UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
203
Critical in 30 days
41
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. High 8.3

    CVE-2026-28808 · Erlang/OTP

    Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved…

    Published 7 Apr 2026 · Fixed in 26.2.5.19, 27.3.4.10, 28.4.2 · NVD
  2. Medium 6.3

    CVE-2026-28810 · Erlang/OTP

    Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an…

    Published 7 Apr 2026 · Fixed in 26.2.5.19, 27.3.4.10, 28.4.2 · NVD
  3. Medium 6.4

    CVE-2025-14732 · Elementor

    Elementor Website Builder – more than just a page builder: Improper Neutralization of Alternate XSS Syntax

    Published 7 Apr 2026 · Fixed in 3.35.6 · WPVulnerability
  4. Low 2.7

    CVE-2026-34947 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, staged user custom fields and username are exposed on public invite pages without email verification. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

    Published 3 Apr 2026 · NVD
  5. Medium 6.3

    CVE-2026-27481 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass vulnerability allows unauthenticated or unauthorized users to view hidden (staff-only) tags and its associated data. All Discourse instances with tagging enabled and staff-only tag groups configured…

    Published 3 Apr 2026 · NVD
  6. Medium 6.5

    CVE-2026-35549 · MariaDB

    An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca.

    Published 3 Apr 2026 · Fixed in 11.4.10, 11.8.6, 12.2.2 · NVD
  7. Unrated

    CVE-2026-32695 · github.com/traefik/traefik, Traefik

    Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass in github.com/traefik/traefik

    Published 2 Apr 2026 · Fixed in 3.6.11, 3.7.0-ea.2 · OSV.dev and GitHub
  8. High 8.1

    CVE-2026-35414 · OpenSSH

    OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

    Published 2 Apr 2026 · Fixed in 10.3 · NVD
  9. Low 2.5

    CVE-2026-35388 · OpenSSH

    OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

    Published 2 Apr 2026 · Fixed in 10.3 · NVD
  10. Medium 6.5

    CVE-2026-35387 · OpenSSH

    OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.

    Published 2 Apr 2026 · Fixed in 10.3 · NVD
  11. High 8.1

    CVE-2026-35386 · OpenSSH

    In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.

    Published 2 Apr 2026 · Fixed in 10.3 · NVD
  12. High 8.1

    CVE-2026-35385 · OpenSSH

    In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

    Published 2 Apr 2026 · Fixed in 10.3 · NVD
  13. High 8.6

    CVE-2026-23899 · Joomla!

    An improper access check allows unauthorized access to webservice endpoints.

    Published 1 Apr 2026 · Fixed in 5.4.4, 6.0.4 · NVD
  14. High 8.6

    CVE-2026-23898 · Joomla!

    Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

    Published 1 Apr 2026 · Fixed in 5.4.4, 6.0.4 · NVD
  15. Medium 5.9

    CVE-2026-21632 · Joomla!

    Lack of output escaping for article titles leads to XSS vectors in various locations.

    Published 1 Apr 2026 · Fixed in 5.4.4, 6.0.4 · NVD
  16. Medium 5.9

    CVE-2026-21631 · Joomla!

    Lack of output escaping leads to a XSS vector in the multilingual associations component.

    Published 1 Apr 2026 · Fixed in 5.4.4, 6.0.4 · NVD
  17. Medium 6.9

    CVE-2026-21630 · Joomla!

    Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

    Published 1 Apr 2026 · Fixed in 5.4.4, 6.0.4 · NVD
  18. Medium 6.3

    CVE-2026-21629 · Joomla!

    The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.

    Published 1 Apr 2026 · Fixed in 5.4.4, 6.0.4 · NVD
  19. Unrated

    CVE-2026-5032 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 1 Apr 2026 · Fixed in 2.9.4 · WPVulnerability
  20. Medium 5.1

    CVE-2026-33415 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authenticated moderator-level user could retrieve post content, topic titles, and usernames from categories they were not authorized to view. Insufficient access controls on a sentiment analytics endpoint allowed…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  21. Medium 5.3

    CVE-2026-33300 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass in the Category Chatables Controller show action allowed moderators to get information on hidden groups names and user count. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  22. Medium 5.3

    CVE-2026-33185 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the group email settings test endpoint could be used to make the server initiate outbound connections to arbitrary hosts and ports. This could allow probing of internal network infrastructure. The endpoint was accessible to…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  23. Medium 6.3

    CVE-2026-33074 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, a user may be able to purchase a lower tier subscription but grant themselves the benefits that comes along with a higher tier subscription. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  24. Low 2.0

    CVE-2026-33073 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the discourse-subscriptions plugin leaks stripe API keys across sites in a multisite cluster resulting in the potential for stripe related information to be leaked across sites within the same multisite cluster. This issue…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  25. Medium 4.3

    CVE-2026-32951 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authenticated user can obtain shared draft topic titles by sending an inline onebox request with a category_id parameter matching the shared drafts category. This issue has been patched in versions 2026.1.3, 2026.2.2,…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  26. Medium 5.3

    CVE-2026-32620 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, non-staff users could access read receipt information for staff-only posts they weren't supposed to see. No post content was exposed, only metadata about who read the post and when. This issue has been patched in versions…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  27. Medium 6.3

    CVE-2026-32619 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, users who lost access to a topic (e.g., removed from a private category group) could still interact with polls in that topic, including voting and toggling poll status. No content was exposed, but users could modify poll…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  28. Medium 4.3

    CVE-2026-32618 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, there is possible channel membership inference from chat user search without authorization. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  29. Medium 5.3

    CVE-2026-32615 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, category group moderators could perform privileged actions on topics inside private categories they did not have read access to. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  30. Low 2.1

    CVE-2026-32607 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, when the hidden prioritize_full_name_in_ux site setting is enabled (defaults to false, requires console access to change), user and group display names are rendered without HTML escaping in several assignment-related UI…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  31. Medium 5.4

    CVE-2026-32273 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, updating a category description via API is not sanitizing the description string, which can lead to XSS attacks. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  32. Medium 5.3

    CVE-2026-32243 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an attacker with the ability to create shared AI conversations could inject arbitrary HTML and JavaScript via crafted conversation titles. This payload would execute in the browser of any user viewing the onebox preview,…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  33. Medium 5.3

    CVE-2026-32143 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, moderators could export CSV data for admin-restricted reports, bypassing the report visibility restrictions. This could expose sensitive operational data intended only for admins. This issue has been patched in versions…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  34. Medium 5.1

    CVE-2026-32113 · Discourse

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the enter action in StaticController reads the sso_destination_url cookie and redirects to it with allow_other_host: true without validating the destination URL. While this cookie is normally set during legitimate…

    Published 31 Mar 2026 · Fixed in 2026.1.3, 2026.2.2 · NVD
  35. High 8.1

    CVE-2026-40764 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 31 Mar 2026 · Fixed in 1.10.0.3 · WPVulnerability
  36. Medium 6.0

    CVE-2026-5170 · MongoDB

    A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set. This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server…

    Published 30 Mar 2026 · Fixed in 7.0.31, 8.0.18, 8.2.2 · NVD
  37. High 8.8

    CVE-2026-2370 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks.

    Published 30 Mar 2026 · Fixed in 18.8.7, 18.9.3 · NVD
  38. Unrated

    CVE-2026-4146 · Loco Translate (WordPress plugin)

    Vulnerability in Loco Translate

    Published 30 Mar 2026 · Fixed in 2.8.3 · WPVulnerability
  39. High 7.5

    CVE-2024-45296 · path-to-regexp

    path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

    Published 27 Mar 2026 · Fixed in 0.1.13 · OSV.dev and GitHub
  40. High

    CVE-2026-6409 · google/protobuf

    Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion

    Published 25 Mar 2026 · Fixed in 4.33.6 · OSV.dev and GitHub
  41. High 8.8

    CVE-2026-34040 · Docker Engine

    AuthZ plugin bypass with oversized request body

    Published 25 Mar 2026 · Fixed in 29.3.1 · Project advisories (GitHub)
  42. Medium 6.8

    CVE-2026-33997 · Docker Engine

    Off-by-one error in plugin privilege validation

    Published 25 Mar 2026 · Fixed in 29.3.1 · Project advisories (GitHub)
  43. High 7.5

    CVE-2026-3988 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance unresponsive due to improper input validation in GraphQL request processing.

    Published 25 Mar 2026 · Fixed in 18.8.7, 18.9.3 · NVD
  44. High 8.8

    CVE-2026-3857 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.

    Published 25 Mar 2026 · Fixed in 18.8.7, 18.9.3 · NVD
  45. Medium 5.4

    CVE-2026-2995 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper sanitization of HTML content.

    Published 25 Mar 2026 · Fixed in 18.8.7, 18.9.3 · NVD
  46. Medium 5.4

    CVE-2026-2973 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to execute arbitrary JavaScript in a user's browser due to improper sanitization of entity-encoded content in Mermaid diagrams.

    Published 25 Mar 2026 · Fixed in 18.8.7, 18.9.3 · NVD
  47. High 8.1

    CVE-2026-2745 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 7.11 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to bypass WebAuthn two-factor authentication and gain unauthorized access to user accounts due to inconsistent input validation in the authentication process.

    Published 25 Mar 2026 · Fixed in 18.8.7, 18.9.3 · NVD
  48. Medium 4.3

    CVE-2026-2726 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to perform unauthorized actions on merge requests in other projects due to improper access control during cross-repository operations.

    Published 25 Mar 2026 · Fixed in 18.8.7, 18.9.3 · NVD
  49. High 7.5

    CVE-2026-1724 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to access API tokens of self-hosted AI models due to improper access control.

    Published 25 Mar 2026 · Fixed in 18.8.7, 18.9.3 · NVD
  50. Medium 4.3

    CVE-2025-14595 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user with Planner role to view security category metadata and attributes in group security configuration due to improper access control

    Published 25 Mar 2026 · Fixed in 18.8.7, 18.9.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.