UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,083
Published in 7 days
645
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,083 vulnerabilities
  1. High 8.8

    CVE-2025-24357 · vLLM

    vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weights_only parameter defaults to False. When torch.load loads malicious pickle data, it will execute arbitrary code during unpickling. This vulnerability is fixed in…

    Published 27 Jan 2025 · Fixed in 0.7.0 · NVD
  2. Critical 9.0

    CVE-2024-55228 · Dolibarr ERP CRM

    A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.

    Published 27 Jan 2025 · NVD
  3. Critical 9.0

    CVE-2024-55227 · Dolibarr ERP CRM

    A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.

    Published 27 Jan 2025 · NVD
  4. Medium 5.5

    CVE-2025-24814 · Apache Solr

    Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor…

    Published 27 Jan 2025 · Fixed in 9.8.0 · NVD
  5. Medium 5.4

    CVE-2024-52012 · Apache Solr

    Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API.  Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.   This issue affects Apache Solr: from 6.6…

    Published 27 Jan 2025 · Fixed in 9.8.0 · NVD
  6. High 7.8

    CVE-2022-49043 · libxml2

    xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.

    Published 26 Jan 2025 · Fixed in 2.11.0 · NVD
  7. High 7.5

    CVE-2025-24365 · Vaultwarden

    Escalation of privilege via variable confusion in OrgHeaders trait

    Published 25 Jan 2025 · Fixed in 1.33.0 · NVD, Project advisories (GitHub)
  8. High 7.2

    CVE-2025-24364 · Vaultwarden

    RCE in the admin panel

    Published 25 Jan 2025 · Fixed in 1.33.0 · NVD, Project advisories (GitHub)
  9. High 7.1

    GHSA-f7r5-w49x-gxm3 · Vaultwarden

    Getting access to the Admin Panel via CSRF

    Published 25 Jan 2025 · Fixed in 1.33.0 · Project advisories (GitHub)
  10. Medium 5.3

    CVE-2025-24360 · Nuxt

    Opening a malicious website while running a Nuxt dev server could allow read-only access to code

    Published 24 Jan 2025 · Fixed in 3.15.3 · Project advisories (GitHub)
  11. High 8.5

    CVE-2025-22605 · Coolify

    OS Command Injection Vulnerability in SSH Command Generation

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.253 · NVD, Project advisories (GitHub)
  12. High 8.5

    CVE-2025-22606 · Coolify

    Command Injection in Project Name

    Published 24 Jan 2025 · NVD, Project advisories (GitHub)
  13. Critical 10.0

    CVE-2025-22612 · Coolify

    Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE)

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.374, 4.0.0 · NVD, Project advisories (GitHub)
  14. Critical 9.9

    CVE-2025-22611 · Coolify

    Privilege Escalation resulting in Remote Command Execution (RCE)

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.361, 4.0.0 · NVD, Project advisories (GitHub)
  15. Critical 10.0

    CVE-2025-22609 · Coolify

    Private Key Hijacking / Remote Command Execution (RCE)

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.361, 4.0.0 · NVD, Project advisories (GitHub)
  16. Medium 5.7

    CVE-2025-22610 · Coolify

    OAuth Secrets Leak

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.361, 4.0.0 · NVD, Project advisories (GitHub)
  17. Medium 6.5

    CVE-2025-22608 · Coolify

    Revoke Arbitrary Team Invitations (DOS)

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.361, 4.0.0 · NVD, Project advisories (GitHub)
  18. Medium 4.7

    CVE-2025-22607 · Coolify

    GitHub / GitLab OAuth Secrets Leak

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.361, 4.0.0 · NVD, Project advisories (GitHub)
  19. Low 1.3

    CVE-2025-24025 · Coolify

    Reflected XSS on Tag Search

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.361, 4.0.0 · NVD, Project advisories (GitHub)
  20. Medium 6.1

    CVE-2025-0314 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of certain file types lead to cross-site scripting.

    Published 24 Jan 2025 · Fixed in 17.6.4, 17.7.3 · NVD
  21. Medium 5.3

    CVE-2024-11931 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.6.4, from 17.7 prior to 17.7.3, and from 17.8 prior to 17.8.1. Under certain conditions, it may have been possible for users with developer role to exfiltrate protected CI variables via CI lint.

    Published 24 Jan 2025 · Fixed in 17.6.4, 17.7.3 · NVD
  22. Medium 4.3

    CVE-2025-24353 · Directus

    Privilege escalation using Share feature

    Published 23 Jan 2025 · Fixed in 11.2.0 · NVD, Project advisories (GitHub)
  23. Medium 6.5

    CVE-2024-43708 · Kibana

    An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana.

    Published 23 Jan 2025 · Fixed in 7.17.23, 8.15.0 · NVD
  24. Medium 6.5

    CVE-2024-52972 · Kibana

    An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.

    Published 23 Jan 2025 · Fixed in 7.17.23, 8.15.0 · NVD
  25. Medium 4.3

    CVE-2024-43710 · Kibana

    A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.

    Published 23 Jan 2025 · Fixed in 8.15.0 · NVD
  26. Medium 6.5

    CVE-2024-43707 · Kibana

    An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.

    Published 23 Jan 2025 · Fixed in 8.15.0 · NVD
  27. High 7.5

    CVE-2025-20128 · ClamAV

    A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file…

    Published 22 Jan 2025 · Fixed in 1.0.8, 1.4.2 · NVD
  28. Medium 6.5

    CVE-2024-55488 · Umbraco CMS

    A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product…

    Published 22 Jan 2025 · NVD
  29. Medium 6.1

    CVE-2022-23439 · Fortinet FortiProxy, Fortinet FortiOS

    A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver

    Published 22 Jan 2025 · Fixed in 7.0.6, 7.2.5, 7.4.0 · NVD
  30. Medium 4.3

    CVE-2025-21567 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL…

    Published 21 Jan 2025 · NVD
  31. Medium 6.5

    CVE-2025-21566 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 21 Jan 2025 · NVD
  32. Medium 5.5

    CVE-2025-21559 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 21 Jan 2025 · NVD
  33. Medium 5.5

    CVE-2025-21555 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 21 Jan 2025 · NVD
  34. High 7.5

    CVE-2025-21549 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 21 Jan 2025 · NVD
  35. Low 3.8

    CVE-2025-21546 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in…

    Published 21 Jan 2025 · NVD
  36. Medium 4.9

    CVE-2025-21543 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…

    Published 21 Jan 2025 · NVD
  37. Medium 5.4

    CVE-2025-21540 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in…

    Published 21 Jan 2025 · NVD
  38. Medium 4.9

    CVE-2025-21536 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…

    Published 21 Jan 2025 · NVD
  39. Critical 9.8

    CVE-2025-21535 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS…

    Published 21 Jan 2025 · NVD
  40. Medium 4.9

    CVE-2025-21534 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Performance Schema). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 21 Jan 2025 · NVD
  41. Medium 4.9

    CVE-2025-21531 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 21 Jan 2025 · NVD
  42. Medium 4.9

    CVE-2025-21529 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 21 Jan 2025 · NVD
  43. Medium 4.9

    CVE-2025-21525 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 21 Jan 2025 · NVD
  44. Medium 4.9

    CVE-2025-21523 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 21 Jan 2025 · NVD
  45. Medium 6.5

    CVE-2025-21522 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 21 Jan 2025 · NVD
  46. High 7.5

    CVE-2025-21521 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 21 Jan 2025 · NVD
  47. Low 1.8

    CVE-2025-21520 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person…

    Published 21 Jan 2025 · NVD
  48. Medium 4.4

    CVE-2025-21519 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in…

    Published 21 Jan 2025 · NVD
  49. Medium 6.5

    CVE-2025-21518 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…

    Published 21 Jan 2025 · NVD
  50. Medium 4.9

    CVE-2025-21505 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in…

    Published 21 Jan 2025 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.