UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
182
Critical in 30 days
41
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. Medium 5.5

    CVE-2026-21294 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A high-privileged attacker could exploit this vulnerability to manipulate server-side requests and bypass security controls. Exploitation of this issue does not require user…

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  2. Medium 5.5

    CVE-2026-21293 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A high-privileged attacker could exploit this vulnerability to manipulate server-side requests and access unauthorized resources. Exploitation of this issue does not require user…

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  3. Medium 5.4

    CVE-2026-21292 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker attacker to inject malicious scripts into vulnerable form fields. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the…

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  4. Medium 4.8

    CVE-2026-21291 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable…

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  5. High 8.7

    CVE-2026-21290 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A…

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  6. High 7.5

    CVE-2026-21289 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized view access of data. Exploitation of this issue does not require user interaction.

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  7. Medium 5.3

    CVE-2026-21286 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction.

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  8. Medium 4.3

    CVE-2026-21285 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access to a feature. Exploitation of this issue does not require user…

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  9. High 8.1

    CVE-2026-21284 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A…

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  10. Medium 5.3

    CVE-2026-21282 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing limited impact to application availability. Exploitation of this issue does not require user…

    Published 11 Mar 2026 · Fixed in 2.4.4, 2.4.5 · NVD
  11. Unrated

    CVE-2026-30852 · Caddy

    Caddy's vars_regexp double-expands user input, leaking env vars and files in github.com/caddyserver/caddy

    Published 10 Mar 2026 · Fixed in 2.11.2 · OSV.dev and GitHub
  12. Unrated

    CVE-2026-30851 · Caddy

    Caddy forward_auth copy_headers allows Identity Injection and Privilege Escalation in github.com/caddyserver/caddy

    Published 10 Mar 2026 · Fixed in 2.11.2 · OSV.dev and GitHub
  13. High 7.8

    CVE-2026-26131 · .NET

    Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.

    Published 10 Mar 2026 · Fixed in 10.0.4 · NVD
  14. High 7.5

    CVE-2026-26130 · .NET

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

    Published 10 Mar 2026 · Fixed in 8.0.25, 9.0.14, 10.0.4 · NVD
  15. High 7.5

    CVE-2026-26127 · .NET

    Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.

    Published 10 Mar 2026 · Fixed in 9.0.14, 10.0.4 · NVD
  16. Unrated

    CVE-2026-3589 · WooCommerce

    Vulnerability in WooCommerce

    Published 10 Mar 2026 · Fixed in 10.5.3 · WPVulnerability
  17. Medium 4.3

    CVE-2026-32446 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Missing Authorization

    Published 7 Mar 2026 · Fixed in 1.9.9.4 · WPVulnerability
  18. Low 2.7

    CVE-2026-32445 · Elementor

    Elementor Website Builder – more than just a page builder: Missing Authorization

    Published 7 Mar 2026 · Fixed in 3.35.6 · WPVulnerability
  19. Medium 5.3

    CVE-2026-3494 · MariaDB

    In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.

    Published 3 Mar 2026 · NVD
  20. Medium 6.5

    CVE-2026-27734 · Beszel

    Docker API Path Traversal via Unsanitized Container ID

    Published 27 Feb 2026 · Project advisories (GitHub)
  21. Low 1.2

    CVE-2026-28227 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the `publish_to_category` topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

    Published 26 Feb 2026 · Fixed in 2025.12.2, 2026.1.1 · NVD
  22. Low 1.3

    CVE-2026-28219 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an improper authorization check in the topic management logic allows authenticated users to modify privileged attributes of their topics. By manipulating specific parameters in a PUT or POST request, a regular user can elevate a topic’s status to a site-wide notice or banner, bypassing intended…

    Published 26 Feb 2026 · Fixed in 2025.12.2, 2026.1.1 · NVD
  23. Medium 5.3

    CVE-2026-28218 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, fail-open access control in Data Explorer plugin allows any authenticated user to execute SQL queries that have no explicit group assignments, including built-in system queries. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. As a workaround, either explicitly set group permissions…

    Published 26 Feb 2026 · Fixed in 2025.12.2, 2026.1.1 · NVD
  24. Low 1.3

    CVE-2026-27154 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, a user full name can be evaluated as raw HTML when the following settings are set: `display_name_on_posts` => true; and `prioritize_username_in_ux` => false. Editing a post of a malicious user would trigger an XSS. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds…

    Published 26 Feb 2026 · Fixed in 2025.12.2, 2026.1.1 · NVD
  25. Low 1.3

    CVE-2026-27153 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, moderators could export user Chat DMs via the CSV export endpoint by exploiting an overly permissive allowlist in `can_export_entity?`. The method allowed moderators to export any entity not explicitly blocked instead of restricting to an explicit allowlist. Versions 2025.12.2, 2026.1.1, and…

    Published 26 Feb 2026 · Fixed in 2025.12.2, 2026.1.1 · NVD
  26. Medium 4.9

    CVE-2026-27162 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `posts_nearby` was checking topic access but then returning all posts regardless of type, including whispers that should only be visible to whisperers. Use `Post.secured(guardian)` to properly filter post types based on user permissions. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the…

    Published 26 Feb 2026 · Fixed in 2025.12.2, 2026.1.1 · NVD
  27. Low 1.3

    CVE-2026-27152 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, DM communication-preference bypass when adding members via `Chat::AddUsersToChannel` — a user could add targets who have blocked/ignored/muted them to an existing DM channel, bypassing per-recipient PM restrictions that are enforced during DM channel creation. Versions 2025.12.2, 2026.1.1, and…

    Published 26 Feb 2026 · Fixed in 2025.12.2, 2026.1.1 · NVD
  28. Low 1.3

    CVE-2026-27151 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the `move_posts` action only checked `can_move_posts?` on the source topic but never validated write permissions on the destination topic. This allowed TL4 users and category group moderators to move posts into topics in categories where they lack posting privileges (e.g., read-only categories…

    Published 26 Feb 2026 · Fixed in 2025.12.2, 2026.1.1 · NVD
  29. Low 1.3

    CVE-2026-27150 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, missing `validate_before_create` authorization in Data Explorer's `QueryGroupBookmarkable` allows any logged-in user to create bookmarks for query groups they don't have access to, enabling metadata disclosure via bookmark reminder notifications. Versions 2025.12.2, 2026.1.1, and 2026.2.0 fix…

    Published 26 Feb 2026 · Fixed in 2025.12.2, 2026.1.1 · NVD
  30. Medium 4.9

    CVE-2026-27149 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, SQL injection in PM tag filtering (`list_private_messages_tag`) allows bypassing tag filter conditions, potentially disclosing unauthorized private message metadata. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

    Published 26 Feb 2026 · Fixed in 2025.12.2, 2026.1.1 · NVD
  31. Medium 6.9

    CVE-2026-27021 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the voters endpoint in the poll plugin lacked post visibility checks which allowed unauthorized access to voters details of polls in any post. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

    Published 26 Feb 2026 · Fixed in 2025.12.0, 2026.1.1 · NVD
  32. Unrated

    CVE-2026-26979 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users are able to close, archive and pin topics in private categories they don't have access to. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

    Published 26 Feb 2026 · Fixed in 2025.12.0, 2026.1.1 · NVD
  33. Medium 4.3

    CVE-2026-26973 · Discourse

    Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR (Insecure Direct Object Reference) in `ReviewableNotesController`. When `enable_category_group_moderation` is enabled, a user belonging to a category moderation group can create or delete their own notes on **any** reviewable in the system, including reviewables in categories they do…

    Published 26 Feb 2026 · Fixed in 2025.12.0, 2026.1.1 · NVD
  34. High 7.5

    CVE-2026-26265 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an IDOR vulnerability in the directory items endpoint allows any user, including anonymous users, to retrieve private user field values for all users in the directory. The `user_field_ids` parameter in `DirectoryItemsController#index` accepts arbitrary user field IDs without authorization…

    Published 26 Feb 2026 · Fixed in 2025.12.0, 2026.1.1 · NVD
  35. Medium 5.4

    CVE-2026-26207 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `discourse-policy` plugin allows any authenticated user to interact with policies on posts they do not have permission to view. The `PolicyController` loads posts by ID without verifying the current user's access, enabling policy group members to accept/unaccept policies on posts in private…

    Published 26 Feb 2026 · Fixed in 2025.12.0, 2026.1.1 · NVD
  36. High 7.5

    CVE-2026-26078 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, when the `patreon_webhook_secret` site setting is blank, an attacker can forge valid webhook signatures by computing an HMAC-MD5 with an empty string as the key. Since the request body is known to the sender, the attacker can produce a matching signature and send arbitrary webhook payloads. This…

    Published 26 Feb 2026 · Fixed in 2025.12.0, 2026.1.1 · NVD
  37. Medium 6.5

    CVE-2026-26077 · Discourse

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, several webhook endpoints (SendGrid, Mailjet, Mandrill, Postmark, SparkPost) in the `WebhooksController` accepted requests without a valid authentication token when no token was configured. This allowed unauthenticated attackers to forge webhook payloads and artificially inflate user bounce…

    Published 26 Feb 2026 · Fixed in 2025.12.0, 2026.1.1 · NVD
  38. Medium 6.5

    CVE-2026-2845 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an authenticated user to cause denial of service by exploiting a Bitbucket Server import endpoint via repeatedly sending large responses.

    Published 25 Feb 2026 · Fixed in 18.7.5, 18.8.5 · NVD
  39. Medium 4.3

    CVE-2026-1747 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.11 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that, under certain conditions, could have allowed Developer-role users with insufficient privileges to make unauthorized modifications to protected Conan packages.

    Published 25 Feb 2026 · Fixed in 18.7.5, 18.8.5 · NVD
  40. High 7.5

    CVE-2026-1725 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting versions from 18.9 before 18.9.1 that could have under certain conditions, allowed an unauthenticated user to cause denial of service by sending specially crafted requests to a CI jobs API endpoint.

    Published 25 Feb 2026 · NVD
  41. High 7.5

    CVE-2026-1662 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to the Jira events endpoint.

    Published 25 Feb 2026 · Fixed in 18.7.5, 18.8.5 · NVD
  42. High 7.5

    CVE-2026-1388 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause regular expression denial of service by sending specially crafted input to a merge request endpoint under certain conditions.

    Published 25 Feb 2026 · Fixed in 18.7.5, 18.8.5 · NVD
  43. Medium 6.1

    CVE-2026-0752 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that under certain circumstances, could have allowed an unauthenticated user to inject arbitrary scripts into the Mermaid sandbox UI.

    Published 25 Feb 2026 · Fixed in 18.7.5, 18.8.5 · NVD
  44. High 7.5

    CVE-2025-14511 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted files to the container registry event endpoint under certain conditions.

    Published 25 Feb 2026 · Fixed in 18.7.5, 18.8.5 · NVD
  45. Medium 6.5

    CVE-2025-3525 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have, under certain circumstances, allowed an authenticated user with certain access to cause Denial of Service by creating specially crafted CI triggers via the API.

    Published 25 Feb 2026 · Fixed in 18.7.5, 18.8.5 · NVD
  46. Medium 4.3

    CVE-2025-14103 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthorized user with Developer-role permissions to set pipeline variables for manually triggered jobs under certain conditions.

    Published 25 Feb 2026 · Fixed in 18.7.5, 18.8.5 · NVD
  47. High

    CVE-2026-27590 · Caddy

    Unicode case-folding causes incorrect split_path index in github.com/caddyserver/caddy/v2

    Published 24 Feb 2026 · Fixed in 2.11.1 · OSV.dev and GitHub
  48. Medium

    CVE-2026-27589 · Caddy

    Caddy is vulnerable to cross-origin config application via local admin API /load in github.com/caddyserver/caddy/v2

    Published 24 Feb 2026 · Fixed in 2.11.1 · OSV.dev and GitHub
  49. High

    CVE-2026-27588 · Caddy

    Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass

    Published 24 Feb 2026 · Fixed in 2.11.1 · OSV.dev and GitHub
  50. High

    CVE-2026-27587 · Caddy

    Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass

    Published 24 Feb 2026 · Fixed in 2.11.1 · OSV.dev and GitHub

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.