UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
181
Critical in 30 days
41
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. High

    CVE-2026-27586 · Caddy

    Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed

    Published 24 Feb 2026 · Fixed in 2.11.1 · OSV.dev and GitHub
  2. Medium

    CVE-2026-27585 · Caddy

    Caddy: Improper sanitization of glob characters in file matcher may lead to bypassing security protections

    Published 24 Feb 2026 · Fixed in 2.11.1 · OSV.dev and GitHub
  3. Critical 9.0

    CVE-2026-27384 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Improper Validation of Specified Quantity in Input

    Published 24 Feb 2026 · Fixed in 2.9.2 · WPVulnerability
  4. High 7.5

    CVE-2026-24734 · Apache Tomcat

    Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11;…

    Published 17 Feb 2026 · Fixed in 9.0.115, 10.1.52, 11.0.18 · NVD
  5. Low 3.7

    CVE-2026-24733 · Apache Tomcat

    Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14,…

    Published 17 Feb 2026 · Fixed in 9.0.113, 10.1.50, 11.0.15 · NVD
  6. Critical 9.1

    CVE-2025-66614 · Apache Tomcat

    Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension…

    Published 17 Feb 2026 · Fixed in 9.0.113, 10.1.50, 11.0.15 · NVD
  7. Unrated

    CVE-2026-25949 · github.com/traefik/traefik, Traefik

    Traefik: TCP readTimeout bypass via STARTTLS on Postgres in github.com/traefik/traefik

    Published 17 Feb 2026 · Fixed in 3.6.8 · OSV.dev and GitHub
  8. Unrated

    CVE-2026-1714 · Woolentor Addons (WordPress plugin)

    Vulnerability in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

    Published 17 Feb 2026 · Fixed in 3.3.3 · WPVulnerability
  9. Medium 6.5

    CVE-2026-26312 · Stalwart

    Out-of-Memory Denial of Service via Malformed Nested MIME Messages

    Published 14 Feb 2026 · Project advisories (GitHub)
  10. Medium 6.5

    CVE-2026-32352 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 13 Feb 2026 · Fixed in 3.35.6 · WPVulnerability
  11. Low 3.7

    CVE-2026-2391 · qs

    qs's arrayLimit bypass in comma parsing allows denial of service

    Published 12 Feb 2026 · Fixed in 6.14.2 · OSV.dev and GitHub
  12. High 8.2

    CVE-2026-2007 · PostgreSQL

    Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. The attacker has limited control over the byte patterns to be written, but we have not ruled out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.

    Published 12 Feb 2026 · Fixed in 18.2 · NVD
  13. High 8.8

    CVE-2026-2006 · PostgreSQL

    Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

    Published 12 Feb 2026 · Fixed in 16.12, 17.8, 18.2 · NVD
  14. High 8.8

    CVE-2026-2005 · PostgreSQL

    Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

    Published 12 Feb 2026 · Fixed in 16.12, 17.8, 18.2 · NVD
  15. High 8.8

    CVE-2026-2004 · PostgreSQL

    Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

    Published 12 Feb 2026 · Fixed in 16.12, 17.8, 18.2 · NVD
  16. Medium 4.3

    CVE-2026-2003 · PostgreSQL

    Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

    Published 12 Feb 2026 · Fixed in 16.12, 17.8, 18.2 · NVD
  17. High 7.5

    CVE-2026-1458 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an unauthenticated user to cause denial of service by uploading malicious files.

    Published 11 Feb 2026 · Fixed in 18.6.6, 18.7.4, 18.8.4 · NVD
  18. High 7.5

    CVE-2026-1456 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through CPU exhaustion by submitting specially crafted markdown files that trigger exponential processing in markdown preview.

    Published 11 Feb 2026 · Fixed in 18.7.4, 18.8.4 · NVD
  19. Medium 6.5

    CVE-2026-1387 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to cause Denial of Service by uploading a malicious file and repeatedly querying it through GraphQl.

    Published 11 Feb 2026 · Fixed in 18.6.6, 18.7.4, 18.8.4 · NVD
  20. Medium 5.4

    CVE-2026-1282 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to inject malicious content into project labels titles.

    Published 11 Feb 2026 · Fixed in 18.6.6, 18.7.4, 18.8.4 · NVD
  21. Medium 4.6

    CVE-2026-1094 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 18.8.4 that could have allowed an authenticated developer to hide specially crafted file changes from the WebUI.

    Published 11 Feb 2026 · Fixed in 18.8.4 · NVD
  22. Medium 4.3

    CVE-2026-1080 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 16.7 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to access iteration data from private descendant groups by querying the iterations API endpoint.

    Published 11 Feb 2026 · Fixed in 18.6.6, 18.7.4, 18.8.4 · NVD
  23. High 7.5

    CVE-2026-0958 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through memory or CPU exhaustion by bypassing JSON validation middleware limits.

    Published 11 Feb 2026 · Fixed in 18.6.6, 18.7.4, 18.8.4 · NVD
  24. Medium 5.4

    CVE-2026-0595 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to add unauthorized email addresses to victim accounts through HTML injection in test case titles.

    Published 11 Feb 2026 · Fixed in 18.6.6, 18.7.4, 18.8.4 · NVD
  25. High 7.5

    CVE-2025-8099 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.8 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions, could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries.

    Published 11 Feb 2026 · Fixed in 18.6.6, 18.7.4, 18.8.4 · NVD
  26. Critical 9.1

    CVE-2025-7659 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to steal tokens and access private repositories by abusing incomplete validation in the Web IDE.

    Published 11 Feb 2026 · Fixed in 18.6.6, 18.7.4, 18.8.4 · NVD
  27. Low 3.5

    CVE-2025-14594 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to view certain pipeline values by querying the API.

    Published 11 Feb 2026 · Fixed in 18.6.6, 18.7.4, 18.8.4 · NVD
  28. Medium 5.3

    CVE-2025-14592 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform unauthorized operations by submitting GraphQL mutations through the GLQL API endpoint.

    Published 11 Feb 2026 · Fixed in 18.6.6, 18.7.4, 18.8.4 · NVD
  29. Medium 5.4

    CVE-2025-14560 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by injecting malicious content into vulnerability code flow.

    Published 11 Feb 2026 · Fixed in 18.6.6, 18.7.4, 18.8.4 · NVD
  30. Medium 5.4

    CVE-2025-12575 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user with certain permissions to make unauthorized requests to internal network services through the GitLab server.

    Published 11 Feb 2026 · Fixed in 18.6.6, 18.7.4, 18.8.4 · NVD
  31. Medium 4.3

    CVE-2025-12073 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery against internal services by bypassing protections in the Git repository import functionality.

    Published 11 Feb 2026 · Fixed in 18.6.6, 18.7.4, 18.8.4 · NVD
  32. Unrated

    CVE-2026-1356 · Webp Converter For Media (WordPress plugin)

    Vulnerability in Converter for Media – Optimize images | Convert WebP & AVIF

    Published 11 Feb 2026 · Fixed in 6.5.2 · WPVulnerability
  33. High 7.1

    CVE-2026-25613 · MongoDB

    An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.

    Published 10 Feb 2026 · Fixed in 7.0.29, 8.0.18, 8.2.4 · NVD
  34. High 7.1

    CVE-2026-25610 · MongoDB

    An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.

    Published 10 Feb 2026 · Fixed in 7.0.29, 8.0.13 · NVD
  35. Medium 5.3

    CVE-2026-25609 · MongoDB

    Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.

    Published 10 Feb 2026 · Fixed in 7.0.29, 8.0.18, 8.2.4 · NVD
  36. High 7.1

    CVE-2026-1850 · MongoDB

    Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash.

    Published 10 Feb 2026 · Fixed in 8.0.18, 8.2.4 · NVD
  37. High 7.1

    CVE-2026-1849 · MongoDB

    MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.

    Published 10 Feb 2026 · Fixed in 7.0.29, 8.0.18, 8.2.2 · NVD
  38. High 8.2

    CVE-2026-1848 · MongoDB

    Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header.

    Published 10 Feb 2026 · Fixed in 7.0.29, 8.0.18, 8.2.4 · NVD
  39. High 7.1

    CVE-2026-1847 · MongoDB

    Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall replication inside the replica set leading to server crash.

    Published 10 Feb 2026 · Fixed in 7.0.29, 8.0.18, 8.2.4 · NVD
  40. High 7.5

    CVE-2026-21218 · .NET

    Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.

    Published 10 Feb 2026 · Fixed in 8.0.24, 9.0.13, 10.0.3 · NVD
  41. High 7.5

    CVE-2026-25639 · axios

    Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

    Published 9 Feb 2026 · Fixed in 0.30.3, 1.13.5 · OSV.dev and GitHub
  42. Unrated

    CVE-2026-1293 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 5 Feb 2026 · Fixed in 26.9 · WPVulnerability
  43. High 8.2

    CVE-2026-1642 · nginx

    A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End…

    Published 4 Feb 2026 · Fixed in 1.28.2, 1.29.5 · NVD
  44. Unrated

    CVE-2025-67484 · MediaWiki

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    Published 3 Feb 2026 · Fixed in 1.39.16, 1.43.6, 1.44.3 · NVD
  45. Unrated

    CVE-2025-67483 · MediaWiki

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.43.6, 1.44.3, 1.45.1.

    Published 3 Feb 2026 · Fixed in 1.43.6, 1.44.3 · NVD
  46. Unrated

    CVE-2025-67481 · MediaWiki

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    Published 3 Feb 2026 · Fixed in 1.39.16, 1.43.6, 1.44.3 · NVD
  47. Unrated

    CVE-2025-67480 · MediaWiki

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    Published 3 Feb 2026 · Fixed in 1.39.16, 1.43.6, 1.44.3 · NVD
  48. Unrated

    CVE-2025-67477 · MediaWiki

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

    Published 3 Feb 2026 · Fixed in 1.44.3 · NVD
  49. Low 1.3

    CVE-2025-67476 · MediaWiki

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

    Published 3 Feb 2026 · Fixed in 1.44.3 · NVD
  50. Unrated

    CVE-2025-67475 · MediaWiki

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    Published 3 Feb 2026 · Fixed in 1.39.16, 1.43.6, 1.44.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.