UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
203
Critical in 30 days
41
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. Medium 6.5

    CVE-2025-13436 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when handling certain CI-related inputs.

    Published 25 Mar 2026 · Fixed in 18.8.7, 18.9.3 · NVD
  2. Medium 6.5

    CVE-2025-13078 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when processing certain webhook configuration inputs.

    Published 25 Mar 2026 · Fixed in 18.8.7, 18.9.3 · NVD
  3. Low 3.7

    CVE-2026-4363 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user to gain unauthorized access to resources due to improper caching of authorization decisions.

    Published 25 Mar 2026 · Fixed in 18.8.7, 18.9.3 · NVD
  4. Unrated

    CVE-2026-1206 · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 25 Mar 2026 · Fixed in 3.35.8 · WPVulnerability
  5. High 8.5

    CVE-2026-32647 · nginx

    NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4…

    Published 24 Mar 2026 · Fixed in 1.28.3, 1.29.7 · NVD
  6. Medium 5.3

    CVE-2026-28755 · nginx

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.   Note: Software versions which have reached End of Technical Support (EoTS)…

    Published 24 Mar 2026 · Fixed in 1.28.3, 1.29.7 · NVD
  7. Medium 6.3

    CVE-2026-28753 · nginx

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 24 Mar 2026 · Fixed in 1.28.3, 1.29.7 · NVD
  8. High 8.5

    CVE-2026-27784 · nginx

    The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration…

    Published 24 Mar 2026 · Fixed in 1.28.3, 1.29.7 · NVD
  9. High 8.8

    CVE-2026-27654 · nginx

    NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the…

    Published 24 Mar 2026 · Fixed in 1.28.3, 1.29.7 · NVD
  10. High 8.7

    CVE-2026-27651 · nginx

    When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are…

    Published 24 Mar 2026 · Fixed in 1.28.3, 1.29.7 · NVD
  11. Medium 5.9

    CVE-2026-21717 · Node.js

    HashDoS in V8

    Published 24 Mar 2026 · Fixed in 22.22.2, 24.14.1, 25.8.2 · NVD, nodejs
  12. Low 3.3

    CVE-2026-21716 · Node.js

    CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown

    Published 24 Mar 2026 · Fixed in 22.22.2, 24.14.1, 25.8.2 · NVD, nodejs
  13. Low 3.3

    CVE-2026-21715 · Node.js

    Permission Model Bypass in realpathSync.native Allows File Existence Disclosure

    Published 24 Mar 2026 · Fixed in 22.22.2, 24.14.1, 25.8.2 · NVD, nodejs
  14. Medium 5.3

    CVE-2026-21714 · Node.js

    Memory leak in Node.js HTTP/2 server via `WINDOW_UPDATE` on stream 0 leads to resource exhaustion

    Published 24 Mar 2026 · Fixed in 22.22.2, 24.14.1, 25.8.2 · NVD, nodejs
  15. Medium 5.9

    CVE-2026-21713 · Node.js

    Timing side-channel in HMAC verification via `memcmp()` in `crypto_hmac.cc` leads to potential MAC forgery

    Published 24 Mar 2026 · Fixed in 22.22.2, 24.14.1, 25.8.2 · NVD, nodejs
  16. Medium 6.5

    CVE-2026-21712 · Node.js

    Assertion error in `node_url.cc` via malformed URL format leads to Node.js crash

    Published 24 Mar 2026 · Fixed in 24.14.1, 25.8.2 · NVD, nodejs
  17. Medium 5.3

    CVE-2026-21711 · Node.js

    Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net`

    Published 24 Mar 2026 · Fixed in 20.0.0, 25.8.2 · NVD, nodejs
  18. High 7.5

    CVE-2026-21710 · Node.js

    Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)

    Published 24 Mar 2026 · Fixed in 22.22.2, 24.14.1, 25.8.2 · NVD, nodejs
  19. Medium 6.5

    CVE-2026-25339 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Insertion of Sensitive Information Into Sent Data

    Published 23 Mar 2026 · Fixed in 1.9.9.2 · WPVulnerability
  20. Medium 4.9

    CVE-2026-33428 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a non-staff user with elevated group membership could access deleted posts belonging to any user due to an overly broad authorization check on the deleted posts index endpoint. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

    Published 21 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  21. Low 2.7

    CVE-2026-33427 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an unauthenticated attacker can cause a legitimate Discourse authorization page to display an attacker-controlled domain, facilitating social engineering attacks against users. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

    Published 21 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  22. Low 3.8

    CVE-2026-33426 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, users with tag-editing permissions could edit and create synonyms for tags hidden in restricted tag groups, even if they lacked visibility into those tags. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

    Published 21 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  23. Medium 6.9

    CVE-2026-33425 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, unauthenticated users can determine whether a specific user is a member of a private group by observing changes in directory results when using the `exclude_groups` parameter. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, disable public access to…

    Published 21 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  24. Medium 4.3

    CVE-2026-33424 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an attacker can grant access to a private message topic through invites even after they lose access to that PM. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

    Published 21 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  25. Unrated

    CVE-2026-3427 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 21 Mar 2026 · Fixed in 27.2 · WPVulnerability
  26. Low 1.3

    CVE-2026-33423 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, staff can modify any user's group notification level. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

    Published 20 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  27. Medium 4.3

    CVE-2026-33422 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `ip_address` of a flagged user is exposed to any user who can access the review queue, including users who should not be able to see IP addresses. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

    Published 20 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  28. Medium 5.4

    CVE-2026-33411 · Discourse

    Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a potential stored XSS in topic titles for the solved posts stream. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS…

    Published 20 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  29. Medium 5.1

    CVE-2026-33291 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, moderators can create Zendesk tickets for topics they do not have access to view. This affects all forums that use the Zendesk plugin. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

    Published 20 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  30. Medium 5.4

    CVE-2026-33251 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authorization bypass vulnerability in hidden Solved topics may allow unauthorized users to accept or unaccept solutions. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, ensure only trusted users are part of the Site Setting for…

    Published 20 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  31. Critical 9.9

    CVE-2026-32710 · MariaDB

    MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab…

    Published 20 Mar 2026 · Fixed in 11.4.10, 11.8.6 · NVD
  32. High 7.0

    CVE-2026-4519 · Python

    The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

    Published 20 Mar 2026 · Fixed in 3.13.13, 3.14.4 · NVD
  33. Medium 5.3

    CVE-2026-32114 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, there is an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access metadata about AI personas, features, and LLM models by providing their identifiers. This information includes credit allocations and usage statistics which are not intended to…

    Published 20 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  34. Medium 5.3

    CVE-2026-31869 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ComposerController#mentions endpoint reveals hidden group membership to any authenticated user who can message the group. By supplying allowed_names referencing a hidden-membership group and probing arbitrary usernames, an attacker can infer membership based on whether user_reasons…

    Published 20 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  35. High 8.2

    CVE-2026-31805 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authorization bypass in the poll plugin allowed authenticated users to vote on, remove votes from, or toggle the open/closed status of polls they did not have access to. By passing post_id as an array (e.g. post_id[]=&post_id[]=), the authorization check resolves to the accessible…

    Published 20 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  36. Medium 5.3

    CVE-2026-30891 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a user could access another user's private activity due to insufficient authorization checks in the user actions endpoint. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch.

    Published 20 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  37. Medium 5.3

    CVE-2026-30889 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a moderator could exploit insufficient authorization checks to access metadata of posts they should not have permission to view. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch.

    Published 20 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  38. Medium 5.5

    CVE-2026-30888 · Discourse

    Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 allow a moderator to edit site policy documents (ToS, guidelines, privacy policy) that they are explicitly prohibited from modifying. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

    Published 20 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  39. Unrated

    CVE-2026-4432 · Yith Woocommerce Wishlist (WordPress plugin)

    Vulnerability in YITH WooCommerce Wishlist

    Published 20 Mar 2026 · Fixed in 4.13.0 · WPVulnerability
  40. Low 2.7

    CVE-2026-33408 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, moderators were able to see the first 40 characters of post edits in PMs and private categories. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  41. Medium 5.4

    CVE-2026-33395 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the discourse-graphviz plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript code through DOT graph definitions. For instances with CSP disabled only. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a…

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  42. Medium 5.4

    CVE-2026-33410 · Discourse

    Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have two authorization issues in the chat direct message API. First, when creating a direct message channel or adding users to an existing one, the `target_groups` parameter was passed directly to the user resolution query without checking group or member visibility for the acting user.…

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  43. Low 2.7

    CVE-2026-33394 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the Post Edits admin report (/admin/reports/post_edits) leaked the first 40 characters of raw post content from private messages and secure categories to moderators who shouldn't have access. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are…

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  44. Medium 4.3

    CVE-2026-33393 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `allowed_spam_host_domains` check used `String#end_with?` without domain boundary validation, allowing domains like `attacker-example.com` to bypass spam protection when `example.com` was allowlisted. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 require exact match or proper…

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  45. Medium 6.5

    CVE-2026-33355 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `/private-posts` endpoint did not apply post-type visibility filtering, allowing regular PM participants to see whisper posts in PM topics they had access to. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  46. Medium 6.5

    CVE-2026-32099 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, when a user has `hide_profile` enabled, their bio, location, and website were still exposed through the user onebox preview. An authenticated user could request a onebox for a hidden user's profile URL and receive their hidden profile fields (bio, location, website) in the response.…

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  47. High 8.2

    CVE-2026-29072 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, users who do not belong to the allowed policy creation groups can create functional policy acceptance widgets in posts under the right conditions. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, disable the discourse-policy plugin by disabling the…

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  48. Low 2.3

    CVE-2026-28282 · Discourse

    Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a security flaw in the discourse-policy plugin which allowed a user with policy creation permission to gain membership access to any private/restricted groups. Once membership to a private/restricted group has been obtained, the user will be able to read private topics that only the…

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  49. Medium 6.9

    CVE-2026-27936 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a restriction bypass allows restricted post action counts to be disclosed to non-privileged users through a carefully crafted request. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  50. Medium 6.9

    CVE-2026-27935 · Discourse

    Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a vulnerability in an API endpoint that discloses private topic metadata of admin users to moderator users even if the moderators do not have access to the private topics. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.