    A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor Status widgets).

    Published 5 Mar 2025 · Fixed in 2.492.2, 2.500 · NVD
  12. Medium 4.3

    CVE-2025-27623 · Jenkins

    Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets.

    Published 5 Mar 2025 · Fixed in 2.492.2, 2.500 · NVD
  13. Medium 4.3

    CVE-2025-27622 · Jenkins

    Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted values of secrets.

    Published 5 Mar 2025 · Fixed in 2.492.2, 2.500 · NVD
  14. Medium

    CVE-2025-27515 · Laravel

    File Validation Bypass

    Published 5 Mar 2025 · Fixed in 12.1.1 · Project advisories (GitHub)
  15. Critical 9.9

    CVE-2025-25015 · Kibana

    Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all,…

    Published 5 Mar 2025 · Fixed in 8.16.6, 8.17.3 · NVD
  16. Medium 5.4

    CVE-2025-27411 · REDAXO

    Arbitrary File Upload in mediapool page

    Published 5 Mar 2025 · Fixed in 5.18.3 · NVD, Project advisories (GitHub)
  17. Medium 6.1

    CVE-2025-27412 · REDAXO

    Authenticated Reflected Cross Site Scripting - packages installation

    Published 5 Mar 2025 · Fixed in 5.18.3 · NVD, Project advisories (GitHub)
  18. Critical 9.8

    CVE-2025-26319 · Flowise

    FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.

    Published 4 Mar 2025 · NVD
  19. Critical 9.0

    CVE-2025-27507 · ZITADEL

    IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations

    Published 4 Mar 2025 · Fixed in 2.68.4, 2.69.4, 2.70.1 · NVD, Project advisories (GitHub)
  20. Medium 6.0Actively exploited

    CVE-2025-22226 · VMware ESXi

    VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.

    Published 4 Mar 2025 · NVD
  21. High 8.2Actively exploited

    CVE-2025-22225 · VMware ESXi

    VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.

    Published 4 Mar 2025 · NVD
  22. High 8.2Actively exploited

    CVE-2025-22224 · VMware ESXi

    VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

    Published 4 Mar 2025 · NVD
  23. Medium 6.1

    CVE-2025-0555 · GitLab

    A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows an attacker to bypass security controls and execute arbitrary scripts in a users browser under specific conditions.

    Published 3 Mar 2025 · Fixed in 17.7.6, 17.8.4 · NVD
  24. Medium 6.1

    CVE-2025-0475 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances.

    Published 3 Mar 2025 · Fixed in 17.7.6, 17.8.4 · NVD
  25. Medium 5.3

    CVE-2024-10925 · GitLab

    A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Security policy YAML

    Published 3 Mar 2025 · Fixed in 17.7.6, 17.8.4 · NVD
  26. Medium 5.4

    CVE-2024-8186 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations.

    Published 3 Mar 2025 · Fixed in 17.7.6, 17.8.4 · NVD
  27. Medium 5.9

    CVE-2025-26466 · OpenSSH

    A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may…

    Published 28 Feb 2025 · NVD
  28. Medium 4.7

    CVE-2025-1749 · OpenCart

    HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in /account/voucher.

    Published 28 Feb 2025 · Fixed in 4.1.0.0 · NVD
  29. Medium 4.7

    CVE-2025-1748 · OpenCart

    HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in /account/register.

    Published 28 Feb 2025 · Fixed in 4.1.0.0 · NVD
  30. Medium 4.7

    CVE-2025-1747 · OpenCart

    HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in /account/login.

    Published 28 Feb 2025 · Fixed in 4.1.0.0 · NVD
  31. Medium 6.1

    CVE-2025-1746 · OpenCart

    Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the search in the /product/search endpoint. This vulnerability could be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

    Published 28 Feb 2025 · Fixed in 4.1.0.0 · NVD
  32. Medium 6.3

    CVE-2025-0769 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Deserialization of Untrusted Data

    Published 28 Feb 2025 · Fixed in 10.1.1.2 · WPVulnerability
  33. Medium 6.1

    CVE-2024-54957 · Nagios XI

    Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users with read-only permissions. This vulnerability allows an attacker to craft a malicious link that redirects users to an arbitrary external URL without their consent.

    Published 27 Feb 2025 · NVD
  34. Medium 5.3

    CVE-2025-27399 · Mastodon

    Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are not yet approved can view the block reasons. Instance admins that do not want their domain blocks to be public are impacted. Versions 4.1.23, 4.2.16, and 4.3.4…

    Published 27 Feb 2025 · Fixed in 4.1.23, 4.2.16, 4.3.4 · NVD
  35. High 8.4

    CVE-2025-23389 · Rancher

    Improper Account Binding Validation in SAML Authentication Enables User Impersonation on First Login

    Published 27 Feb 2025 · Fixed in 2.8.13, 2.9.7, 2.10.3 · Project advisories (GitHub)
  36. High 8.2

    CVE-2025-23388 · Rancher

    Unauthenticated stack overflow in /v3-public/authproviders API

    Published 27 Feb 2025 · Fixed in 2.8.13, 2.9.7, 2.10.3 · Project advisories (GitHub)
  37. Medium 5.3

    CVE-2025-23387 · Rancher

    SAML-based login via CLI can be denied by unauthenticated users

    Published 27 Feb 2025 · Fixed in 2.8.13, 2.9.7, 2.10.3 · Project advisories (GitHub)
  38. Low

    GHSA-mq2m-hr29-8gqf · Mastodon

    OEmbed embeds allow <embed> tag (blocked by CSP)

    Published 27 Feb 2025 · Fixed in 4.1.23 · Project advisories (GitHub)
  39. Medium 5.3

    CVE-2025-27157 · Mastodon

    Missing rate-limit on sign-up email verification

    Published 27 Feb 2025 · Fixed in 4.2.16, 4.3.4 · NVD, Project advisories (GitHub)
  40. Medium 6.5

    CVE-2024-36259 · Odoo

    Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information via an oracle-based (yes/no response) crafted attack.

    Published 25 Feb 2025 · NVD
  41. High 8.8

    CVE-2024-12368 · Odoo

    Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users.

    Published 25 Feb 2025 · NVD
  42. High 7.9

    CVE-2025-27110 · ModSecurity

    Encoded HTML entities possible bypass

    Published 25 Feb 2025 · NVD, Project advisories (GitHub)
  43. Medium 5.3

    CVE-2024-11955 · GLPI

    Open Redirection

    Published 25 Feb 2025 · Fixed in 10.0.18 · NVD, Project advisories (GitHub)
  44. Medium 6.1

    CVE-2025-21627 · GLPI

    Reflected XSS in search page

    Published 25 Feb 2025 · Fixed in 10.0.18 · NVD, Project advisories (GitHub)
  45. Medium 6.5

    CVE-2025-21626 · GLPI

    Exposure of sensitive information in the `status.php` endpoint

    Published 25 Feb 2025 · Fixed in 10.0.18 · NVD, Project advisories (GitHub)
  46. Medium 6.9

    CVE-2025-23024 · GLPI

    Plugins disabled by unauthenticated user

    Published 25 Feb 2025 · Fixed in 10.0.18 · NVD, Project advisories (GitHub)
  47. Medium 6.3

    CVE-2025-23046 · GLPI

    Unauthorized authentication by email using the OAuthIMAP plugin

    Published 25 Feb 2025 · Fixed in 10.0.18 · NVD, Project advisories (GitHub)
  48. Medium 6.5

    CVE-2025-25192 · GLPI

    Unauthorized access to debug mode

    Published 25 Feb 2025 · Fixed in 10.0.18 · NVD, Project advisories (GitHub)
  49. High 7.7

    CVE-2024-47053 · Mautic

    Improper Authorization in Reporting API

    Published 25 Feb 2025 · Fixed in 5.2.3 · NVD, Project advisories (GitHub)
  50. Medium 5.4

    CVE-2022-25773 · Mautic

    Relative Path Traversal in assets file upload

    Published 25 Feb 2025 · Fixed in 5.2.3 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.