UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
180
Critical in 30 days
40
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. High 8.1

    CVE-2024-4994 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions starting from 17.1.0 before 17.1.1 which allowed for a CSRF attack on GitLab's GraphQL API leading to the execution of arbitrary GraphQL mutations.

    Published 20 Jun 2025 · Fixed in 16.11.5, 17.0.3 · NVD
  2. High 7.5

    CVE-2024-4025 · GitLab

    A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions from 7.10 prior before 16.11.5, version 17.0 before 17.0.3, and 17.1 before 17.1.1. It is possible for an attacker to cause a denial of service using a crafted markdown page.

    Published 20 Jun 2025 · Fixed in 16.11.5, 17.0.3 · NVD
  3. Critical 9.9

    CVE-2025-5121 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.4 and 18.0 before 18.0.2. A missing authorization check may have allowed compliance frameworks to be applied to projects outside the compliance framework's group.

    Published 20 Jun 2025 · Fixed in 17.11.4, 18.0.2 · NVD
  4. Medium 6.1

    CVE-2025-2443 · GitLab

    An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

    Published 20 Jun 2025 · Fixed in 17.9.7, 17.10.5 · NVD
  5. High 7.5

    CVE-2024-7586 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.

    Published 20 Jun 2025 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  6. Medium 5.9

    CVE-2025-52710 · Filester (WordPress plugin)

    File Manager Pro – Filester: Cross-site Scripting

    Published 19 Jun 2025 · Fixed in 1.8.9 · WPVulnerability
  7. Medium 6.5

    CVE-2024-50555 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 19 Jun 2025 · Fixed in 3.29.1 · WPVulnerability
  8. Medium 6.4

    CVE-2025-6201 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Cross-site Scripting

    Published 18 Jun 2025 · Fixed in 1.49.1 · WPVulnerability
  9. High 7.5

    CVE-2025-49125 · Apache Tomcat

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be…

    Published 16 Jun 2025 · Fixed in 9.0.106, 10.1.42, 11.0.8 · NVD
  10. High 8.4

    CVE-2025-49124 · Apache Tomcat

    Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected:…

    Published 16 Jun 2025 · Fixed in 9.0.106, 10.1.42, 11.0.8 · NVD
  11. High 7.5

    CVE-2025-48988 · Apache Tomcat

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are…

    Published 16 Jun 2025 · Fixed in 9.0.106, 10.1.42, 11.0.8 · NVD
  12. High 7.5

    CVE-2025-30399 · .NET

    Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.

    Published 13 Jun 2025 · Fixed in 8.0.17, 9.0.6 · NVD
  13. Medium 6.4

    CVE-2025-5238 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Cross-site Scripting

    Published 13 Jun 2025 · Fixed in 4.6.0 · WPVulnerability
  14. High 7.2

    CVE-2025-3234 · Filester (WordPress plugin)

    File Manager Pro – Filester: Unrestricted Upload of File with Dangerous Type

    Published 13 Jun 2025 · Fixed in 1.8.9 · WPVulnerability
  15. High 7.5

    CVE-2025-5982 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.

    Published 12 Jun 2025 · Fixed in 17.10.8, 17.11.4, 18.0.2 · NVD
  16. Medium 5.9

    CVE-2024-9512 · GitLab

    An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync.

    Published 12 Jun 2025 · Fixed in 17.10.8, 17.11.4, 18.0.2 · NVD
  17. Medium 4.3

    CVE-2025-5195 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. It was possible for authenticated users to access arbitrary compliance frameworks, leading to unauthorized data disclosure.

    Published 12 Jun 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  18. High 7.5

    CVE-2025-0673 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2, allow an attacker to trigger an infinite redirect loop, potentially leading to a denial of service condition.

    Published 12 Jun 2025 · Fixed in 17.10.8, 17.11.4, 18.0.2 · NVD
  19. Medium 6.5

    CVE-2025-5996 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. A lack of input validation in HTTP responses could allow an authenticated user to cause denial of service.

    Published 12 Jun 2025 · Fixed in 17.10.8, 17.11.4, 18.0.2 · NVD
  20. High 8.7

    CVE-2025-4278 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover.

    Published 12 Jun 2025 · Fixed in 18.0.2 · NVD
  21. Medium 6.1

    CVE-2025-2254 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper output encoding in the snipper viewer functionality lead to Cross-Site scripting attacks.

    Published 12 Jun 2025 · Fixed in 17.10.8, 17.11.4, 18.0.2 · NVD
  22. High 7.5

    CVE-2025-1516 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper input validation in Tokens Names could be used to trigger a denial of service.

    Published 12 Jun 2025 · Fixed in 17.10.8, 17.11.4, 18.0.2 · NVD
  23. High 7.5

    CVE-2025-1478 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in Board Names could be used to trigger a denial of service.

    Published 12 Jun 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  24. High 8.4

    CVE-2025-47110 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Scope is changed…

    Published 10 Jun 2025 · NVD
  25. High 8.1

    CVE-2025-43586 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized elevated access. Exploitation of this issue does not require user interaction.

    Published 10 Jun 2025 · NVD
  26. High 8.2

    CVE-2025-43585 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access leading to a limited impact to confidentiality and a high impact to integrity. Exploitation of this issue…

    Published 10 Jun 2025 · NVD
  27. Medium 5.3

    CVE-2025-27206 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited write access. Exploitation of this issue does not require user interaction.

    Published 10 Jun 2025 · NVD
  28. High 8.1

    CVE-2025-48877 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, Codepen is present in the default `allowed_iframes` site setting, and it can potentially auto-run arbitrary JS in the iframe scope, which is unintended. This issue is patched in version 3.4.4 of the…

    Published 9 Jun 2025 · Fixed in 3.4.4, 3.5.0 · NVD
  29. Medium 6.1

    CVE-2025-48062 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, certain invites via email may result in HTML injection in the email body if the topic title includes HTML. This includes inviting someone (without an account) to a PM and inviting someone (without an…

    Published 9 Jun 2025 · Fixed in 3.4.4, 3.5.0 · NVD
  30. High 8.7

    CVE-2025-48053 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, sending a malicious URL in a PM to a bot user can cause a reduced the availability of a Discourse instance. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the…

    Published 9 Jun 2025 · Fixed in 3.4.4, 3.5.0 · NVD
  31. High 7.5

    CVE-2025-5399 · curl

    Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application.

    Published 7 Jun 2025 · Fixed in 8.14.1 · NVD
  32. High 8.7

    CVE-2025-1763 · GitLab

    An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

    Published 30 May 2025 · Fixed in 17.9.7, 17.10.5 · NVD
  33. High 7.3

    CVE-2025-46701 · Apache Tomcat

    Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was…

    Published 29 May 2025 · Fixed in 9.0.105, 10.1.41, 11.0.7 · NVD
  34. Critical 9.8

    CVE-2025-27151 · Redis

    Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been…

    Published 29 May 2025 · Fixed in 7.2.9, 7.4.4, 8.0.2 · NVD
  35. Low

    CVE-2025-48068 · Next.js

    Information exposure in Next.js dev server due to lack of origin verification

    Published 28 May 2025 · Fixed in 14.2.30, 15.2.2 · OSV.dev and GitHub
  36. Medium 4.8

    CVE-2025-5025 · curl

    libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly…

    Published 28 May 2025 · Fixed in 8.14.0 · NVD
  37. Medium 6.5

    CVE-2025-4947 · curl

    libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

    Published 28 May 2025 · Fixed in 8.14.0 · NVD
  38. High 7.5

    CVE-2024-9163 · GitLab

    A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an attacker can cause a branch name confusion in confidential MRs.

    Published 23 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  39. High 7.5

    CVE-2024-7803 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A Discord webhook integration may cause DoS.

    Published 23 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  40. Medium 6.5

    CVE-2025-0993 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. This could allow an authenticated attacker to cause a denial of service condition by exhausting server resources.

    Published 22 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  41. Medium 4.3

    CVE-2025-0679 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Under certain conditions un-authorised users can view full email addresses that should be partially obscured.

    Published 22 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  42. Medium 4.3

    CVE-2025-0605 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access controls could allow certain users to bypass two-factor authentication requirements.

    Published 22 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  43. Medium 6.8

    CVE-2024-12093 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 11.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Improper XPath validation allows modified SAML response to bypass 2FA requirement under specialized conditions.

    Published 22 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  44. High 7.5

    CVE-2025-4979 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to reveal masked or hidden CI variables (that they did not author) in the WebUI, by simply creating their own variable and observing the HTTP response.

    Published 22 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  45. Medium 6.5

    CVE-2025-4575 · OpenSSL

    Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Impact summary: If a user intends to make a trusted certificate rejected for a particular use it will be instead marked as trusted for that use. A copy & paste error during minor refactoring of the code introduced this issue in the OpenSSL 3.5 version. If, for…

    Published 22 May 2025 · NVD
  46. Medium 6.5

    CVE-2025-3111 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 10.2 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in the Kubernetes integration could allow an authenticated user to cause denial of service..

    Published 22 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  47. Medium 6.5

    CVE-2025-2853 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of proper validation in GitLab could allow an authenticated user to cause a denial of service condition.

    Published 22 May 2025 · Fixed in 17.10.7, 17.11.3 · NVD
  48. Medium 4.3

    CVE-2025-1110 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could access Job Data via a crafted GraphQL query.

    Published 22 May 2025 · NVD
  49. Medium 6.1

    CVE-2025-5062 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 21 May 2025 · Fixed in 9.3.4, 9.4.3 · NVD, WPVulnerability
  50. Medium 5.4

    CVE-2025-2892 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting

    Published 18 May 2025 · Fixed in 4.8.2 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.