UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,083
Published in 7 days
645
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,083 vulnerabilities
  1. Critical 9.9

    CVE-2024-47051 · Mautic

    Remote Code Execution & File Deletion in Asset Uploads

    Published 25 Feb 2025 · Fixed in 5.2.3 · NVD, Project advisories (GitHub)
  2. Critical 9.8

    CVE-2025-26533 · Moodle

    An SQL injection risk was identified in the module list filter within course search.

    Published 24 Feb 2025 · Fixed in 4.3.10, 4.4.6, 4.5.2 · NVD
  3. Medium 4.3

    CVE-2025-26532 · Moodle

    Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.

    Published 24 Feb 2025 · Fixed in 4.3.10, 4.4.6, 4.5.2 · NVD
  4. Medium 5.3

    CVE-2025-26531 · Moodle

    Insufficient capability checks made it possible to disable badges a user does not have permission to access.

    Published 24 Feb 2025 · Fixed in 4.3.10, 4.4.6, 4.5.2 · NVD
  5. Medium 6.1

    CVE-2025-26530 · Moodle

    The question bank filter required additional sanitizing to prevent a reflected XSS risk.

    Published 24 Feb 2025 · Fixed in 4.3.10, 4.4.6, 4.5.2 · NVD
  6. Medium 6.1

    CVE-2025-26529 · Moodle

    Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.

    Published 24 Feb 2025 · Fixed in 4.3.10, 4.4.6, 4.5.2 · NVD
  7. Medium 6.1

    CVE-2025-26528 · Moodle

    The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.

    Published 24 Feb 2025 · Fixed in 4.3.10, 4.4.6, 4.5.2 · NVD
  8. Medium 5.3

    CVE-2025-26527 · Moodle

    Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.

    Published 24 Feb 2025 · Fixed in 4.3.10, 4.4.6, 4.5.2 · NVD
  9. Medium 6.5

    CVE-2025-26526 · Moodle

    Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities.

    Published 24 Feb 2025 · Fixed in 4.3.10, 4.4.6, 4.5.2 · NVD
  10. High 8.6

    CVE-2025-26525 · Moodle

    Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).

    Published 24 Feb 2025 · Fixed in 4.3.10, 4.4.6, 4.5.2 · NVD
  11. Medium 4.8

    CVE-2025-27141 · Metabase

    Cached questions leak data to impersonated users

    Published 24 Feb 2025 · Fixed in 1.51.14, 1.52.11, 1.53.2 · NVD, Project advisories (GitHub)
  12. High 7.5

    CVE-2025-25279 · Mattermost

    Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards.

    Published 24 Feb 2025 · Fixed in 10.2.3, 10.3.3, 10.4.2 · NVD
  13. Medium 4.3

    CVE-2025-24526 · Mattermost

    Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access to it

    Published 24 Feb 2025 · Fixed in 10.2.3, 10.3.3, 10.4.2 · NVD
  14. Medium 6.5

    CVE-2025-24490 · Mattermost

    Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an attacker to retrieve data from the database, via a SQL injection when reordering specially crafted boards categories.

    Published 24 Feb 2025 · Fixed in 10.2.3, 10.3.3, 10.4.2 · NVD
  15. Medium 6.5

    CVE-2025-20051 · Mattermost

    Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted block in Boards.

    Published 24 Feb 2025 · Fixed in 10.2.3, 10.3.3, 10.4.2 · NVD
  16. High 8.8

    CVE-2025-1412 · Mattermost

    Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot.

    Published 24 Feb 2025 · Fixed in 9.11.7, 10.4.2 · NVD
  17. Medium 5.4

    CVE-2024-54444 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 24 Feb 2025 · Fixed in 3.25.11 · NVD, WPVulnerability
  18. Medium 5.3

    CVE-2025-1594 · FFmpeg

    A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

    Published 23 Feb 2025 · NVD
  19. Critical 9.8

    CVE-2025-26794 · Exim

    Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)

    Published 21 Feb 2025 · Fixed in 4.98.1 · NVD
  20. Medium 4.9

    CVE-2024-38657 · Ivanti Connect Secure

    External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to write arbitrary files.

    Published 21 Feb 2025 · Fixed in 22.7 · NVD
  21. Medium 6.5

    CVE-2024-54961 · Nagios XI

    Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and email addresses of all current users.

    Published 20 Feb 2025 · NVD
  22. Medium 6.5

    CVE-2024-54960 · Nagios XI

    A SQL Injection vulnerability in Nagios XI 2024R1.2.2 allows a remote attacker to execute SQL injection via a crafted payload in the History Tab component.

    Published 20 Feb 2025 · NVD
  23. Medium 6.1

    CVE-2024-54959 · Nagios XI

    Nagios XI 2024R1.2.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack through the Favorites component, enabling POST-based Cross-Site Scripting (XSS).

    Published 20 Feb 2025 · NVD
  24. Medium 6.1

    CVE-2024-54958 · Nagios XI

    Nagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. This flaw allows an attacker to inject malicious scripts into the Tools interface, which are then stored and executed in the context of other users accessing the page.

    Published 20 Feb 2025 · NVD
  25. Medium 5.4

    CVE-2024-53974 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 19 Feb 2025 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  26. Medium 4.3

    CVE-2025-27089 · Directus

    Overlapping policies allow update to non-allowed fields

    Published 19 Feb 2025 · Fixed in 11.1.2 · NVD, Project advisories (GitHub)
  27. Medium 5.4

    CVE-2024-13445 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 19 Feb 2025 · Fixed in 3.27.5 · NVD, WPVulnerability
  28. High 7.5

    CVE-2025-27113 · libxml2

    libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

    Published 18 Feb 2025 · Fixed in 2.12.10, 2.13.6 · NVD
  29. High 7.7

    CVE-2025-24928 · libxml2

    libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.

    Published 18 Feb 2025 · Fixed in 2.12.10, 2.13.6 · NVD
  30. High 8.8

    CVE-2025-25469 · FFmpeg

    FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c.

    Published 18 Feb 2025 · Fixed in 2025-01-13 · NVD
  31. Medium 6.5

    CVE-2025-25468 · FFmpeg

    FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c.

    Published 18 Feb 2025 · Fixed in 2025-01-13 · NVD
  32. Medium 6.5

    CVE-2025-22921 · FFmpeg

    FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c.

    Published 18 Feb 2025 · NVD
  33. Critical 9.8

    CVE-2024-56171 · libxml2

    libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

    Published 18 Feb 2025 · Fixed in 2.12.10, 2.13.6 · NVD
  34. Medium 6.8

    CVE-2025-26465 · OpenSSH

    A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory…

    Published 18 Feb 2025 · NVD
  35. Medium 4.8

    CVE-2025-1373 · FFmpeg

    A vulnerability was found in FFmpeg up to 7.1. It has been rated as problematic. Affected by this issue is the function mov_read_trak of the file libavformat/mov.c of the component MOV Parser. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The patch is identified as…

    Published 17 Feb 2025 · NVD
  36. Medium 5.3

    CVE-2025-0503 · Mattermost

    Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database.

    Published 14 Feb 2025 · Fixed in 9.11.7 · NVD
  37. Medium 4.8

    CVE-2025-1071 · WatchGuard Fireware OS

    A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the spamBlocker module. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user.

    Published 14 Feb 2025 · Fixed in 12.5.13, 12.11.1 · NVD
  38. Medium 5.1

    CVE-2025-0178 · WatchGuard Fireware OS

    An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious JavaScript into responses sent by the Web UI.

    Published 14 Feb 2025 · Fixed in 12.5.13, 12.11.1 · NVD
  39. Medium 5.7

    CVE-2024-3303 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prior to 17.8.2, which allows an attacker to exfiltrate contents of a private issue using prompt injection.

    Published 13 Feb 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  40. Medium 5.3

    CVE-2025-1198 · GitLab

    An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results.

    Published 13 Feb 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  41. Medium 6.6

    CVE-2024-8266 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.6.0, which allows an attacker with maintainer role to trigger a pipeline as project owner under certain circumstances.

    Published 13 Feb 2025 · Fixed in 17.6.0 · NVD
  42. High 7.5

    CVE-2024-7102 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another user under certain circumstances.

    Published 13 Feb 2025 · Fixed in 17.5.0 · NVD
  43. Critical 9.1

    CVE-2022-31631 · PHP

    In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.

    Published 12 Feb 2025 · Fixed in 8.0.27, 8.1.15, 8.2.2 · NVD
  44. High 7.1Actively exploited

    CVE-2025-0111 · Palo Alto Networks PAN-OS

    An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to…

    Published 12 Feb 2025 · Fixed in 10.2.12, 11.1.6, 11.2.4 · NVD
  45. High 8.8Actively exploited

    CVE-2025-0108 · Palo Alto Networks PAN-OS

    An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and…

    Published 12 Feb 2025 · Fixed in 10.2.7, 11.1.2, 11.2.4 · NVD
  46. Medium 4.3

    CVE-2025-0516 · GitLab

    Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform unauthorized actions on critical project data.

    Published 12 Feb 2025 · Fixed in 17.7.4, 17.8.2 · NVD
  47. High 8.8

    CVE-2024-9870 · GitLab

    An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services.

    Published 12 Feb 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  48. High 7.5

    CVE-2025-1212 · GitLab

    An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send a crafted request to a backend server to reveal sensitive information.

    Published 12 Feb 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  49. High 7.5

    CVE-2025-1042 · GitLab

    An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized way.

    Published 12 Feb 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  50. Medium 6.1

    CVE-2025-0376 · GitLab

    An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an attacker to execute unauthorized actions via a change page.

    Published 12 Feb 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.