UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
181
Critical in 30 days
41
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. Medium 4.9

    CVE-2026-21964 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 20 Jan 2026 · NVD
  2. Medium 4.9

    CVE-2026-21952 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 20 Jan 2026 · NVD
  3. Medium 6.5

    CVE-2026-21950 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 20 Jan 2026 · NVD
  4. Medium 6.5

    CVE-2026-21949 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 20 Jan 2026 · NVD
  5. Medium 4.9

    CVE-2026-21948 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 20 Jan 2026 · NVD
  6. Low 3.1

    CVE-2026-21947 · Java

    Vulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result…

    Published 20 Jan 2026 · NVD
  7. High 7.5

    CVE-2026-21945 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows…

    Published 20 Jan 2026 · NVD
  8. Medium 4.9

    CVE-2026-21941 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 20 Jan 2026 · NVD
  9. Medium 4.9

    CVE-2026-21937 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 20 Jan 2026 · NVD
  10. Medium 4.9

    CVE-2026-21936 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 20 Jan 2026 · NVD
  11. Medium 6.1

    CVE-2026-21933 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows…

    Published 20 Jan 2026 · NVD
  12. High 7.4

    CVE-2026-21932 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows…

    Published 20 Jan 2026 · NVD
  13. Medium 5.3

    CVE-2026-21929 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 9.0.0-9.5.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 20 Jan 2026 · NVD
  14. Medium 4.8

    CVE-2026-21925 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows…

    Published 20 Jan 2026 · NVD
  15. High 7.5

    CVE-2026-21637 · Node.js

    Incomplete fix for CVE-2026-21637: `loadSNI()` in `_tls_wrap.js` lacks `try`/`catch` leading to Remote DoS

    Published 20 Jan 2026 · Fixed in 24.14.1, 25.3.0, 25.8.2 · NVD, nodejs
  16. Medium 4.3

    CVE-2025-14384 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Missing Authorization

    Published 15 Jan 2026 · Fixed in 4.9.3 · WPVulnerability
  17. Medium 5.4

    CVE-2025-11224 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to execute stored cross-site scripting through improper input validation in the Kubernetes proxy functionality.

    Published 14 Jan 2026 · Fixed in 18.3.6, 18.4.4, 18.5.2 · NVD
  18. Critical 10.0

    CVE-2026-21636 · Node.js

    Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)

    Published 13 Jan 2026 · Fixed in 25.3.0 · NVD, nodejs
  19. High 7.5

    CVE-2025-59466 · Node.js

    Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers

    Published 13 Jan 2026 · Fixed in 22.22.0, 24.13.0, 25.3.0 · NVD, nodejs
  20. High 7.5

    CVE-2025-59465 · Node.js

    Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame

    Published 13 Jan 2026 · Fixed in 22.22.0, 24.13.0, 25.3.0 · NVD, nodejs
  21. High 7.5

    CVE-2025-59464 · Node.js

    Memory leak that enables remote Denial of Service against applications processing TLS client certificates

    Published 13 Jan 2026 · Fixed in 24.12.0, 24.13.0 · NVD, nodejs
  22. Medium 5.3

    CVE-2025-55132 · Node.js

    fs.futimes() Bypasses Read-Only Permission Model

    Published 13 Jan 2026 · Fixed in 22.22.0, 24.13.0, 25.3.0 · NVD, nodejs
  23. High

    CVE-2025-55131 · Node.js

    Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled

    Published 13 Jan 2026 · Fixed in 22.22.0, 24.13.0, 25.3.0 · nodejs
  24. Critical 9.1

    CVE-2025-55130 · Node.js

    Bypass File System Permissions using crafted symlinks

    Published 13 Jan 2026 · Fixed in 22.22.0, 24.13.0, 25.3.0 · NVD, nodejs
  25. Medium 5.1

    CVE-2023-54332 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting

    Published 13 Jan 2026 · NVD, WPVulnerability
  26. Medium 5.1

    CVE-2020-36919 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 13 Jan 2026 · NVD, WPVulnerability
  27. Medium 5.4

    CVE-2025-9222 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to achieve stored cross-site scripting by exploiting GitLab Flavored Markdown.

    Published 9 Jan 2026 · Fixed in 18.5.5, 18.6.3 · NVD
  28. Low 3.5

    CVE-2025-3950 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed a user to leak certain information by referencing specially crafted images that bypass asset proxy protection.

    Published 9 Jan 2026 · Fixed in 18.5.5, 18.6.3, 18.7.1 · NVD
  29. Medium 6.5

    CVE-2025-13781 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations.

    Published 9 Jan 2026 · Fixed in 18.5.5, 18.6.3 · NVD
  30. Medium 4.3

    CVE-2025-13772 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to access and utilize AI model settings from unauthorized namespaces by manipulating namespace identifiers in API requests.

    Published 9 Jan 2026 · Fixed in 18.5.5, 18.6.3 · NVD
  31. Critical 9.6

    CVE-2025-13761 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arbitrary code in the context of an authenticated user's browser by convincing the legitimate user to visit a specially crafted webpage.

    Published 9 Jan 2026 · Fixed in 18.6.3 · NVD
  32. Medium 5.4

    CVE-2025-11246 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user with specific permissions to remove all project runners from unrelated projects by manipulating GraphQL runner associations.

    Published 9 Jan 2026 · Fixed in 18.5.5, 18.6.3 · NVD
  33. Medium 6.5

    CVE-2025-10569 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to create a denial of service condition by providing crafted responses to external API calls.

    Published 9 Jan 2026 · Fixed in 18.5.5, 18.6.3 · NVD
  34. Low 3.1

    CVE-2025-15224 · curl

    When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.

    Published 8 Jan 2026 · Fixed in 8.18.0 · NVD
  35. Medium 5.3

    CVE-2025-15079 · curl

    When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.

    Published 8 Jan 2026 · Fixed in 8.18.0 · NVD
  36. Medium 5.3

    CVE-2025-14819 · curl

    When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.

    Published 8 Jan 2026 · Fixed in 8.18.0 · NVD
  37. Medium 5.3

    CVE-2025-14524 · curl

    When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

    Published 8 Jan 2026 · Fixed in 8.18.0 · NVD
  38. Medium 6.3

    CVE-2025-14017 · curl

    When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.

    Published 8 Jan 2026 · Fixed in 8.18.0 · NVD
  39. Medium 5.9

    CVE-2025-13034 · curl

    When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool, curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done…

    Published 8 Jan 2026 · Fixed in 8.18.0 · NVD
  40. Medium 5.9

    CVE-2025-63083 · Joomla!

    Lack of output escaping leads to a XSS vector in the pagebreak plugin.

    Published 6 Jan 2026 · Fixed in 5.4.2, 6.0.2 · NVD
  41. Medium 5.9

    CVE-2025-63082 · Joomla!

    Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.

    Published 6 Jan 2026 · Fixed in 5.4.2, 6.0.2 · NVD
  42. High 8.1

    CVE-2025-67934 · Wellspring (WordPress theme)

    Wellspring: PHP Remote File Inclusion

    Published 6 Jan 2026 · Fixed in 2.8 · WPVulnerability
  43. High 8.8

    CVE-2025-59157 · Coolify

    Git Repository RCE in Coolify

    Published 3 Jan 2026 · Fixed in 4.0.0 · NVD, Project advisories (GitHub)
  44. Critical 9.4

    CVE-2025-59158 · Coolify

    Stored XSS in Project Name

    Published 3 Jan 2026 · Fixed in 4.0.0 · NVD, Project advisories (GitHub)
  45. Critical 9.4

    CVE-2025-59156 · Coolify

    Docker Compose Injection in Coolify

    Published 3 Jan 2026 · Fixed in 4.0.0 · NVD, Project advisories (GitHub)
  46. Medium 5.7

    CVE-2025-59955 · Coolify

    Sensitive information `email_change_code` leaked in `/api/v1/teams/{team_id | current}/members` API endpoint

    Published 3 Jan 2026 · NVD, Project advisories (GitHub)
  47. High 8.5

    CVE-2025-64425 · Coolify

    Host header injection in forgot password

    Published 3 Jan 2026 · Fixed in 4.0.0-beta.435, 4.0.0 · NVD, Project advisories (GitHub)
  48. Critical 9.4

    CVE-2025-64424 · Coolify

    Command injection in project git source

    Published 3 Jan 2026 · Fixed in 4.0.0 · NVD, Project advisories (GitHub)
  49. High 7.7

    CVE-2025-64423 · Coolify

    Privilege Escalation - low privileged users can see and use admin invitation links

    Published 3 Jan 2026 · Fixed in 4.0.0 · NVD, Project advisories (GitHub)
  50. High 8.7

    CVE-2025-64421 · Coolify

    Privilege escalation - Low privileged user can invite themselves as an admin user

    Published 3 Jan 2026 · Fixed in 4.0.0 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.