Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 38,083
- Published in 7 days
- 642
- Critical in 30 days
- 387
- Actively exploited
- 420
Latest vulnerabilities
38,083 vulnerabilities- Medium 4.9
CVE-2025-21504 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…
Published 21 Jan 2025 · NVD - Medium 4.9
CVE-2025-21503 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…
Published 21 Jan 2025 · NVD - Medium 4.8
CVE-2025-21502 · Java
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM Enterprise Edition: 20.3.16 and 21.3.12. Difficult to exploit vulnerability allows…
Published 21 Jan 2025 · NVD - Medium 6.5
CVE-2025-21501 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…
Published 21 Jan 2025 · NVD - Medium 6.5
CVE-2025-21500 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…
Published 21 Jan 2025 · NVD - Medium 4.9
CVE-2025-21499 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…
Published 21 Jan 2025 · NVD - Medium 5.5
CVE-2025-21497 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…
Published 21 Jan 2025 · NVD - Medium 4.1
CVE-2025-21494 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can…
Published 21 Jan 2025 · NVD - Medium 4.4
CVE-2025-21493 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…
Published 21 Jan 2025 · NVD - Medium 4.9
CVE-2025-21492 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…
Published 21 Jan 2025 · NVD - Medium 4.9
CVE-2025-21491 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…
Published 21 Jan 2025 · NVD - Medium 4.9
CVE-2025-21490 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…
Published 21 Jan 2025 · NVD - Medium 6.5
CVE-2025-24461 · TeamCity
In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint
Published 21 Jan 2025 · NVD - Medium 4.3
CVE-2025-24460 · TeamCity
In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool
Published 21 Jan 2025 · Fixed in 2024.12.1 · NVD - Medium 6.1
CVE-2025-24459 · TeamCity
In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page
Published 21 Jan 2025 · Fixed in 2024.12.1 · NVD - Medium 6.5
CVE-2024-52973 · Kibana
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana.
Published 21 Jan 2025 · Fixed in 7.17.23, 8.14.2 · NVD - High 7.5
CVE-2024-43709 · Elasticsearch
An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.
Published 21 Jan 2025 · Fixed in 7.17.21, 8.13.3 · NVD - Medium 5.4
CVE-2025-24012 · Umbraco CMS
XSS/HTML Injection Vulnerability in Umbraco Backoffice Components
Published 21 Jan 2025 · Fixed in 14.3.2, 15.1.2 · NVD, Project advisories (GitHub) - Medium 5.3
CVE-2025-24011 · Umbraco CMS
User Enumeration Feasible Based On Management API Timing and Response Codes
Published 21 Jan 2025 · Fixed in 14.3.2, 15.1.2 · NVD, Project advisories (GitHub) - High 7.1
CVE-2025-24019 · YesWiki
Authenticated arbitrary file deletion in YesWiki <= 4.4.5
Published 21 Jan 2025 · Fixed in 4.5.0 · NVD, Project advisories (GitHub) - Medium 5.4
CVE-2025-24018 · YesWiki
Authenticated Stored XSS in YesWiki <= 4.4.5
Published 21 Jan 2025 · Fixed in 4.5.0 · NVD, Project advisories (GitHub) - Medium 6.1
CVE-2025-24017 · YesWiki
Unauthenticated DOM Based XSS in YesWiki <= 4.4.5
Published 21 Jan 2025 · Fixed in 4.5.0 · NVD, Project advisories (GitHub) - Medium
CVE-2025-23085 · Node.js
GOAWAY HTTP/2 frames cause memory leak outside heap
Published 21 Jan 2025 · Fixed in 20.18.2, 22.13.1, 23.6.1 · nodejs - Medium 5.5
CVE-2025-23084 · Node.js
Path traversal by drive name in Windows environment
Published 21 Jan 2025 · Fixed in 20.18.2, 22.13.1, 23.6.1 · NVD, nodejs - High
CVE-2025-23083 · Node.js
Worker permission bypass via InternalWorker leak in diagnostics
Published 21 Jan 2025 · Fixed in 20.18.2, 22.13.1, 23.6.1 · nodejs - High 8.1Actively exploited
CVE-2025-23209 · Craft CMS
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8.…
Published 18 Jan 2025 · Fixed in 4.13.8, 5.5.8 · NVD - High 7.5
CVE-2025-20621 · Mattermost
Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel.
Published 16 Jan 2025 · Fixed in 9.11.6, 10.0.4, 10.1.4 · NVD - Medium 4.8
CVE-2025-0518 · FFmpeg
Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C . This issue affects FFmpeg: 7.1. Issue was fixed: https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a…
Published 16 Jan 2025 · NVD - Critical 9.1
CVE-2024-48885 · Fortinet FortiWeb
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0 all versions, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions, FortiWeb 6.4 all versions…
Published 16 Jan 2025 · Fixed in 7.4.5 · NVD - High 7.5
CVE-2024-13333 · File Manager Advanced (WordPress plugin)
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Unrestricted Upload of File with Dangerous Type
Published 16 Jan 2025 · Fixed in 5.2.14 · WPVulnerability - Critical 9.1
CVE-2025-22146 · Sentry
Improper authentication on SAML SSO process allows user impersonation
Published 15 Jan 2025 · Fixed in 25.1.0 · Project advisories (GitHub) - Medium 6.5
CVE-2025-20088 · Mattermost
Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.
Published 15 Jan 2025 · Fixed in 9.11.6, 10.0.4, 10.1.4 · NVD - Medium 6.5
CVE-2025-20086 · Mattermost
Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.
Published 15 Jan 2025 · Fixed in 9.11.6, 10.0.4, 10.1.4 · NVD - Medium 6.5
CVE-2025-21088 · Mattermost
Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the frontend via crafted malicious input.
Published 15 Jan 2025 · Fixed in 9.11.6, 10.0.4, 10.1.4 · NVD - Critical 9.8
CVE-2024-12084 · rsync
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
Published 15 Jan 2025 · NVD - Medium 6.1
CVE-2025-0215 · UpdraftPlus
UpdraftPlus: WP Backup & Migration Plugin: Cross-site Scripting
Published 15 Jan 2025 · Fixed in 1.25.1 · WPVulnerability - Medium 5.4
CVE-2024-53277 · Silverstripe CMS
XSS in form messages
Published 14 Jan 2025 · Fixed in 5.3.8 · NVD, Project advisories (GitHub) - Low
GHSA-mqf3-qpc3-g26q · Silverstripe CMS
Reflected Cross Site Scripting (XSS) in error message
Published 14 Jan 2025 · Fixed in 5.3.8 · Project advisories (GitHub) - High 8.9
CVE-2024-52281 · Rancher
Stored XSS in Rancher UI
Published 14 Jan 2025 · Fixed in 2.9.4, 2.10.0 · Project advisories (GitHub) - High 8.8
CVE-2025-21176 · .NET
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
Published 14 Jan 2025 · NVD - High 7.3
CVE-2025-21173 · .NET
.NET Elevation of Privilege Vulnerability
Published 14 Jan 2025 · NVD - High 7.5
CVE-2025-21172 · .NET
.NET and Visual Studio Remote Code Execution Vulnerability
Published 14 Jan 2025 · NVD - High 7.5
CVE-2025-21171 · .NET
.NET Remote Code Execution Vulnerability
Published 14 Jan 2025 · NVD - High 7.5
CVE-2024-12088 · rsync
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
Published 14 Jan 2025 · NVD - High 7.5
CVE-2024-12087 · rsync
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could…
Published 14 Jan 2025 · NVD - Medium 6.8
CVE-2024-12086 · rsync
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed…
Published 14 Jan 2025 · NVD - High 7.5
CVE-2024-12085 · rsync
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
Published 14 Jan 2025 · Fixed in 3.3.0 · NVD - Low 2.7
CVE-2024-55593 · Fortinet FortiWeb
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWeb versions 6.3.17 through 7.6.1 allows attacker to gain information disclosure via crafted SQL queries
Published 14 Jan 2025 · Fixed in 7.6.2 · NVD - Critical 9.8Actively exploited
CVE-2024-55591 · Fortinet FortiProxy, Fortinet FortiOS
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
Published 14 Jan 2025 · Fixed in 7.0.17, 7.0.20, 7.2.13 · NVD - Medium 5.8
CVE-2024-54021 · Fortinet FortiProxy, Fortinet FortiOS
An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in Fortinet FortiOS 7.2.0 through 7.6.0, FortiProxy 7.2.0 through 7.4.5 may allow a remote unauthenticated attacker to bypass the file filter via crafted HTTP headers.
Published 14 Jan 2025 · Fixed in 7.2.12, 7.4.5, 7.4.6 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.