UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
211
Critical in 30 days
41
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. Medium 5.1

    CVE-2022-50958 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 10 May 2026 · WPVulnerability
  2. Medium 4.3

    CVE-2026-44458 · hono

    Hono has CSS Declaration Injection via Style Object Values in JSX SSR

    Published 9 May 2026 · Fixed in 4.12.18 · OSV.dev and GitHub
  3. Low 3.8

    CVE-2026-44459 · hono

    Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

    Published 9 May 2026 · Fixed in 4.12.18 · OSV.dev and GitHub
  4. Medium 5.3

    CVE-2026-44457 · hono

    Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

    Published 9 May 2026 · Fixed in 4.12.18 · OSV.dev and GitHub
  5. High 7.5

    CVE-2026-6322 · fast-uri

    fast-uri vulnerable to host confusion via percent-encoded authority delimiters

    Published 8 May 2026 · Fixed in 2.4.1, 3.1.2 · OSV.dev and GitHub
  6. High 7.5

    CVE-2026-6321 · fast-uri

    fast-uri vulnerable to path traversal via percent-encoded dot segments

    Published 8 May 2026 · Fixed in 2.4.1, 3.1.1 · OSV.dev and GitHub
  7. High 7.1

    CVE-2026-8063 · MongoDB

    An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads the first element on each stage’s input pipeline array without first verifying that the array is…

    Published 7 May 2026 · Fixed in 8.2.7 · NVD
  8. Unrated

    CVE-2026-82305 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Authorization Bypass Through User-Controlled Key

    Published 7 May 2026 · Fixed in 4.18.1 · WPVulnerability
  9. Medium 5.3

    CVE-2026-27329 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Authorization Bypass Through User-Controlled Key

    Published 7 May 2026 · Fixed in 4.13.0 · WPVulnerability
  10. Medium 6.5

    CVE-2026-44456 · hono

    Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

    Published 6 May 2026 · Fixed in 4.12.16 · OSV.dev and GitHub
  11. Medium 4.7

    CVE-2026-44455 · hono

    hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection

    Published 6 May 2026 · Fixed in 4.12.16 · OSV.dev and GitHub
  12. Medium 4.2

    GHSA-4c35-wcg5-mm9h · next-intl

    next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys

    Published 6 May 2026 · Fixed in 4.9.2 · OSV.dev and GitHub
  13. Low 3.7

    GHSA-r27j-894h-3w3p · icu-minify

    mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`

    Published 6 May 2026 · Fixed in 4.9.2 · OSV.dev and GitHub
  14. High 8.1

    CVE-2026-7252 · WP Optimize (WordPress plugin)

    WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance: Path Traversal

    Published 6 May 2026 · Fixed in 4.5.3 · WPVulnerability
  15. High 8.8

    CVE-2026-6692 · Slider Revolution

    Slider Revolution: Unrestricted Upload of File with Dangerous Type

    Published 6 May 2026 · Fixed in 7.0.11 · WPVulnerability
  16. Critical 9.8

    CVE-2026-28780 · Apache HTTP Server

    Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67,…

    Published 5 May 2026 · Fixed in 2.4.67 · NVD
  17. Medium

    CVE-2026-42338 · ip-address

    ip-address has XSS in Address6 HTML-emitting methods

    Published 5 May 2026 · Fixed in 10.1.1 · OSV.dev and GitHub
  18. High 7.7

    CVE-2026-25243 · Redis

    Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL…

    Published 5 May 2026 · Fixed in 8.6.3 · NVD
  19. Medium 6.1

    CVE-2026-23631 · Redis

    Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using…

    Published 5 May 2026 · Fixed in 8.6.3 · NVD
  20. High 7.7

    CVE-2026-23479 · Redis

    Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.

    Published 5 May 2026 · Fixed in 8.6.3 · NVD
  21. High 7.3

    CVE-2026-29168 · Apache HTTP Server

    Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

    Published 5 May 2026 · Fixed in 2.4.67 · NVD
  22. Medium 5.3

    CVE-2026-42037 · axios

    Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

    Published 5 May 2026 · Fixed in 1.15.1 · OSV.dev and GitHub
  23. Medium 6.8

    CVE-2026-42038 · axios

    Axios: no_proxy bypass via IP alias allows SSRF

    Published 5 May 2026 · Fixed in 0.31.1, 1.15.1 · OSV.dev and GitHub
  24. Medium 7.5

    CVE-2026-42039 · axios

    Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

    Published 5 May 2026 · Fixed in 0.31.1, 1.15.1 · OSV.dev and GitHub
  25. Medium 5.3

    CVE-2026-42034 · axios

    Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

    Published 5 May 2026 · Fixed in 0.31.1, 1.15.1 · OSV.dev and GitHub
  26. Medium 5.3

    CVE-2026-42036 · axios

    Axios: HTTP adapter streamed responses bypass maxContentLength

    Published 5 May 2026 · Fixed in 0.31.1, 1.15.1 · OSV.dev and GitHub
  27. High 7.4

    CVE-2026-42033 · axios

    Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

    Published 5 May 2026 · Fixed in 0.31.1, 1.15.1 · OSV.dev and GitHub
  28. High 7.4

    CVE-2026-42035 · axios

    Axios: Header Injection via Prototype Pollution

    Published 5 May 2026 · Fixed in 0.31.1, 1.15.1 · OSV.dev and GitHub
  29. Medium 5.4

    CVE-2026-42042 · axios

    Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

    Published 5 May 2026 · Fixed in 0.31.1, 1.15.1 · OSV.dev and GitHub
  30. Medium 4.8

    CVE-2026-42041 · axios

    Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

    Published 5 May 2026 · Fixed in 0.31.1, 1.15.1 · OSV.dev and GitHub
  31. High 7.2

    CVE-2026-42043 · axios

    Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

    Published 5 May 2026 · Fixed in 0.31.1, 1.15.1 · OSV.dev and GitHub
  32. Medium 6.5

    CVE-2026-42044 · axios

    Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

    Published 5 May 2026 · Fixed in 1.15.2 · OSV.dev and GitHub
  33. High 7.4

    CVE-2026-42264 · axios

    Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

    Published 5 May 2026 · Fixed in 1.15.2 · OSV.dev and GitHub
  34. Low 3.7

    CVE-2026-42040 · axios

    Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

    Published 5 May 2026 · Fixed in 0.31.1, 1.15.1 · OSV.dev and GitHub
  35. Medium 6.5

    CVE-2026-33523 · Apache HTTP Server

    HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Server: from through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

    Published 4 May 2026 · Fixed in 2.4.67 · NVD
  36. Medium 5.3

    CVE-2026-33007 · Apache HTTP Server

    A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

    Published 4 May 2026 · Fixed in 2.4.67 · NVD
  37. Medium 4.8

    CVE-2026-33006 · Apache HTTP Server

    A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

    Published 4 May 2026 · Fixed in 2.4.67 · NVD
  38. High 7.5

    CVE-2026-29169 · Apache HTTP Server

    A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or mod_dav_fs. The only known use-case for mod_dav_lock was mod_dav_svn from Apache Subversion earlier than version 1.2.0. Users are recommended to upgrade to version 2.4.66, which fixes this issue,…

    Published 4 May 2026 · Fixed in 2.4.67 · NVD
  39. High 8.8

    CVE-2026-23918 · Apache HTTP Server

    Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

    Published 4 May 2026 · NVD
  40. Medium 5.3

    CVE-2026-34032 · Apache HTTP Server

    Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

    Published 4 May 2026 · Fixed in 2.4.67 · NVD
  41. Medium 5.3

    CVE-2026-33857 · Apache HTTP Server

    Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

    Published 4 May 2026 · Fixed in 2.4.67 · NVD
  42. High 7.5

    CVE-2026-34059 · Apache HTTP Server

    Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

    Published 4 May 2026 · Fixed in 2.4.67 · NVD
  43. High 8.8

    CVE-2026-24072 · Apache HTTP Server

    An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

    Published 4 May 2026 · Fixed in 2.4.67 · NVD
  44. Medium 4.9

    CVE-2026-1921 · Loco Translate (WordPress plugin)

    Loco Translate: Path Traversal

    Published 4 May 2026 · Fixed in 2.8.3 · WPVulnerability
  45. High 8.1

    CVE-2026-42349 · @clerk/astro, @clerk/backend, @clerk/chrome-extension and 14 more

    Clerk has an authorization bypass when combining organization, billing, or reverification checks

    Published 30 Apr 2026 · Fixed in 6.7.5, 6.39.3, 7.2.4 · OSV.dev and GitHub
  46. Medium 6.4

    CVE-2026-6127 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 30 Apr 2026 · Fixed in 4.0.5 · WPVulnerability
  47. High 7.5

    CVE-2026-40902 · phpoffice/phpspreadsheet

    PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

    Published 29 Apr 2026 · Fixed in 2.4.5, 3.10.5, 5.7.0 · OSV.dev and GitHub
  48. High 7.5

    CVE-2026-40863 · phpoffice/phpspreadsheet

    PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

    Published 29 Apr 2026 · Fixed in 2.4.5, 3.10.5, 5.7.0 · OSV.dev and GitHub
  49. Critical

    CVE-2026-34084 · phpoffice/phpspreadsheet

    PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled

    Published 29 Apr 2026 · Fixed in 2.4.4, 3.10.4, 5.6.0 · OSV.dev and GitHub
  50. Medium 5.3

    CVE-2026-6915 · MongoDB

    An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account.

    Published 29 Apr 2026 · Fixed in 7.0.32, 8.0.21, 8.2.7 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.