UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
203
Critical in 30 days
41
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. Medium 6.0

    CVE-2026-22003 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u481 and 8u481-b50; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition…

    Published 21 Apr 2026 · NVD
  2. Medium 4.9

    CVE-2026-22002 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 21 Apr 2026 · NVD
  3. Low 2.7

    CVE-2026-22001 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access…

    Published 21 Apr 2026 · NVD
  4. Medium 4.9

    CVE-2026-21998 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 21 Apr 2026 · NVD
  5. Critical 9.1

    CVE-2026-40372 · .NET

    Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

    Published 21 Apr 2026 · Fixed in 10.0.7 · NVD
  6. Medium 5.3

    CVE-2026-32147 · Erlang/OTP

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory. The SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle,…

    Published 21 Apr 2026 · Fixed in 26.2.5.20, 27.3.4.11, 28.4.3 · NVD
  7. High 7.5

    CVE-2026-33116 · .NET

    Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.

    Published 14 Apr 2026 · Fixed in 8.0.26, 9.0.15, 10.0.6 · NVD
  8. High 7.5

    CVE-2026-32203 · .NET

    Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.

    Published 14 Apr 2026 · Fixed in 8.0.26, 9.0.15, 10.0.6 · NVD
  9. High 7.5

    CVE-2026-32178 · .NET

    Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.

    Published 14 Apr 2026 · Fixed in 8.0.26, 9.0.15, 10.0.6 · NVD
  10. High 7.5

    CVE-2026-26171 · .NET

    Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.

    Published 14 Apr 2026 · Fixed in 8.0.26, 9.0.15, 10.0.6 · NVD
  11. Medium

    CVE-2026-40895 · follow-redirects

    follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

    Published 14 Apr 2026 · Fixed in 1.16.0 · OSV.dev and GitHub
  12. Medium 5.3

    CVE-2026-4812 · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Published 14 Apr 2026 · Fixed in 6.7.1 · WPVulnerability
  13. Medium 5.8

    CVE-2026-33555 · HAProxy

    An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

    Published 13 Apr 2026 · Fixed in 3.3.6 · NVD
  14. Unrated

    CVE-2026-4059 · Woolentor Addons (WordPress plugin)

    Vulnerability in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

    Published 13 Apr 2026 · Fixed in 3.3.6 · WPVulnerability
  15. Medium 4.8

    CVE-2026-40175 · axios

    Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

    Published 10 Apr 2026 · Fixed in 0.31.0, 1.15.0 · OSV.dev and GitHub
  16. High 7.5

    GHSA-q4gf-8mx6-v5v3 · Next.js

    Next.js has a Denial of Service with Server Components

    Published 10 Apr 2026 · Fixed in 15.5.15, 16.2.3 · OSV.dev and GitHub
  17. High 7.5

    CVE-2026-23869 · react-server-dom-parcel, react-server-dom-turbopack, React

    React Server Components have a Denial of Service Vulnerability

    Published 10 Apr 2026 · Fixed in 19.0.5, 19.1.6, 19.2.5 · OSV.dev and GitHub
  18. Medium 6.5

    CVE-2026-34500 · Apache Tomcat

    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

    Published 9 Apr 2026 · Fixed in 9.0.117, 10.1.54, 11.0.21 · NVD
  19. High 7.5

    CVE-2026-34487 · Apache Tomcat

    Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

    Published 9 Apr 2026 · Fixed in 9.0.117, 10.1.54, 11.0.21 · NVD
  20. High 7.5Actively exploited

    CVE-2026-34486 · Apache Tomcat

    Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

    Published 9 Apr 2026 · NVD
  21. High 7.5

    CVE-2026-34483 · Apache Tomcat

    Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.

    Published 9 Apr 2026 · Fixed in 9.0.117, 10.1.54, 11.0.21 · NVD
  22. Medium 5.3

    CVE-2026-32990 · Apache Tomcat

    Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

    Published 9 Apr 2026 · Fixed in 9.0.116, 10.1.53, 11.0.20 · NVD
  23. High 7.5

    CVE-2026-29146 · Apache Tomcat

    Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

    Published 9 Apr 2026 · Fixed in 9.0.116, 10.1.53, 11.0.20 · NVD
  24. Critical 9.1

    CVE-2026-29145 · Apache Tomcat

    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0…

    Published 9 Apr 2026 · Fixed in 9.0.116, 10.1.53, 11.0.20 · NVD
  25. High 7.5

    CVE-2026-29129 · Apache Tomcat

    Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

    Published 9 Apr 2026 · Fixed in 9.0.116, 10.1.53, 11.0.20 · NVD
  26. Medium 6.1

    CVE-2026-25854 · Apache Tomcat

    Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected Users are recommended to upgrade to version 11.0.20, 10.1.53…

    Published 9 Apr 2026 · Fixed in 9.0.116, 10.1.53, 11.0.20 · NVD
  27. High 7.5

    CVE-2026-24880 · Apache Tomcat

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected. Users are recommended…

    Published 9 Apr 2026 · Fixed in 9.0.116, 10.1.53, 11.0.20 · NVD
  28. Low 3.5

    CVE-2026-40077 · Beszel

    IDOR in hub API endpoints that read system ID from URL parameter

    Published 9 Apr 2026 · Project advisories (GitHub)
  29. Medium 4.8

    CVE-2025-62718 · axios

    Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

    Published 9 Apr 2026 · Fixed in 0.31.0, 1.15.0 · OSV.dev and GitHub
  30. Unrated

    CVE-2026-2712 · WP Optimize (WordPress plugin)

    Vulnerability in WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance

    Published 9 Apr 2026 · Fixed in 4.5.1 · WPVulnerability
  31. High 8.5

    CVE-2026-5173 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections due to improper access control.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  32. Low 2.7

    CVE-2026-4916 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with custom role permissions to demote or remove higher-privileged group members due to improper authorization checks on member management operations.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  33. Medium 5.4

    CVE-2026-4398 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own project, due to missing namespace validation on self-managed instances.

    Published 8 Apr 2026 · Fixed in 19.1.7, 19.2.5 · NVD
  34. Medium 5.4

    CVE-2026-4332 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  35. Medium 4.3

    CVE-2026-2619 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects due to incorrect authorization.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  36. Medium 4.3

    CVE-2026-2104 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to access confidential issues assigned to other users via CSV export due to insufficient authorization checks.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  37. Medium 4.3

    CVE-2026-1752 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in the API.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  38. Medium 5.7

    CVE-2026-1516 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.0.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that in Code Quality reports could have allowed an authenticated user to leak IP addresses of users viewing the report via specially crafted content.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  39. Medium 6.5

    CVE-2026-1101 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to cause denial of service to the GitLab instance due to improper input validation in GraphQL queries.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  40. High 7.5

    CVE-2026-1092 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service due to improper input validation of JSON payloads.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  41. Medium 4.3

    CVE-2025-9484 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user to have access to other users' email addresses via certain GraphQL queries.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  42. High 7.5

    CVE-2025-12664 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries.

    Published 8 Apr 2026 · Fixed in 18.8.9, 18.9.5, 18.10.3 · NVD
  43. High 7.5

    CVE-2026-31790 · OpenSSL

    Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes…

    Published 7 Apr 2026 · Fixed in 3.4.5, 3.5.6, 3.6.2 · NVD
  44. Critical 9.8

    CVE-2026-31789 · OpenSSL

    Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such…

    Published 7 Apr 2026 · Fixed in 3.4.5, 3.5.6, 3.6.2 · NVD
  45. High 7.5

    CVE-2026-28390 · OpenSSL

    Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP…

    Published 7 Apr 2026 · Fixed in 3.4.5, 3.5.6, 3.6.2 · NVD
  46. High 7.5

    CVE-2026-28389 · OpenSSL

    Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional…

    Published 7 Apr 2026 · Fixed in 3.4.5, 3.5.6, 3.6.2 · NVD
  47. High 7.5

    CVE-2026-28388 · OpenSSL

    Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the…

    Published 7 Apr 2026 · Fixed in 3.4.5, 3.5.6, 3.6.2 · NVD
  48. High 8.1

    CVE-2026-28387 · OpenSSL

    Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue…

    Published 7 Apr 2026 · Fixed in 3.4.5, 3.5.6, 3.6.2 · NVD
  49. High 7.5

    CVE-2026-28386 · OpenSSL

    Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds read of up to 15 bytes when processing partial cipher blocks. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is…

    Published 7 Apr 2026 · Fixed in 3.6.2 · NVD
  50. High 7.6

    CVE-2026-32144 · Erlang/OTP

    Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification. The OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder…

    Published 7 Apr 2026 · Fixed in 27.3.4.10, 28.4.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.