UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
181
Critical in 30 days
41
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. Unrated

    CVE-2025-9501 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 27 Oct 2025 · Fixed in 2.8.13 · WPVulnerability
  2. Medium 6.4

    CVE-2025-11823 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

    Published 24 Oct 2025 · Fixed in 3.2.5 · WPVulnerability
  3. Low 3.7

    CVE-2025-61748 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple…

    Published 21 Oct 2025 · NVD
  4. Medium 4.9

    CVE-2025-53069 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 21 Oct 2025 · Fixed in 8.0.43, 8.4.6, 9.4.0 · NVD
  5. Medium 4.9

    CVE-2025-53067 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 21 Oct 2025 · Fixed in 9.4.0 · NVD
  6. High 7.5

    CVE-2025-53066 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker…

    Published 21 Oct 2025 · NVD
  7. Medium 4.9

    CVE-2025-53062 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 21 Oct 2025 · Fixed in 8.0.43, 8.4.6, 9.4.0 · NVD
  8. Medium 5.9

    CVE-2025-53057 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated…

    Published 21 Oct 2025 · NVD
  9. Medium 5.5

    CVE-2025-53054 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 21 Oct 2025 · NVD
  10. Medium 5.5

    CVE-2025-53053 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 21 Oct 2025 · NVD
  11. Medium 4.9

    CVE-2025-53045 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 21 Oct 2025 · NVD
  12. Medium 4.9

    CVE-2025-53044 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 21 Oct 2025 · NVD
  13. Medium 4.9

    CVE-2025-53042 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 21 Oct 2025 · NVD
  14. Medium 4.9

    CVE-2025-53040 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and 9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 21 Oct 2025 · NVD
  15. High 8.3

    CVE-2025-22166 · Confluence

    This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Atlassian recommends that Confluence Data Center…

    Published 21 Oct 2025 · Fixed in 8.5.25, 9.2.7, 10.0.2 · NVD
  16. Medium 5.9

    CVE-2025-67554 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 21 Oct 2025 · Fixed in 2.5.9 · WPVulnerability
  17. Medium 6.5

    CVE-2025-11979 · MongoDB

    An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0.

    Published 20 Oct 2025 · Fixed in 7.0.25, 8.0.15 · NVD
  18. High 7.2

    CVE-2026-5934 · WP Rocket (WordPress plugin)

    WP Rocket: Cross-site Scripting

    Published 20 Oct 2025 · Fixed in 3.21.1 · WPVulnerability
  19. Medium 5.9

    CVE-2026-28044 · WP Rocket (WordPress plugin)

    WP Rocket: Cross-site Scripting

    Published 20 Oct 2025 · Fixed in 3.20.0.2 · WPVulnerability
  20. Medium 6.5

    CVE-2025-54267 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to elevated privileges that increase integrity impact to high. Exploitation of this issue does not require user…

    Published 14 Oct 2025 · NVD
  21. Medium 4.8

    CVE-2025-54266 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.…

    Published 14 Oct 2025 · NVD
  22. Medium 5.9

    CVE-2025-54265 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

    Published 14 Oct 2025 · NVD
  23. High 8.1

    CVE-2025-54264 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page…

    Published 14 Oct 2025 · NVD
  24. High 8.1

    CVE-2025-54263 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and maintain unauthorized access. Exploitation of this issue does not require user interaction.

    Published 14 Oct 2025 · NVD
  25. Critical 9.9

    CVE-2025-55315 · .NET

    Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

    Published 14 Oct 2025 · Fixed in 2.3.6, 8.0.21, 9.0.10 · NVD
  26. Medium 5.7

    CVE-2025-55248 · .NET

    Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.

    Published 14 Oct 2025 · Fixed in 8.0.21, 9.0.10 · NVD
  27. High 7.3

    CVE-2025-55247 · .NET

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

    Published 14 Oct 2025 · Fixed in 8.0.21, 9.0.10 · NVD
  28. Medium 5.7

    CVE-2025-37727 · Elasticsearch

    Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex

    Published 10 Oct 2025 · Fixed in 8.19.5, 9.0.8, 9.1.5 · NVD
  29. Medium 6.5

    CVE-2025-2934 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 5.2 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2 that could have allowed an authenticated attacker to create a denial of service condition by configuring malicious webhook endpoints that send crafted HTTP responses.

    Published 9 Oct 2025 · Fixed in 18.2.8, 18.3.4, 18.4.2 · NVD
  30. High 7.7

    CVE-2025-11340 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 that, under certain conditions, could have allowed authenticated users with read-only API tokens to perform unauthorized write operations on vulnerability records by exploiting incorrectly scoped GraphQL mutations.

    Published 9 Oct 2025 · Fixed in 18.3.4, 18.4.2 · NVD
  31. High 7.5

    CVE-2025-10004 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository blobs.

    Published 9 Oct 2025 · Fixed in 18.2.8, 18.3.4, 18.4.2 · NVD
  32. Medium 6.5

    CVE-2025-10249 · Slider Revolution

    Slider Revolution: Relative Path Traversal

    Published 8 Oct 2025 · Fixed in 6.7.38 · WPVulnerability
  33. Critical 9.9

    CVE-2025-49844 · Redis

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue…

    Published 3 Oct 2025 · Fixed in 7.4.6, 8.0.4, 8.2.2 · NVD
  34. High 7.1

    CVE-2025-46819 · Redis

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server…

    Published 3 Oct 2025 · Fixed in 7.4.6, 8.0.4, 8.2.2 · NVD
  35. High 7.3

    CVE-2025-46818 · Redis

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the…

    Published 3 Oct 2025 · Fixed in 7.4.6, 8.0.4, 8.2.2 · NVD
  36. High 8.8

    CVE-2025-46817 · Redis

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.

    Published 3 Oct 2025 · Fixed in 7.4.6, 8.0.4, 8.2.2 · NVD
  37. Medium 5.5

    CVE-2025-59337 · Discourse

    Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. This issue is fixed in version 3.5.1.

    Published 1 Oct 2025 · Fixed in 3.5.1, 3.6.0 · NVD
  38. Medium 4.3

    CVE-2025-58055 · Discourse

    Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic “Title”, “Category”, and “Tags” allowed authenticated users to extract information about topics that they weren’t authorized to access. By modifying the “topic_id” value in API requests to the AI suggestion endpoints, users could target specific restricted…

    Published 1 Oct 2025 · Fixed in 3.5.1, 3.6.0 · NVD
  39. Medium 5.4

    CVE-2025-58054 · Discourse

    Discourse is an open-source community discussion platform. Versions 3.5.0 and below are vulnerable to XSS attacks through parsing and rendering of chat channel titles and chat thread titles via the quote message functionality when using the rich text editor. This issue is fixed in version 3.5.1.

    Published 1 Oct 2025 · Fixed in 3.5.0, 3.6.0 · NVD
  40. Medium 6.3

    CVE-2025-11233 · Rust

    Rust standard library didn't detect all path separators on Cygwin

    Published 1 Oct 2025 · Fixed in 1.89.0 · Project advisories (GitHub)
  41. High 7.5

    CVE-2025-61600 · Stalwart

    Unbounded Memory Allocation in Stalwart IMAP server

    Published 30 Sept 2025 · Fixed in 0.13.4 · Project advisories (GitHub)
  42. High 7.5

    CVE-2025-8014 · GitLab

    Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows unauthenticated users to potentially bypass query complexity limits leading to resource exhaustion and service disruption.

    Published 27 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  43. Medium 6.5

    CVE-2025-5069 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name to the victim's project.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  44. High 7.5

    CVE-2025-11042 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while using specific GraphQL queries.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  45. Medium 5.3

    CVE-2025-10868 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 where certain string conversion methods exhibit performance degradation with large inputs.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  46. High 7.7

    CVE-2025-9958 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry configurations.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  47. Critical 9.6

    CVE-2025-9642 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an attacker to inject malicious content that may lead to account takeover.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  48. High 8.8

    CVE-2025-7691 · GitLab

    A privilege escalation issue has been discovered in GitLab EE affecting all versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 that could have allowed a developer with specific group management permissions to escalate their privileges and obtain unauthorized access to additional system capabilities.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  49. High 7.2

    CVE-2025-10871 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can exploit a vulnerability where they can assign custom roles to users with permissions exceeding their own, effectively granting themselves elevated privileges.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  50. Medium 6.5

    CVE-2025-10867 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to create a denial-of-service condition by exploiting an unprotected GraphQL API through repeated requests.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.