UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
203
Critical in 30 days
41
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. High 8.7

    CVE-2026-27934 · Discourse

    Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checks with a user action API endpoint that results in disclosure of the title and post excerpt to unauthorized users, leading to information disclosure. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  2. Medium 5.1

    CVE-2026-27740 · Discourse

    Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a cross-site scripting vulnerability that arises because the system trusts the raw output from an AI Large Language Model (LLM) and renders it using htmlSafe in the Review Queue interface without adequate sanitization. A malicious attacker can use valid Prompt Injection techniques to…

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  3. Medium 5.1

    CVE-2026-27570 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the onebox method in the SharedAiConversation model renders the conversation title directly into HTML without proper sanitization. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, tighten access by changing the `ai_bot_public_sharing_allowed_groups`…

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  4. Medium 6.9

    CVE-2026-27491 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a type coercion issue in a post actions API endpoint allowed non-staff users to issue warnings to other users. Warnings are a staff-only moderation feature. The vulnerability required the attacker to be a logged-in user and to send a specifically crafted request. No data exposure or…

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  5. Medium 5.3

    CVE-2026-27454 · Discourse

    Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, requesting /posts/:id.json?version=X bypassed authorization checks on post revisions. The display_post method called post.revert_to directly without verifying whether the revision was hidden or if the user had permission to view edit history. This meant hidden revisions (intentionally…

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1 · NVD
  6. Medium 5.4

    CVE-2026-27166 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed iframes value allows an attacker to trick a user into changing the URL of the main page. This issue has been fixed in versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2. To workaround this issue, remove Codepen from the list of allowed…

    Published 19 Mar 2026 · Fixed in 2026.1.2, 2026.2.1, 2026.3.0 · NVD
  7. High 7.5

    CVE-2026-25667 · .NET

    ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing.

    Published 19 Mar 2026 · Fixed in 8.0.22, 9.0.11 · NVD
  8. Medium 6.1

    CVE-2026-4358 · MongoDB

    A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.

    Published 17 Mar 2026 · Fixed in 7.0.31, 8.0.20, 8.2.6 · NVD
  9. Medium

    CVE-2026-29057 · Next.js

    Next.js: HTTP request smuggling in rewrites

    Published 17 Mar 2026 · Fixed in 15.5.13, 16.1.7 · OSV.dev and GitHub
  10. Medium

    CVE-2026-27980 · Next.js

    Next.js: Unbounded next/image disk cache growth can exhaust storage

    Published 17 Mar 2026 · Fixed in 15.5.14, 16.1.7 · OSV.dev and GitHub
  11. High 8.7

    CVE-2026-4148 · MongoDB

    A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.

    Published 17 Mar 2026 · Fixed in 7.0.31, 8.0.20, 8.2.6 · NVD
  12. High 7.1

    CVE-2026-4147 · MongoDB

    An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.

    Published 17 Mar 2026 · Fixed in 7.0.31, 8.0.20, 8.2.6 · NVD
  13. Medium 6.0

    CVE-2026-4224 · Python

    When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

    Published 16 Mar 2026 · Fixed in 3.10.0, 3.13.13, 3.14.4 · NVD
  14. Medium 6.0

    CVE-2026-3644 · Python

    The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

    Published 16 Mar 2026 · Fixed in 3.13.13, 3.14.4 · NVD
  15. High 8.6

    CVE-2026-31386 · LiteSpeed Web Server, OpenLiteSpeed

    OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.

    Published 16 Mar 2026 · Fixed in 6.3.5 · NVD
  16. Medium 6.5

    CVE-2026-2673 · OpenSSL

    Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated…

    Published 13 Mar 2026 · Fixed in 3.5.6, 3.6.2 · NVD
  17. Medium 6.9

    CVE-2026-23943 · Erlang/OTP

    Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS. Two compression algorithms are…

    Published 13 Mar 2026 · Fixed in 26.2.5.18, 27.3.4.9, 28.4.1 · NVD
  18. Medium 5.3

    CVE-2026-23942 · Erlang/OTP

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2. The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking…

    Published 13 Mar 2026 · Fixed in 26.2.5.18, 27.3.4.9, 28.4.1 · NVD
  19. High 7.0

    CVE-2026-23941 · Erlang/OTP

    Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling. This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7. The server does not reject or normalize duplicate Content-Length headers. The earliest…

    Published 13 Mar 2026 · Fixed in 26.2.5.18, 27.3.4.9, 28.4.1 · NVD
  20. Unrated

    CVE-2026-29777 · github.com/traefik/traefik, Traefik

    Traefik: kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values in github.com/traefik/traefik

    Published 12 Mar 2026 · Fixed in 3.6.10 · OSV.dev and GitHub
  21. Low 2.0

    CVE-2025-13462 · Python

    The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

    Published 12 Mar 2026 · Fixed in 3.13.13, 3.14.4 · NVD
  22. Medium 4.3

    CVE-2026-1182 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to gain unauthorized access to confidential issue title created in public projects under certain circumstances.

    Published 12 Mar 2026 · Fixed in 18.7.6, 18.8.6, 18.9.2 · NVD
  23. Medium 4.7

    CVE-2026-39595 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Missing Authorization

    Published 12 Mar 2026 · Fixed in 2.9.2 · WPVulnerability
  24. Medium 4.3

    CVE-2025-12555 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that, under certain conditions, could have allowed an authenticated user to access previous pipeline job information on projects with repository and CI/CD disabled due to improper authorization checks.

    Published 11 Mar 2026 · Fixed in 18.7.6, 18.8.6, 18.9.2 · NVD
  25. Medium 5.0

    CVE-2026-3848 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to make unintended internal requests through proxy environments under certain conditions due to improper input validation in import functionality.

    Published 11 Mar 2026 · Fixed in 18.7.6, 18.8.6, 18.9.2 · NVD
  26. Medium 4.3

    CVE-2026-1732 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose confidential issue titles due to improper filtering under certain circumstances.

    Published 11 Mar 2026 · Fixed in 18.7.6, 18.8.6, 18.9.2 · NVD
  27. Medium 4.3

    CVE-2026-1663 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with group import permissions to create labels in private projects due to improper authorization validation in the group import process under certain circumstances.

    Published 11 Mar 2026 · Fixed in 18.7.6, 18.8.6, 18.9.2 · NVD
  28. Medium 6.5

    CVE-2026-1230 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 1.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to cause repository downloads to contain different code than displayed in the web interface due to incorrect validation of branch references under certain circumstances.

    Published 11 Mar 2026 · Fixed in 18.7.6, 18.8.6, 18.9.2 · NVD
  29. Medium 5.4

    CVE-2026-1090 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user, when the `markdown_placeholders` feature flag was enabled, to inject JavaScript in a browser due to improper sanitization of placeholder content in markdown processing.

    Published 11 Mar 2026 · Fixed in 18.7.6, 18.8.6, 18.9.2 · NVD
  30. High 7.5

    CVE-2026-1069 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by sending specially crafted GraphQL requests due to uncontrolled recursion under certain circumstances.

    Published 11 Mar 2026 · Fixed in 18.9.2 · NVD
  31. Medium 4.3

    CVE-2026-0602 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose metadata from private issues, merge requests, epics, milestones, or commits due to improper filtering in the snippet rendering process under certain circumstances.

    Published 11 Mar 2026 · Fixed in 18.7.6, 18.8.6, 18.9.2 · NVD
  32. High 7.5

    CVE-2025-14513 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service condition due to improper input validation when processing specially crafted JSON payloads in the protected branches API.

    Published 11 Mar 2026 · Fixed in 18.7.6, 18.8.6, 18.9.2 · NVD
  33. High 7.5

    CVE-2025-13929 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certain conditions.

    Published 11 Mar 2026 · Fixed in 18.7.6, 18.8.6, 18.9.2 · NVD
  34. Medium 6.5

    CVE-2025-13690 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to cause a denial of service condition due to improper input validation on webhook custom header names under certain conditions.

    Published 11 Mar 2026 · Fixed in 18.7.6, 18.8.6, 18.9.2 · NVD
  35. Medium 4.3

    CVE-2025-12704 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to access Virtual Registry data in groups where they are not members due to improper authorization under certain conditions.

    Published 11 Mar 2026 · Fixed in 18.7.6, 18.8.6, 18.9.2 · NVD
  36. Medium 4.4

    CVE-2025-12697 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.5 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with maintainer-role permissions to reveal Datadog API credentials under certain conditions.

    Published 11 Mar 2026 · Fixed in 18.7.6, 18.8.6, 18.9.2 · NVD
  37. Medium 6.5

    CVE-2025-12576 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that under certain conditions could have allowed an authenticated user to cause a denial of service due to improper handling of webhook response data.

    Published 11 Mar 2026 · Fixed in 18.7.6, 18.8.6, 18.9.2 · NVD
  38. High 7.5

    CVE-2026-3805 · curl

    When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.

    Published 11 Mar 2026 · Fixed in 8.19.0 · NVD
  39. Medium 6.5

    CVE-2026-3784 · curl

    curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.

    Published 11 Mar 2026 · Fixed in 8.18.0 · NVD
  40. Medium 5.3

    CVE-2026-3783 · curl

    When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first…

    Published 11 Mar 2026 · Fixed in 8.19.0 · NVD
  41. Medium 6.5

    CVE-2026-1965 · curl

    libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an…

    Published 11 Mar 2026 · Fixed in 8.19.0 · NVD
  42. High 8.1

    CVE-2026-21361 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vvulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.…

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  43. Medium 6.8

    CVE-2026-21360 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restricted…

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  44. Medium 4.7

    CVE-2026-21359 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have limited impact to the integrity and availability of data. The exploit depends on conditions beyond the…

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  45. High 8.0

    CVE-2026-21311 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A…

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  46. Medium 5.3

    CVE-2026-21310 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass, with limited impact to integrity. Exploitation of this issue does not require user interaction.

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  47. High 7.5

    CVE-2026-21309 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized view access of data. Exploitation of this issue does not require user interaction.

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  48. Medium 4.3

    CVE-2026-21297 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access to a feature. Exploitation of this issue does not require user…

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  49. Medium 4.3

    CVE-2026-21296 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user…

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  50. Low 3.1

    CVE-2026-21295 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.