UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,083
Published in 7 days
645
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,083 vulnerabilities
  1. Low 2.3

    CVE-2025-23415 · F5 BIG-IP

    An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass endpoint inspection checks for VPN connection initiated thru BIG-IP APM browser network access VPN client for Windows, macOS and Linux. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 5 Feb 2025 · Fixed in 15.1.10.6.0.11.6, 16.1.5, 17.1.2 · NVD
  2. High 8.7

    CVE-2025-23412 · F5 BIG-IP

    When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 5 Feb 2025 · Fixed in 16.1.5, 17.1.2 · NVD
  3. High 8.5

    CVE-2025-23239 · F5 BIG-IP

    When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 5 Feb 2025 · NVD
  4. High 8.7

    CVE-2025-22846 · F5 BIG-IP

    When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 5 Feb 2025 · Fixed in 15.1.10.6.0.11.6, 16.1.5, 17.1.2 · NVD
  5. High 8.7

    CVE-2025-21091 · F5 BIG-IP

    When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    Published 5 Feb 2025 · Fixed in 16.1.6, 17.1.2 · NVD
  6. High 8.9

    CVE-2025-21087 · F5 BIG-IP

    When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    Published 5 Feb 2025 · Fixed in 16.1.6, 17.1.2 · NVD
  7. High 8.9

    CVE-2025-20058 · F5 BIG-IP

    When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    Published 5 Feb 2025 · Fixed in 16.1.6, 17.1.2 · NVD
  8. High 8.7

    CVE-2025-20045 · F5 BIG-IP

    When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 5 Feb 2025 · Fixed in 16.1.5, 17.1.2 · NVD
  9. High 8.7

    CVE-2025-20029 · F5 BIG-IP

    Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 5 Feb 2025 · Fixed in 15.1.10.6, 16.1.5.2, 17.1.2.1 · NVD
  10. High 7.5

    CVE-2024-2878 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible for an attacker to cause a denial of service by crafting unusual search terms for branch names.

    Published 5 Feb 2025 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  11. Medium 6.5

    CVE-2024-3976 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose via the UI the confidential issues title and description from a public project to unauthorised instance users.

    Published 5 Feb 2025 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  12. High 7.5

    CVE-2024-9631 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, where viewing diffs of MR with conflicts can be slow.

    Published 5 Feb 2025 · Fixed in 17.2.9, 17.3.5, 17.4.2 · NVD
  13. Medium 5.4

    CVE-2024-5528 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows a subdomain takeover in GitLab Pages.

    Published 5 Feb 2025 · Fixed in 16.11.6, 17.0.4, 17.1.2 · NVD
  14. High 7.3

    CVE-2025-0725 · curl

    When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.

    Published 5 Feb 2025 · Fixed in 8.12.0 · NVD
  15. High 7.0

    CVE-2025-0665 · curl

    libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.

    Published 5 Feb 2025 · NVD
  16. Low 3.4

    CVE-2025-0167 · curl

    When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.

    Published 5 Feb 2025 · Fixed in 8.12.0 · NVD
  17. Medium 4.4

    CVE-2024-6356 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which allowed cross project access for Security policy bot.

    Published 5 Feb 2025 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  18. Medium 5.3

    CVE-2024-1539 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose updates to issues to a banned group member using the API.

    Published 5 Feb 2025 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  19. High 7.5

    CVE-2023-6386 · GitLab

    A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 prior to 16.8.2 which allows an attacker to spike the GitLab instance resource usage resulting in service degradation.

    Published 5 Feb 2025 · Fixed in 16.6.7, 16.7.5, 16.8.2 · NVD
  20. Medium 5.4

    CVE-2024-53966 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 5 Feb 2025 · Fixed in 6.5.22, 2024.11.0 · NVD
  21. Medium 5.4

    CVE-2024-53965 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This…

    Published 5 Feb 2025 · Fixed in 6.5.22, 2024.11.0 · NVD
  22. Medium 5.4

    CVE-2024-53964 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 5 Feb 2025 · Fixed in 6.5.22, 2024.11.0 · NVD
  23. Medium 5.4

    CVE-2024-53963 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This…

    Published 5 Feb 2025 · Fixed in 6.5.22, 2024.11.0 · NVD
  24. Medium 5.4

    CVE-2024-53962 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 5 Feb 2025 · Fixed in 6.5.22, 2024.11.0 · NVD
  25. Medium 4.3

    CVE-2024-53994 · Discourse

    Discourse is an open source platform for community discussion. In affected versions users who disable chat in preferences could still be reachable in some cases. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable the chat plugin within site settings.

    Published 4 Feb 2025 · Fixed in 3.3.3, 3.4.0 · NVD
  26. Medium 6.5

    CVE-2024-53851 · Discourse

    Discourse is an open source platform for community discussion. In affected versions the endpoint for generating inline oneboxes for URLs wasn't enforcing limits on the number of URLs that it accepted, allowing a malicious user to inflict denial of service on some parts of the app. This vulnerability is only exploitable by authenticated users. This issue has been patched in the latest stable,…

    Published 4 Feb 2025 · Fixed in 3.3.3, 3.4.0 · NVD
  27. Medium 5.4

    CVE-2024-53266 · Discourse

    Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in the user's profile page may be vulnerable to XSS. This has been patched in the latest version of Discourse core. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled.

    Published 4 Feb 2025 · Fixed in 3.3.3, 3.4.0 · NVD
  28. High 8.2

    CVE-2025-23023 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to poison the anonymous cache (for example, the cache may have a response with missing preloaded data). This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse. Users are…

    Published 4 Feb 2025 · Fixed in 3.3.2 · NVD
  29. Medium 6.1

    CVE-2025-22602 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can execute arbitrary JavaScript on users' browsers by posting a malicious video placeholder html element. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should enable CSP.

    Published 4 Feb 2025 · Fixed in 3.3.4, 3.4.0 · NVD
  30. Low 3.1

    CVE-2025-22601 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username via carefully crafted link using the `activate-account` route. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 4 Feb 2025 · Fixed in 3.4.0 · NVD
  31. Medium 6.1

    CVE-2024-56328 · Discourse

    Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by posting a maliciously crafted onebox url. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should enable CSP, disable inline Oneboxes globally, or…

    Published 4 Feb 2025 · Fixed in 3.3.3, 3.4.0 · NVD
  32. Medium 4.9

    CVE-2024-56197 · Discourse

    Discourse is an open source platform for community discussion. PM titles and metadata can be read by other users when the "PM tags allowed for groups" option is enabled, the other user is a member of a group added to this option, and the PM has been tagged. This issue has been patched in the latest `stable`, `beta` and `tests-passed` versions of Discourse. Users are advised to upgrade. Users…

    Published 4 Feb 2025 · Fixed in 3.3.4, 3.4.0 · NVD
  33. High 8.2

    CVE-2024-55948 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR request to poison the anonymous cache (for example, the cache may have a response with missing preloaded data). This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to…

    Published 4 Feb 2025 · Fixed in 3.3.2 · NVD
  34. Medium 5.7

    CVE-2024-10973 · Keycloak

    CLI option for encrypted JGroups ignored

    Published 4 Feb 2025 · Fixed in 26.0.6 · Project advisories (GitHub)
  35. Medium 4.8

    CVE-2024-11623 · authentik

    Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons.  This action could only be performed by an authenticated admin user. The issue was fixed in 2024.10.4 release.

    Published 4 Feb 2025 · Fixed in 2024.10.4 · NVD
  36. Medium 5.3

    CVE-2025-25065 · Zimbra Collaboration

    SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized redirection to internal network endpoints.

    Published 3 Feb 2025 · Fixed in 9.0.0, 10.0.12, 10.1.4 · NVD
  37. High 8.8

    CVE-2025-25064 · Zimbra Collaboration

    SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by manipulating a specific parameter in the request, allowing them to inject arbitrary SQL queries that could retrieve email metadata.

    Published 3 Feb 2025 · Fixed in 10.0.12, 10.1.4 · NVD
  38. Medium 6.1

    CVE-2024-57004 · Roundcube

    Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session.

    Published 3 Feb 2025 · NVD
  39. Medium 4.4

    CVE-2025-25063 · Backdrop CMS

    An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is…

    Published 3 Feb 2025 · Fixed in 1.28.5, 1.29.3 · NVD
  40. Medium 4.4

    CVE-2025-25062 · Backdrop CMS

    An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an…

    Published 3 Feb 2025 · Fixed in 1.28.5, 1.29.3 · NVD
  41. Medium 5.4

    CVE-2024-13403 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 3 Feb 2025 · Fixed in 1.9.3.2 · NVD, WPVulnerability
  42. High 8.8

    CVE-2024-1211 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instances configured to use JWT as an OmniAuth provider.

    Published 31 Jan 2025 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  43. Medium 4.3

    CVE-2023-6195 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. GitLab was vulnerable to Server Side Request Forgery when an attacker uses a malicious URL in the markdown image value when importing a GitHub repository.

    Published 31 Jan 2025 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  44. Medium 6.8

    CVE-2025-23216 · Argo CD

    Secret values are not scrubbed from patch errors

    Published 30 Jan 2025 · Fixed in 2.11.13, 2.12.10, 2.13.4 · NVD, Project advisories (GitHub)
  45. Medium 6.5

    CVE-2024-8494 · Elementor, Elementor Pro (WordPress plugin)

    Elementor Pro: Exposure of Sensitive Information to an Unauthorized Actor

    Published 29 Jan 2025 · Fixed in 3.25.11 · NVD, WPVulnerability
  46. Medium 5.1

    CVE-2024-11956 · Pimcore

    A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functionality of the file /admin/customermanagementframework/customers/list. The manipulation of the argument filterDefinition/filter leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and…

    Published 28 Jan 2025 · Fixed in 4.2.1 · NVD
  47. Medium 5.1

    CVE-2024-11954 · Pimcore

    A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

    Published 28 Jan 2025 · NVD
  48. High 8.1

    GHSA-xr3m-6gq6-22cg · Pimcore

    Authenticated Stored Cross-Site Scripting (XSS) Via Search Document

    Published 28 Jan 2025 · Project advisories (GitHub)
  49. High 7.2

    GHSA-q53r-9hh9-w277 · Pimcore

    SQL Injection: Hibernate in NA

    Published 28 Jan 2025 · Fixed in 4.2.1 · Project advisories (GitHub)
  50. Medium 4.3

    CVE-2025-0290 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 prior to 17.5.5, from 17.6 prior to 17.6.3, and from 17.7 prior to 17.7.1. Under certain conditions, processing of CI artifacts metadata could cause background jobs to become unresponsive.

    Published 28 Jan 2025 · Fixed in 17.5.5, 17.6.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.