UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
172
Critical in 30 days
40
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. Medium 4.9

    CVE-2025-21584 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Apr 2025 · NVD
  2. Medium 4.9

    CVE-2025-21583 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.4.0 and 9.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 15 Apr 2025 · NVD
  3. Medium 4.9

    CVE-2025-21581 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 15 Apr 2025 · NVD
  4. Medium 4.9

    CVE-2025-21580 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Apr 2025 · NVD
  5. Medium 4.9

    CVE-2025-21579 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 15 Apr 2025 · NVD
  6. Medium 6.5

    CVE-2025-21577 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Apr 2025 · NVD
  7. Medium 6.5

    CVE-2025-21575 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 15 Apr 2025 · NVD
  8. Medium 6.5

    CVE-2025-21574 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 15 Apr 2025 · NVD
  9. Medium 5.3

    CVE-2025-3247 · Contact Form 7

    Contact Form 7: Improper Validation of Integrity Check Value

    Published 15 Apr 2025 · Fixed in 6.0.6 · NVD, WPVulnerability
  10. Medium 6.5

    CVE-2025-0362 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions, an attacker could potentially trick users into unintentionally authorizing sensitive actions on their behalf.

    Published 10 Apr 2025 · Fixed in 17.8.7, 17.9.6, 17.10.4 · NVD
  11. Medium 5.3

    CVE-2025-2469 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.9.6, and 17.10 before 17.10.4. The runtime profiling data of a specific service was accessible to unauthenticated users.

    Published 10 Apr 2025 · Fixed in 17.9.6, 17.10.4 · NVD
  12. Medium 5.3

    CVE-2025-2408 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions users could bypass IP access restrictions and view sensitive information.

    Published 10 Apr 2025 · Fixed in 17.8.7, 17.9.6, 17.10.4 · NVD
  13. High 7.5

    CVE-2025-1677 · GitLab

    A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of service could occur upon injecting oversized payloads into CI pipeline exports.

    Published 10 Apr 2025 · Fixed in 17.9.6, 17.10.4 · NVD
  14. High 7.5

    CVE-2024-11129 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term."

    Published 10 Apr 2025 · Fixed in 17.8.7, 17.9.6, 17.10.4 · NVD
  15. Low 3.8

    CVE-2025-32728 · OpenSSH

    In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.

    Published 10 Apr 2025 · Fixed in 10.0 · NVD
  16. Low 2.7

    CVE-2025-27192 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnerability to gain unauthorized access to protected resources by obtaining sensitive credential information. Exploitation of this issue does…

    Published 8 Apr 2025 · Fixed in 2.4.4 · NVD
  17. Medium 5.3

    CVE-2025-27191 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.

    Published 8 Apr 2025 · Fixed in 2.4.4 · NVD
  18. Medium 5.3

    CVE-2025-27190 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.

    Published 8 Apr 2025 · NVD
  19. Medium 4.3

    CVE-2025-27188 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.

    Published 8 Apr 2025 · Fixed in 2.4.4 · NVD
  20. High 7.5

    CVE-2025-26682 · .NET

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

    Published 8 Apr 2025 · Fixed in 8.0.15, 9.0.4 · NVD
  21. High 7.5

    CVE-2025-25227 · Joomla!

    Insufficient state checks lead to a vector that allows to bypass 2FA checks.

    Published 8 Apr 2025 · Fixed in 4.4.13, 5.2.6 · NVD
  22. Critical 9.8

    CVE-2025-25226 · Joomla!

    Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the…

    Published 8 Apr 2025 · Fixed in 2.2.0, 3.4.0 · NVD
  23. High 7.5

    CVE-2024-52981 · Elasticsearch

    An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.

    Published 8 Apr 2025 · Fixed in 7.17.24, 8.15.1 · NVD
  24. Medium 6.5

    CVE-2024-52980 · Elasticsearch

    A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.

    Published 8 Apr 2025 · Fixed in 8.15.1 · NVD
  25. Critical 9.2

    CVE-2024-11235 · PHP

    In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.

    Published 4 Apr 2025 · Fixed in 8.3.19, 8.4.5 · NVD
  26. Critical 9.8

    CVE-2025-3085 · MongoDB

    A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to improper authentication. This issue may also affect intra-cluster authentication. This issue affects…

    Published 1 Apr 2025 · Fixed in 6.0.20, 7.0.16, 8.0.4 · NVD
  27. Medium 6.5

    CVE-2025-3084 · MongoDB

    When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Server v8.0 prior to 8.0.4

    Published 1 Apr 2025 · Fixed in 6.0.20, 7.0.16, 8.0.4 · NVD
  28. High 7.5

    CVE-2025-3083 · MongoDB

    Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31,  MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to 7.0.16

    Published 1 Apr 2025 · Fixed in 5.0.31, 6.0.20, 7.0.16 · NVD
  29. Medium 5.4

    CVE-2025-3082 · MongoDB

    A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, MongoDB Server v7.0 version prior to 7.0.14 and MongoDB Server v7.3 versions prior to 7.3.4.

    Published 1 Apr 2025 · Fixed in 6.0.20, 7.0.14, 7.3.4 · NVD
  30. Medium 6.3

    CVE-2025-1861 · PHP

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting…

    Published 30 Mar 2025 · Fixed in 8.2.26, 8.3.14, 8.4.5 · NVD
  31. Medium 6.3

    CVE-2025-1736 · PHP

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.

    Published 30 Mar 2025 · Fixed in 8.2.28, 8.3.19, 8.4.5 · NVD
  32. Medium 6.3

    CVE-2025-1734 · PHP

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

    Published 30 Mar 2025 · Fixed in 8.2.28, 8.3.19, 8.4.5 · NVD
  33. Medium 6.3

    CVE-2025-1219 · PHP

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.

    Published 30 Mar 2025 · Fixed in 8.2.28, 8.3.19, 8.4.5 · NVD
  34. Medium 6.3

    CVE-2025-1217 · PHP

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.

    Published 29 Mar 2025 · Fixed in 8.2.28, 8.3.19, 8.4.5 · NVD
  35. Medium 6.5

    CVE-2024-12619 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects.

    Published 28 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  36. Medium 5.5

    CVE-2024-10307 · GitLab

    An issue has been discovered in GitLab EE/CE affecting all versions from 12.10 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A maliciously crafted file can cause uncontrolled CPU consumption when viewing the associated merge request.

    Published 28 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  37. Medium 6.5

    CVE-2025-2867 · GitLab

    An issue has been discovered in the GitLab Duo with Amazon Q affecting all versions from 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A specifically crafted issue could manipulate AI-assisted development features to potentially expose sensitive project data to unauthorized users.

    Published 27 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  38. Medium 5.4

    CVE-2025-2255 · GitLab

    An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks (XSS). for AppSec.

    Published 27 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  39. High 8.8

    CVE-2025-2242 · GitLab

    An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to groups and projects.

    Published 27 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  40. Medium 5.4

    CVE-2025-0811 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering of certain file types leads to cross-site scripting.

    Published 27 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  41. High 8.0

    CVE-2024-9773 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions starting from 17.10 before 17.10.1. An input validation issue in the Harbor registry integration could have allowed a maintainer to add malicious code to the CLI commands shown in the UI.

    Published 27 Mar 2025 · Fixed in 17.8.6, 17.9.3 · NVD
  42. Medium 4.3

    CVE-2025-24972 · Discourse

    Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions `3.3.4` and `3.4.0.beta5` contain a patch for the issue. A workaround is available. If a user disables chat in their…

    Published 26 Mar 2025 · Fixed in 3.3.4, 3.4.0 · NVD
  43. Low 3.1

    CVE-2025-24808 · Discourse

    Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, someone who is about to reach the limit of users in a group DM may send requests to add new users in parallel. The requests might all go through ignoring the limit due to a race condition. The patch in versions `3.3.4` and `3.4.0.beta5` uses the `lock` step in…

    Published 26 Mar 2025 · Fixed in 3.3.3, 3.4.0 · NVD
  44. High 7.2

    CVE-2024-13889 · Wordpress Importer (WordPress plugin)

    WordPress Importer: Deserialization of Untrusted Data

    Published 25 Mar 2025 · Fixed in 0.8.4 · WPVulnerability
  45. Critical 9.1

    CVE-2025-29927 · Next.js

    Authorization Bypass in Next.js Middleware

    Published 21 Mar 2025 · Fixed in 13.5.9, 14.2.25, 15.2.3 · OSV.dev and GitHub
  46. High 7.5

    CVE-2025-0755 · MongoDB

    The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and…

    Published 18 Mar 2025 · Fixed in 7.0.16 · NVD
  47. High 7.5

    CVE-2025-1257 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. A vulnerability in certain GitLab instances could allow an attacker to cause a denial of service condition by manipulating specific API inputs.

    Published 13 Mar 2025 · Fixed in 17.7.7, 17.8.5, 17.9.2 · NVD
  48. Medium 6.5

    CVE-2025-0652 · GitLab

    An issue has been discovered in GitLab EE/CE affecting all versions starting from 16.9 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2 could allow unauthorized users to access confidential information intended for internal use only.

    Published 13 Mar 2025 · Fixed in 17.7.7, 17.8.5, 17.9.2 · NVD
  49. High 7.4

    CVE-2024-8402 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 17.2 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. An input validation issue in the Google Cloud IAM integration feature could have enabled a Maintainer to introduce malicious code.

    Published 13 Mar 2025 · Fixed in 17.7.7, 17.8.5, 17.9.2 · NVD
  50. Low 2.7

    CVE-2024-7296 · GitLab

    An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user with a custom permission to approve pending membership requests beyond the maximum number of allowed users.

    Published 13 Mar 2025 · Fixed in 17.7.7, 17.8.5, 17.9.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.