UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
172
Critical in 30 days
40
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. Medium 6.5

    CVE-2024-13054 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. where a denial of service vulnerability could allow an attacker to cause a system reboot under certain conditions.

    Published 13 Mar 2025 · Fixed in 17.7.7, 17.8.5, 17.9.2 · NVD
  2. High 7.5

    CVE-2024-12380 · GitLab

    An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive authentication information.

    Published 13 Mar 2025 · Fixed in 17.7.7, 17.8.5, 17.9.2 · NVD
  3. Medium 5.9

    CVE-2025-26762 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 12 Mar 2025 · Fixed in 9.7.1 · WPVulnerability
  4. High 7.0

    CVE-2025-24070 · .NET

    Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.

    Published 11 Mar 2025 · Fixed in 8.0.14, 9.0.3 · NVD
  5. Medium 5.4

    CVE-2025-1527 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 11 Mar 2025 · Fixed in 3.1.1 · WPVulnerability
  6. Critical 9.8Actively exploited

    CVE-2025-24813 · Apache Tomcat

    Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was…

    Published 10 Mar 2025 · Fixed in 9.0.99, 10.1.35, 11.0.3 · NVD
  7. Medium 4.3

    CVE-2025-2045 · GitLab

    Improper authorization in GitLab EE affecting all versions from 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, 17.9 prior to 17.9.1 allow users with limited permissions to access to potentially sensitive project analytics data.

    Published 6 Mar 2025 · Fixed in 17.7.6, 17.8.4 · NVD
  8. Medium 4.2

    CVE-2025-1540 · GitLab

    An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. It was possible for a user added as an External to read and clone internal projects under certain circumstances."

    Published 6 Mar 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  9. Medium 6.4

    CVE-2024-13805 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Cross-site Scripting

    Published 6 Mar 2025 · Fixed in 5.3.0 · WPVulnerability
  10. Medium 6.1

    CVE-2025-0555 · GitLab

    A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows an attacker to bypass security controls and execute arbitrary scripts in a users browser under specific conditions.

    Published 3 Mar 2025 · Fixed in 17.7.6, 17.8.4 · NVD
  11. Medium 6.1

    CVE-2025-0475 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances.

    Published 3 Mar 2025 · Fixed in 17.7.6, 17.8.4 · NVD
  12. Medium 5.3

    CVE-2024-10925 · GitLab

    A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Security policy YAML

    Published 3 Mar 2025 · Fixed in 17.7.6, 17.8.4 · NVD
  13. Medium 5.4

    CVE-2024-8186 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations.

    Published 3 Mar 2025 · Fixed in 17.7.6, 17.8.4 · NVD
  14. Medium 5.9

    CVE-2025-26466 · OpenSSH

    A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may…

    Published 28 Feb 2025 · NVD
  15. Medium 5.4

    CVE-2024-54444 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 24 Feb 2025 · Fixed in 3.25.11 · NVD, WPVulnerability
  16. Medium 5.4

    CVE-2024-13445 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 19 Feb 2025 · Fixed in 3.27.5 · NVD, WPVulnerability
  17. Medium 6.8

    CVE-2025-26465 · OpenSSH

    A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory…

    Published 18 Feb 2025 · NVD
  18. Medium 5.7

    CVE-2024-3303 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prior to 17.8.2, which allows an attacker to exfiltrate contents of a private issue using prompt injection.

    Published 13 Feb 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  19. Medium 5.3

    CVE-2025-1198 · GitLab

    An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results.

    Published 13 Feb 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  20. Medium 6.6

    CVE-2024-8266 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.6.0, which allows an attacker with maintainer role to trigger a pipeline as project owner under certain circumstances.

    Published 13 Feb 2025 · Fixed in 17.6.0 · NVD
  21. High 7.5

    CVE-2024-7102 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another user under certain circumstances.

    Published 13 Feb 2025 · Fixed in 17.5.0 · NVD
  22. Critical 9.1

    CVE-2022-31631 · PHP

    In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.

    Published 12 Feb 2025 · Fixed in 8.0.27, 8.1.15, 8.2.2 · NVD
  23. Medium 4.3

    CVE-2025-0516 · GitLab

    Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform unauthorized actions on critical project data.

    Published 12 Feb 2025 · Fixed in 17.7.4, 17.8.2 · NVD
  24. High 8.8

    CVE-2024-9870 · GitLab

    An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services.

    Published 12 Feb 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  25. High 7.5

    CVE-2025-1212 · GitLab

    An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send a crafted request to a backend server to reveal sensitive information.

    Published 12 Feb 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  26. High 7.5

    CVE-2025-1042 · GitLab

    An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized way.

    Published 12 Feb 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  27. Medium 6.1

    CVE-2025-0376 · GitLab

    An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an attacker to execute unauthorized actions via a change page.

    Published 12 Feb 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  28. Medium 6.5

    CVE-2024-12379 · GitLab

    A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to impact the availability of GitLab via unbounded symbol creation via the scopes parameter in a Personal Access Token.

    Published 12 Feb 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  29. Medium 4.3

    CVE-2024-13229 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Improper Access Control

    Published 12 Feb 2025 · Fixed in 1.0.236 · WPVulnerability
  30. Medium 6.4

    CVE-2024-13227 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 12 Feb 2025 · Fixed in 1.0.236 · WPVulnerability
  31. High 8.7

    CVE-2025-24438 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · NVD
  32. Medium 5.4

    CVE-2025-24437 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to view or modify select information. Exploitation of this issue does not require user interaction.

    Published 11 Feb 2025 · NVD
  33. Medium 4.3

    CVE-2025-24436 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to view select information. Exploitation of this issue does not require user interaction.

    Published 11 Feb 2025 · NVD
  34. Medium 4.3

    CVE-2025-24435 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to modify limited fields. Exploitation of this issue does not require user interaction.

    Published 11 Feb 2025 · NVD
  35. Critical 9.1

    CVE-2025-24434 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. A successful attacker can abuse this to…

    Published 11 Feb 2025 · NVD
  36. Low 3.7

    CVE-2025-24432 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this race condition to alter a condition after it has been checked but before it is used, potentially bypassing rate limiting mechanisms. Exploitation…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  37. Low 3.7

    CVE-2025-24430 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this race condition to alter a condition after it has been checked but before it is used, potentially bypassing rate limiting mechanisms. Exploitation…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  38. Low 3.5

    CVE-2025-24429 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass allowing read only access. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction.

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  39. Medium 5.4

    CVE-2025-24428 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  40. Medium 6.5

    CVE-2025-24427 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  41. Medium 5.3

    CVE-2025-24425 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Business Logic Error vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to circumvent intended security mechanisms by manipulating the logic of the application's operations causing limited data modification. Exploitation of this issue…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  42. Medium 4.3

    CVE-2025-24421 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to read select data. Exploitation of this issue does not require user interaction

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  43. High 8.7

    CVE-2025-24417 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  44. High 8.7

    CVE-2025-24416 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  45. High 8.7

    CVE-2025-24415 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  46. High 8.7

    CVE-2025-24414 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  47. High 8.7

    CVE-2025-24413 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  48. High 8.7

    CVE-2025-24412 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  49. High 8.1

    CVE-2025-24411 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access affecting Confidentiality and Integrity. Exploitation of this issue does not require…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  50. High 8.7

    CVE-2025-24410 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.