UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
180
Critical in 30 days
40
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. Medium 4.9

    CVE-2025-50077 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Jul 2025 · NVD
  2. Medium 6.5

    CVE-2025-50076 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.25. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 15 Jul 2025 · NVD
  3. High 7.3

    CVE-2025-50063 · Java

    Vulnerability in Oracle Java SE (component: Install). The supported version that is affected is Oracle Java SE: 8u451. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this…

    Published 15 Jul 2025 · NVD
  4. High 8.6

    CVE-2025-50059 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows…

    Published 15 Jul 2025 · NVD
  5. Medium 4.8

    CVE-2025-30754 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows…

    Published 15 Jul 2025 · NVD
  6. Low 3.7

    CVE-2025-30752 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle Java SE: 24.0.1; Oracle GraalVM for JDK: 24.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK. Successful attacks of this…

    Published 15 Jul 2025 · NVD
  7. High 8.1

    CVE-2025-30749 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows…

    Published 15 Jul 2025 · NVD
  8. High

    CVE-2025-27210 · Node.js

    Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

    Published 15 Jul 2025 · Fixed in 20.19.4, 22.17.1, 24.4.1 · nodejs
  9. High

    CVE-2025-27209 · Node.js

    HashDoS in V8

    Published 15 Jul 2025 · Fixed in 24.4.1 · nodejs
  10. High 7.5

    CVE-2025-1735 · PHP

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.

    Published 13 Jul 2025 · Fixed in 8.2.29, 8.3.23, 8.4.10 · NVD
  11. Medium 5.3

    CVE-2025-1220 · PHP

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using…

    Published 13 Jul 2025 · Fixed in 8.2.29, 8.3.23, 8.4.10 · NVD
  12. Medium 5.9

    CVE-2025-6491 · PHP

    In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.

    Published 13 Jul 2025 · Fixed in 8.2.29, 8.3.23, 8.4.10 · NVD
  13. High 7.5

    CVE-2025-53506 · Apache Tomcat

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be…

    Published 10 Jul 2025 · NVD
  14. High 7.5

    CVE-2025-52520 · Apache Tomcat

    For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through…

    Published 10 Jul 2025 · Fixed in 9.0.107, 10.1.43, 11.0.9 · NVD
  15. High 7.5

    CVE-2025-52434 · Apache Tomcat

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be…

    Published 10 Jul 2025 · Fixed in 9.0.107 · NVD
  16. High 7.5

    CVE-2025-53020 · Apache HTTP Server

    Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  17. High 7.4

    CVE-2025-49812 · Apache HTTP Server

    In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  18. High 7.5

    CVE-2025-49630 · Apache HTTP Server

    In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  19. Critical 9.1

    CVE-2025-23048 · Apache HTTP Server

    In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a…

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  20. High 7.5

    CVE-2024-47252 · Apache HTTP Server

    Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or…

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  21. High 7.5

    CVE-2024-43394 · Apache HTTP Server

    Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via  mod_rewrite or apache expressions that pass unvalidated request input. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63. Note:  The Apache HTTP Server Project will be setting a higher bar for accepting vulnerability reports regarding SSRF via UNC…

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  22. High 7.5

    CVE-2024-43204 · Apache HTTP Server

    SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request. Users are recommended to upgrade to version 2.4.64 which fixes this issue.

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  23. High 7.5

    CVE-2024-42516 · Apache HTTP Server

    HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response. This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue. Users are recommended to upgrade to version 2.4.64, which…

    Published 10 Jul 2025 · Fixed in 2.4.64 · NVD
  24. High 8.0

    CVE-2025-6948 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.

    Published 10 Jul 2025 · Fixed in 17.11.6, 18.0.4, 18.1.2 · NVD
  25. Low 2.7

    CVE-2025-6168 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests.

    Published 10 Jul 2025 · Fixed in 18.0.4, 18.1.2 · NVD
  26. Low 2.7

    CVE-2025-4972 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated users with invitation privileges to bypass group-level user invitation restrictions by manipulating group invitation functionality.

    Published 10 Jul 2025 · Fixed in 18.0.4, 18.1.2 · NVD
  27. Medium 4.3

    CVE-2025-3396 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that could have allowed authenticated project owners to bypass group-level forking restrictions by manipulating API requests.

    Published 10 Jul 2025 · Fixed in 17.11.6, 18.0.4, 18.1.2 · NVD
  28. Medium 6.5

    CVE-2025-7259 · MongoDB

    An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can only be triggered by authorized users and cause Denial of Service. This issue affects MongoDB Server v8.1 version 8.1.0.

    Published 7 Jul 2025 · NVD
  29. High 7.5

    CVE-2025-48367 · Redis

    Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19.

    Published 7 Jul 2025 · Fixed in 7.2.10, 7.4.5, 8.0.3 · NVD
  30. High 7.8

    CVE-2025-32023 · Redis

    Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is…

    Published 7 Jul 2025 · Fixed in 7.2.10, 7.4.5, 8.0.3 · NVD
  31. High 7.5

    CVE-2025-6714 · MongoDB

    MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured with load balancer support. This issue affects MongoDB Server v6.0 prior to 6.0.23, MongoDB Server v7.0 prior to 7.0.20 and MongoDB Server v8.0 prior to 8.0.9 Required Configuration: This affects MongoDB sharded clusters when configured…

    Published 7 Jul 2025 · Fixed in 6.0.23, 7.0.20, 8.0.9 · NVD
  32. Medium 6.5

    CVE-2025-6713 · MongoDB

    An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This issue affects MongoDB Server MongoDB Server v8.0 versions prior to 8.0.7, MongoDB Server v7.0 versions prior to 7.0.19 and MongoDB Server…

    Published 7 Jul 2025 · Fixed in 6.0.22, 7.0.19, 8.0.7 · NVD
  33. Medium 6.5

    CVE-2025-6712 · MongoDB

    MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in memory management related to internal operations. In scenarios where certain internal processes persist longer than anticipated, memory consumption can increase, potentially impacting server stability and availability. This issue affects…

    Published 7 Jul 2025 · Fixed in 8.0.10 · NVD
  34. Medium 4.9

    CVE-2025-6711 · MongoDB

    An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered. This issue affects MongoDB Server v8.0 versions prior to 8.0.5, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v6.0 versions prior to 6.0.21.

    Published 7 Jul 2025 · Fixed in 6.0.21, 7.0.18, 8.0.5 · NVD
  35. Low 3.7

    CVE-2025-49005 · Next.js

    Next.js has a Cache poisoning vulnerability due to omission of the Vary header

    Published 3 Jul 2025 · Fixed in 15.3.3 · OSV.dev and GitHub
  36. Medium 4.3

    CVE-2025-53193 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Cross-Site Request Forgery (CSRF)

    Published 27 Jun 2025 · Fixed in 2.0.8 · WPVulnerability
  37. High 7.5

    CVE-2025-6710 · MongoDB

    MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the server to crash which could occur pre-authorisation. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and…

    Published 26 Jun 2025 · Fixed in 6.0.21, 7.0.17, 8.0.5 · NVD
  38. High 7.5

    CVE-2025-6709 · MongoDB

    The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using the mongo shell to send a malicious JSON payload leading to an invariant failure and server crash. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior…

    Published 26 Jun 2025 · Fixed in 6.0.21, 7.0.17, 8.0.5 · NVD
  39. Medium 5.4

    CVE-2025-6707 · MongoDB

    Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5.

    Published 26 Jun 2025 · Fixed in 6.0.24, 7.0.21, 8.0.5 · NVD
  40. High 8.8

    CVE-2025-6706 · MongoDB

    An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific combination of rarely-used aggregation pipeline expressions. This issue affects MongoDB Server v6.0…

    Published 26 Jun 2025 · Fixed in 6.0.21, 7.0.17, 8.0.4 · NVD
  41. Medium 4.3

    CVE-2025-5846 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to assign unrelated compliance frameworks to projects by sending crafted GraphQL mutations that bypassed framework-specific permission checks.

    Published 26 Jun 2025 · Fixed in 17.11.5, 18.0.3 · NVD
  42. Medium 4.3

    CVE-2025-5315 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users with Guest role permissions to add child items to incident work items by sending crafted API requests that bypassed UI-enforced role restrictions.

    Published 26 Jun 2025 · Fixed in 17.11.5, 18.0.3 · NVD
  43. Medium 6.5

    CVE-2025-3279 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated attackers to create a DoS condition by sending crafted GraphQL requests.

    Published 26 Jun 2025 · Fixed in 17.11.5, 18.0.3 · NVD
  44. High 8.8

    CVE-2025-2938 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants.

    Published 26 Jun 2025 · Fixed in 17.11.5, 18.0.3 · NVD
  45. Medium 5.3

    CVE-2025-1754 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed unauthenticated attackers to upload arbitrary files to public projects by sending crafted API requests, potentially leading to resource abuse and unauthorized content storage.

    Published 26 Jun 2025 · Fixed in 17.11.5, 18.0.3 · NVD
  46. Medium 4.3

    CVE-2025-49550 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access. Exploitation of this issue requires user interaction.

    Published 25 Jun 2025 · Fixed in 2.4.4, 2.4.5 · NVD
  47. Low 2.7

    CVE-2025-49549 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access. Exploitation of this issue does not require user interaction.

    Published 25 Jun 2025 · Fixed in 2.4.4, 2.4.5 · NVD
  48. Medium 6.3

    CVE-2025-49845 · Discourse

    Discourse is an open-source discussion platform. The visibility of posts typed `whisper` is controlled via the `whispers_allowed_groups` site setting. Only users that belong to groups specified in the site setting are allowed to view posts typed `whisper`. However, it has been discovered that users of versions prior to 3.4.6 on the `stable` branch and prior to 3.5.0.beta8-dev on the…

    Published 25 Jun 2025 · Fixed in 3.4.6 · NVD
  49. Medium 6.1

    CVE-2025-48954 · Discourse

    Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled.

    Published 25 Jun 2025 · Fixed in 3.5.0 · NVD
  50. Low 3.1

    CVE-2023-5600 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. Arbitrary access to the titles of an private specific references could be leaked through the service-desk custom email template.

    Published 20 Jun 2025 · Fixed in 16.3.6, 16.4.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.