UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
181
Critical in 30 days
41
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. Medium 5.4

    CVE-2025-59788 · Nextcloud

    Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to…

    Published 4 Dec 2025 · Fixed in 30.0.17, 31.0.10, 32.0.1 · NVD
  2. Medium 6.3

    CVE-2025-12084 · Python

    When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

    Published 3 Dec 2025 · Fixed in 3.13.11, 3.14.2 · NVD
  3. Critical 10.0

    GHSA-9qr9-h5gf-34mp · Next.js

    Next.js is vulnerable to RCE in React flight protocol

    Published 3 Dec 2025 · Fixed in 15.4.8, 15.5.7, 16.0.7 · OSV.dev and GitHub
  4. Low 2.1

    CVE-2025-13837 · Python

    When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

    Published 1 Dec 2025 · Fixed in 3.13.10, 3.14.1 · NVD
  5. Medium 6.3

    CVE-2025-13836 · Python

    When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

    Published 1 Dec 2025 · Fixed in 3.11.15, 3.12.13, 3.13.11 · NVD
  6. Medium 6.5

    CVE-2025-7449 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user with specific permissions to cause a denial of service condition through HTTP response processing.

    Published 26 Nov 2025 · Fixed in 18.4.5, 18.5.3 · NVD
  7. Medium 4.3

    CVE-2025-6195 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user to view information from security reports under certain configuration conditions.

    Published 26 Nov 2025 · Fixed in 18.4.5, 18.5.3 · NVD
  8. Medium 5.3

    CVE-2025-13611 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.5.5 and 18.6 before 18.6.3 that could have allowed an authenticated user with access to certain logs to obtain sensitive tokens under specific conditions.

    Published 26 Nov 2025 · Fixed in 18.4.5, 18.5.3 · NVD
  9. Medium 6.5

    CVE-2025-12653 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that under specific conditions could have allowed an unauthenticated user to join arbitrary organizations by changing headers on some requests.

    Published 26 Nov 2025 · Fixed in 18.4.5, 18.5.3 · NVD
  10. High 7.5

    CVE-2025-12571 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an unauthenticated user to cause a Denial of Service condition by sending specifically crafted requests containing malicious JSON payloads.

    Published 26 Nov 2025 · Fixed in 18.4.5, 18.5.3 · NVD
  11. Medium 6.5

    CVE-2025-64295 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Insertion of Sensitive Information Into Sent Data

    Published 26 Nov 2025 · Fixed in 4.8.7 · WPVulnerability
  12. High 7.1

    CVE-2025-13644 · MongoDB

    MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.13, and MongoDB Server v8.1…

    Published 25 Nov 2025 · Fixed in 7.0.26, 8.0.13, 8.1.2 · NVD
  13. Low 2.3

    CVE-2025-13643 · MongoDB

    A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully completing. This issue affects MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB Server v8.0 versions prior to 8.0.14

    Published 25 Nov 2025 · Fixed in 7.0.26, 8.0.14 · NVD
  14. High 7.1

    CVE-2025-13507 · MongoDB

    Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8.2 versions prior to 8.2.1.

    Published 25 Nov 2025 · Fixed in 7.0.26, 8.0.16, 8.2.1 · NVD
  15. Low 2.3

    CVE-2025-12893 · MongoDB

    Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running…

    Published 25 Nov 2025 · Fixed in 7.0.26, 8.0.16, 8.2.2 · NVD
  16. Medium 4.3

    CVE-2025-67588 · Elementor

    Elementor Website Builder – more than just a page builder: Missing Authorization

    Published 25 Nov 2025 · Fixed in 3.33.1 · WPVulnerability
  17. Medium 6.5

    CVE-2025-9825 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have allowed authenticated users without project membership to view sensitive manual CI/CD variables by querying the GraphQL API.

    Published 21 Nov 2025 · Fixed in 18.2.8, 18.3.4, 18.4.2 · NVD
  18. Medium 6.4

    CVE-2025-11186 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 21 Nov 2025 · Fixed in 2.5.9 · WPVulnerability
  19. High 7.5

    CVE-2025-11230 · HAProxy

    Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

    Published 19 Nov 2025 · Fixed in 3.0.12, 3.1.9, 3.2.6 · NVD
  20. Medium 5.3

    CVE-2025-12777 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Improper Authorization

    Published 18 Nov 2025 · Fixed in 4.10.1 · WPVulnerability
  21. Medium 5.3

    CVE-2025-12545 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Exposure of Sensitive Information to an Unauthorized Actor

    Published 18 Nov 2025 · Fixed in 1.49.3 · WPVulnerability
  22. Medium 5.3

    CVE-2025-12427 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Authorization Bypass Through User-Controlled Key

    Published 18 Nov 2025 · WPVulnerability
  23. Medium 6.5

    CVE-2025-12983 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to cause a denial of service condition by submitting specially crafted markdown content with nested formatting patterns.

    Published 15 Nov 2025 · Fixed in 18.3.6, 18.4.4, 18.5.2 · NVD
  24. Medium 4.3

    CVE-2025-7736 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to bypass access control restrictions and view GitLab Pages content intended only for project members by authenticating through OAuth providers.

    Published 15 Nov 2025 · Fixed in 18.3.6, 18.4.4, 18.5.2 · NVD
  25. Medium 4.3

    CVE-2025-7000 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.6 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that, under specific conditions, could have allowed unauthorized users to view confidential branch names by accessing project issues with related merge requests.

    Published 15 Nov 2025 · Fixed in 18.3.6, 18.4.4, 18.5.2 · NVD
  26. Low 3.5

    CVE-2025-6945 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments.

    Published 15 Nov 2025 · Fixed in 18.3.6, 18.4.4, 18.5.2 · NVD
  27. Medium 4.3

    CVE-2025-6171 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker with reporter access to view branch names and pipeline details by accessing the packages API endpoint even when repository access was disabled.

    Published 15 Nov 2025 · Fixed in 18.3.6, 18.4.4, 18.5.2 · NVD
  28. Medium 6.5

    CVE-2025-2615 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections.

    Published 15 Nov 2025 · Fixed in 18.3.6, 18.4.4, 18.5.2 · NVD
  29. Low 3.5

    CVE-2025-11990 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses.

    Published 15 Nov 2025 · Fixed in 18.4.4, 18.5.2 · NVD
  30. Medium 5.3

    CVE-2025-11865 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 18.1 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that, under certain circumstances, could have allowed an attacker to remove Duo flows of another user.

    Published 15 Nov 2025 · Fixed in 18.3.6, 18.4.4, 18.5.2 · NVD
  31. Medium 4.3

    CVE-2025-12847 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Missing Authorization

    Published 14 Nov 2025 · Fixed in 4.9.0 · WPVulnerability
  32. Medium 4.3

    CVE-2025-10966 · curl

    curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

    Published 7 Nov 2025 · Fixed in 8.17.0 · NVD
  33. High 7.7

    CVE-2025-62507 · Redis

    Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL…

    Published 4 Nov 2025 · Fixed in 8.2.3 · NVD
  34. Medium 5.9

    CVE-2025-12657 · MongoDB

    The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations.

    Published 3 Nov 2025 · Fixed in 7.0.22, 8.0.10 · NVD
  35. Critical 9.8

    CVE-2025-12493 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Path Traversal

    Published 3 Nov 2025 · Fixed in 3.2.6 · WPVulnerability
  36. Low 1.8

    CVE-2025-6075 · Python

    If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

    Published 31 Oct 2025 · Fixed in 3.9.0, 3.13.11, 3.14.1 · NVD
  37. Medium 5.3

    CVE-2025-12521 · WP Analytify Pro (WordPress plugin)

    Analytify Pro: Exposure of Sensitive Information to an Unauthorized Actor

    Published 30 Oct 2025 · Fixed in 7.0.4 · WPVulnerability
  38. High 8.8

    CVE-2025-11702 · GitLab

    GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker with specific permissions to hijack project runners from other projects.

    Published 29 Oct 2025 · Fixed in 18.3.5, 18.4.3 · NVD
  39. Unrated

    CVE-2025-49042 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 29 Oct 2025 · Fixed in 10.0.3 · WPVulnerability
  40. Medium 6.3

    CVE-2025-61598 · Discourse

    Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was missing from error responses. This may caused unintended caching of those responses by proxies potentially leading to cache poisoning attacks. This vulnerability is fixed in 3.6.2 and 3.6.0.beta2.

    Published 28 Oct 2025 · Fixed in 3.5.2, 3.6.0 · NVD
  41. Medium 6.1

    CVE-2025-12450 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 28 Oct 2025 · Fixed in 7.6 · WPVulnerability
  42. Medium 5.3

    CVE-2025-61795 · Apache Tomcat

    Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible…

    Published 27 Oct 2025 · Fixed in 10.0.27, 10.1.47, 11.0.12 · NVD
  43. Critical 9.6

    CVE-2025-55754 · Apache Tomcat

    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the…

    Published 27 Oct 2025 · Fixed in 10.0.27, 10.1.45, 11.0.11 · NVD
  44. High 7.5

    CVE-2025-55752 · Apache Tomcat

    Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If…

    Published 27 Oct 2025 · Fixed in 10.0.27, 10.1.45, 11.0.11 · NVD
  45. Medium 6.5

    CVE-2025-6601 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approval workflow.

    Published 27 Oct 2025 · Fixed in 18.4.3 · NVD
  46. High 8.1

    CVE-2025-11989 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to execute unauthorized quick actions by including malicious commands in specific descriptions.

    Published 27 Oct 2025 · Fixed in 18.3.5, 18.4.3 · NVD
  47. Medium 6.5

    CVE-2025-11974 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to specific API endpoints.

    Published 27 Oct 2025 · Fixed in 18.3.5, 18.4.3 · NVD
  48. Medium 6.5

    CVE-2025-11971 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits.

    Published 27 Oct 2025 · Fixed in 18.3.5, 18.4.3 · NVD
  49. High 7.5

    CVE-2025-11447 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending GraphQL requests with crafted JSON payloads.

    Published 27 Oct 2025 · Fixed in 18.3.5, 18.4.3 · NVD
  50. High 7.5

    CVE-2025-10497 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending specially crafted payloads.

    Published 27 Oct 2025 · Fixed in 18.3.5, 18.4.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.