UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
181
Critical in 30 days
40
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. High 7.5

    CVE-2025-10858 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that allows unauthenticated users to cause a Denial of Service (DoS) condition while uploading specifically crafted large JSON files.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  2. Medium 5.4

    CVE-2025-58650 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 22 Sept 2025 · Fixed in 4.8.7.2 · WPVulnerability
  3. Medium 4.3

    CVE-2025-58649 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Published 22 Sept 2025 · Fixed in 4.8.7.2 · WPVulnerability
  4. High 7.5

    CVE-2025-9086 · curl

    1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path="/"`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl…

    Published 12 Sept 2025 · Fixed in 8.16.0 · NVD
  5. Medium 6.5

    CVE-2025-7337 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 7.8 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user with Developer-level access to cause a persistent denial of service affecting all users on a GitLab instance by uploading large files.

    Published 12 Sept 2025 · Fixed in 18.1.6, 18.2.6, 18.3.2 · NVD
  6. Medium 4.3

    CVE-2025-6769 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.1 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to view administrator-only maintenance notes by accessing runner details through specific interfaces.

    Published 12 Sept 2025 · Fixed in 18.1.6, 18.2.6, 18.3.2 · NVD
  7. High 8.8

    CVE-2025-6454 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences.

    Published 12 Sept 2025 · Fixed in 18.1.6, 18.2.6, 18.3.2 · NVD
  8. High 7.5

    CVE-2025-2256 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed unauthorized users to render the GitLab instance unresponsive to legitimate users by sending multiple concurrent large SAML responses.

    Published 12 Sept 2025 · Fixed in 18.1.6, 18.2.6, 18.3.2 · NVD
  9. Medium 6.5

    CVE-2025-1250 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user to stall background job processing by sending specially crafted commit messages, merge request descriptions, or notes.

    Published 12 Sept 2025 · Fixed in 18.1.6, 18.2.6, 18.3.2 · NVD
  10. Medium 5.3

    CVE-2025-10148 · curl

    curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as…

    Published 12 Sept 2025 · Fixed in 8.16.0 · NVD
  11. Medium 6.5

    CVE-2025-10094 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to disrupt access to token listings and related administrative operations by creating tokens with excessively large names.

    Published 12 Sept 2025 · Fixed in 18.1.6, 18.2.6, 18.3.2 · NVD
  12. Medium 4.3

    CVE-2025-64351 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Insertion of Sensitive Information Into Sent Data

    Published 11 Sept 2025 · Fixed in 1.0.253 · WPVulnerability
  13. Low 3.8

    CVE-2025-64350 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization

    Published 11 Sept 2025 · Fixed in 1.0.253 · WPVulnerability
  14. High

    CVE-2025-59045 · Stalwart

    Memory Exhaustion via CalDAV Event Expansion

    Published 10 Sept 2025 · Fixed in 0.13.3 · Project advisories (GitHub)
  15. Critical 9.1Actively exploited

    CVE-2025-54236 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

    Published 9 Sept 2025 · NVD
  16. Medium 5.4

    CVE-2025-58990 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 9 Sept 2025 · Fixed in 3.2.1 · WPVulnerability
  17. Medium 6.5

    CVE-2025-10061 · MongoDB

    An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This vulnerability could lead to denial of service if triggered repeatedly. This issue affects MongoDB Server v6.0 versions prior to…

    Published 5 Sept 2025 · Fixed in 7.0.22, 8.0.12, 8.1.2 · NVD
  18. High 7.5

    CVE-2025-10060 · MongoDB

    MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22 and MongoDB Server v8.0 versions…

    Published 5 Sept 2025 · Fixed in 6.0.25, 7.0.22, 8.0.12 · NVD
  19. Medium 6.5

    CVE-2025-10059 · MongoDB

    An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. This affects MongoDB Server v6.0 versions prior to 6.0.x, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v8.0 versions prior to 8.0.6.

    Published 5 Sept 2025 · Fixed in 6.0.24, 7.0.18, 8.0.6 · NVD
  20. Medium 6.2

    CVE-2025-57752 · Next.js

    Next.js Affected by Cache Key Confusion for Image Optimization API Routes

    Published 29 Aug 2025 · Fixed in 14.2.31, 15.4.5 · OSV.dev and GitHub
  21. Medium 4.3

    CVE-2025-55173 · Next.js

    Next.js Content Injection Vulnerability for Image Optimization

    Published 29 Aug 2025 · Fixed in 14.2.31, 15.4.5 · OSV.dev and GitHub
  22. Medium 6.5

    CVE-2025-57822 · Next.js

    Next.js Improper Middleware Redirect Handling Leads to SSRF

    Published 29 Aug 2025 · Fixed in 14.2.32, 15.4.7 · OSV.dev and GitHub
  23. Medium 6.5

    CVE-2025-9217 · Slider Revolution

    Slider Revolution: Path Traversal

    Published 28 Aug 2025 · Fixed in 6.7.37 · WPVulnerability
  24. Medium 5.0

    CVE-2025-5101 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that under certain conditions could have allowed an authenticated attacker to distribute malicious code that appears harmless in the web interface by taking advantage of ambiguity between branches and tags during repository imports.

    Published 27 Aug 2025 · Fixed in 18.1.5, 18.2.5 · NVD
  25. High 7.5

    CVE-2025-4225 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 14.1 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that that under certain conditions could have allowed an unauthenticated attacker to cause a denial-of-service condition affecting all users by sending specially crafted GraphQL requests.

    Published 27 Aug 2025 · Fixed in 18.1.5, 18.2.5 · NVD
  26. Medium 6.5

    CVE-2025-3601 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.15 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have could have allowed an authenticated user to cause a Denial of Service (DoS) condition by submitting URLs that generate excessively large responses.

    Published 27 Aug 2025 · Fixed in 18.1.5, 18.2.5 · NVD
  27. Medium 5.3

    CVE-2025-2246 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have allowed unauthenticated users to access sensitive manual CI/CD variables by querying the GraphQL API.

    Published 27 Aug 2025 · Fixed in 18.1.5, 18.2.5 · NVD
  28. Critical 9.4

    CVE-2025-34161 · Coolify

    Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field during project creation. By submitting a crafted repository string containing command injection syntax, an attacker can…

    Published 27 Aug 2025 · Fixed in 4.0.0 · NVD
  29. Critical 9.4

    CVE-2025-34159 · Coolify

    Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary Docker Compose directives during project creation. By crafting a malicious service definition that mounts the host root filesystem, an attacker can gain full root…

    Published 27 Aug 2025 · Fixed in 4.0.0 · NVD
  30. Critical 9.4

    CVE-2025-34157 · Coolify

    Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to delete the project or its associated resource, the payload executes in the admin’s browser…

    Published 27 Aug 2025 · Fixed in 4.0.0 · NVD
  31. High

    CVE-2025-54370 · phpoffice/phpspreadsheet

    PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser

    Published 25 Aug 2025 · Fixed in 2.4.0, 3.10.0, 5.0.0 · OSV.dev and GitHub
  32. Low 2.4

    CVE-2025-54411 · Discourse

    Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcome_banner.header.logged_in_members site text to remove the preferred_display_name placeholder, or not impersonate any users for the time being. This…

    Published 19 Aug 2025 · Fixed in 3.5.0 · NVD
  33. Medium 6.5

    CVE-2025-8770 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allowed authenticated users with specific access to bypass merge request approval policies by manipulating approval rule identifiers.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  34. Medium 5.4

    CVE-2025-7739 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions.

    Published 13 Aug 2025 · Fixed in 18.2.2 · NVD
  35. Medium 5.4

    CVE-2025-7734 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 14.2 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  36. Medium 5.4

    CVE-2025-6186 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to achieve account takeover by injecting malicious HTML into work item names.

    Published 13 Aug 2025 · Fixed in 18.1.4, 18.2.2 · NVD
  37. Medium 5.0

    CVE-2025-5819 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users with developer access to obtain ID tokens for protected branches under certain circumstances.

    Published 13 Aug 2025 · Fixed in 17.11.6, 18.0.4, 18.1.2 · NVD
  38. Medium 6.5

    CVE-2025-2937 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to create a denial of service condition by sending specially crafted markdown payloads to the Wiki feature.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  39. Medium 6.5

    CVE-2025-2614 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an authenticated user to cause a denial of service condition by creating specially crafted content that consumes excessive server resources when processed.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  40. Medium 4.3

    CVE-2025-2498 · GitLab

    An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  41. High 7.5

    CVE-2025-1477 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.14 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an unauthenticated user to create a denial of service condition by sending specially crafted payloads to specific integration API endpoints.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  42. Medium 5.5

    CVE-2024-12303 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users with specific roles and permissions to delete issues including confidential ones by inviting users with a specific role.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  43. Medium 6.5

    CVE-2024-10219 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users to bypass access controls and download private artifacts by accessing specific API endpoints.

    Published 13 Aug 2025 · Fixed in 18.0.6, 18.1.4, 18.2.2 · NVD
  44. Medium 6.3

    CVE-2025-53859 · nginx

    NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations…

    Published 13 Aug 2025 · Fixed in 1.29.1 · NVD
  45. Medium 6.5

    CVE-2025-55668 · Apache Tomcat

    Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

    Published 13 Aug 2025 · Fixed in 9.0.106, 10.1.42, 11.0.8 · NVD
  46. High 7.5

    CVE-2025-48989 · Apache Tomcat

    Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

    Published 13 Aug 2025 · Fixed in 9.0.108, 10.1.44, 11.0.10 · NVD
  47. Medium 5.3

    CVE-2025-49559 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to modify limited data. Exploitation of this issue does not require user interaction.

    Published 12 Aug 2025 · Fixed in 2.4.4, 2.4.5 · NVD
  48. Medium 5.9

    CVE-2025-49558 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability by manipulating the timing between the check of a resource's state and its use, allowing unauthorized write access.…

    Published 12 Aug 2025 · Fixed in 2.4.4, 2.4.5 · NVD
  49. High 8.7

    CVE-2025-49557 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as…

    Published 12 Aug 2025 · Fixed in 2.4.4, 2.4.5 · NVD
  50. High 7.5

    CVE-2025-49556 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction, and scope is…

    Published 12 Aug 2025 · Fixed in 2.4.4, 2.4.5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.