UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
172
Critical in 30 days
40
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. High 8.2

    CVE-2025-24409 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both a High impact to confidentiality and Low impact to integrity. Exploitation of this…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  2. Medium 6.5

    CVE-2025-24408 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Information Exposure vulnerability that could result in privilege escalation. A low-privileged attacker could gain unauthorized access to sensitive information. Exploitation of this issue does not require user interaction.

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  3. High 7.5

    CVE-2025-24406 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a security feature bypass. An unauthenticated attacker could exploit this vulnerability to modify files that are stored outside the restricted directory. Exploitation of this…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  4. Medium 6.1

    CVE-2024-10383 · GitLab

    An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343and used by all versions of GitLab CE/EE starting from 15.11 prior to 17.3 and which also temporarily affected versions 17.4, 17.5 and 17.6, where a XSS attack was possible when loading .ipynb files in the web IDE

    Published 7 Feb 2025 · Fixed in 17.3.0 · NVD
  5. Medium 6.5

    CVE-2025-1072 · GitLab

    A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior to 17.4.4, and 17.5 prior to 17.5.2. A denial of service could occur upon importing maliciously crafted content using the Fogbugz importer.

    Published 7 Feb 2025 · Fixed in 17.4.4, 17.5.2, 17.7.3 · NVD
  6. Medium 5.3

    CVE-2025-23419 · nginx

    When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache…

    Published 5 Feb 2025 · Fixed in 1.26.3, 1.27.4 · NVD
  7. High 7.5

    CVE-2024-2878 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible for an attacker to cause a denial of service by crafting unusual search terms for branch names.

    Published 5 Feb 2025 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  8. Medium 6.5

    CVE-2024-3976 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose via the UI the confidential issues title and description from a public project to unauthorised instance users.

    Published 5 Feb 2025 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  9. High 7.5

    CVE-2024-9631 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, where viewing diffs of MR with conflicts can be slow.

    Published 5 Feb 2025 · Fixed in 17.2.9, 17.3.5, 17.4.2 · NVD
  10. Medium 5.4

    CVE-2024-5528 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows a subdomain takeover in GitLab Pages.

    Published 5 Feb 2025 · Fixed in 16.11.6, 17.0.4, 17.1.2 · NVD
  11. High 7.3

    CVE-2025-0725 · curl

    When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.

    Published 5 Feb 2025 · Fixed in 8.12.0 · NVD
  12. High 7.0

    CVE-2025-0665 · curl

    libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.

    Published 5 Feb 2025 · NVD
  13. Low 3.4

    CVE-2025-0167 · curl

    When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.

    Published 5 Feb 2025 · Fixed in 8.12.0 · NVD
  14. Medium 4.4

    CVE-2024-6356 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which allowed cross project access for Security policy bot.

    Published 5 Feb 2025 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  15. Medium 5.3

    CVE-2024-1539 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose updates to issues to a banned group member using the API.

    Published 5 Feb 2025 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  16. High 7.5

    CVE-2023-6386 · GitLab

    A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 prior to 16.8.2 which allows an attacker to spike the GitLab instance resource usage resulting in service degradation.

    Published 5 Feb 2025 · Fixed in 16.6.7, 16.7.5, 16.8.2 · NVD
  17. Medium 4.3

    CVE-2024-53994 · Discourse

    Discourse is an open source platform for community discussion. In affected versions users who disable chat in preferences could still be reachable in some cases. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable the chat plugin within site settings.

    Published 4 Feb 2025 · Fixed in 3.3.3, 3.4.0 · NVD
  18. Medium 6.5

    CVE-2024-53851 · Discourse

    Discourse is an open source platform for community discussion. In affected versions the endpoint for generating inline oneboxes for URLs wasn't enforcing limits on the number of URLs that it accepted, allowing a malicious user to inflict denial of service on some parts of the app. This vulnerability is only exploitable by authenticated users. This issue has been patched in the latest stable,…

    Published 4 Feb 2025 · Fixed in 3.3.3, 3.4.0 · NVD
  19. Medium 5.4

    CVE-2024-53266 · Discourse

    Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in the user's profile page may be vulnerable to XSS. This has been patched in the latest version of Discourse core. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled.

    Published 4 Feb 2025 · Fixed in 3.3.3, 3.4.0 · NVD
  20. High 8.2

    CVE-2025-23023 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to poison the anonymous cache (for example, the cache may have a response with missing preloaded data). This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse. Users are…

    Published 4 Feb 2025 · Fixed in 3.3.2 · NVD
  21. Medium 6.1

    CVE-2025-22602 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can execute arbitrary JavaScript on users' browsers by posting a malicious video placeholder html element. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should enable CSP.

    Published 4 Feb 2025 · Fixed in 3.3.4, 3.4.0 · NVD
  22. Low 3.1

    CVE-2025-22601 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username via carefully crafted link using the `activate-account` route. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 4 Feb 2025 · Fixed in 3.4.0 · NVD
  23. Medium 6.1

    CVE-2024-56328 · Discourse

    Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by posting a maliciously crafted onebox url. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should enable CSP, disable inline Oneboxes globally, or…

    Published 4 Feb 2025 · Fixed in 3.3.3, 3.4.0 · NVD
  24. Medium 4.9

    CVE-2024-56197 · Discourse

    Discourse is an open source platform for community discussion. PM titles and metadata can be read by other users when the "PM tags allowed for groups" option is enabled, the other user is a member of a group added to this option, and the PM has been tagged. This issue has been patched in the latest `stable`, `beta` and `tests-passed` versions of Discourse. Users are advised to upgrade. Users…

    Published 4 Feb 2025 · Fixed in 3.3.4, 3.4.0 · NVD
  25. High 8.2

    CVE-2024-55948 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR request to poison the anonymous cache (for example, the cache may have a response with missing preloaded data). This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to…

    Published 4 Feb 2025 · Fixed in 3.3.2 · NVD
  26. Medium 5.4

    CVE-2024-13403 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 3 Feb 2025 · Fixed in 1.9.3.2 · NVD, WPVulnerability
  27. High 8.8

    CVE-2024-1211 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instances configured to use JWT as an OmniAuth provider.

    Published 31 Jan 2025 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  28. Medium 4.3

    CVE-2023-6195 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. GitLab was vulnerable to Server Side Request Forgery when an attacker uses a malicious URL in the markdown image value when importing a GitHub repository.

    Published 31 Jan 2025 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  29. Medium 6.5

    CVE-2024-8494 · Elementor

    The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.25.10 via the 'elementor-template' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the content of Private, Pending, and Draft Templates. The vulnerability was…

    Published 30 Jan 2025 · Fixed in 3.25.11 · NVD
  30. Medium 4.3

    CVE-2025-0290 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 prior to 17.5.5, from 17.6 prior to 17.6.3, and from 17.7 prior to 17.7.1. Under certain conditions, processing of CI artifacts metadata could cause background jobs to become unresponsive.

    Published 28 Jan 2025 · Fixed in 17.5.5, 17.6.3 · NVD
  31. High 8.5

    CVE-2025-22605 · Coolify

    OS Command Injection Vulnerability in SSH Command Generation

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.253 · NVD, Project advisories (GitHub)
  32. High 8.5

    CVE-2025-22606 · Coolify

    Command Injection in Project Name

    Published 24 Jan 2025 · NVD, Project advisories (GitHub)
  33. Critical 10.0

    CVE-2025-22612 · Coolify

    Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE)

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.374, 4.0.0 · NVD, Project advisories (GitHub)
  34. Critical 9.9

    CVE-2025-22611 · Coolify

    Privilege Escalation resulting in Remote Command Execution (RCE)

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.361, 4.0.0 · NVD, Project advisories (GitHub)
  35. Critical 10.0

    CVE-2025-22609 · Coolify

    Private Key Hijacking / Remote Command Execution (RCE)

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.361, 4.0.0 · NVD, Project advisories (GitHub)
  36. Medium 5.7

    CVE-2025-22610 · Coolify

    OAuth Secrets Leak

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.361, 4.0.0 · NVD, Project advisories (GitHub)
  37. Medium 6.5

    CVE-2025-22608 · Coolify

    Revoke Arbitrary Team Invitations (DOS)

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.361, 4.0.0 · NVD, Project advisories (GitHub)
  38. Medium 4.7

    CVE-2025-22607 · Coolify

    GitHub / GitLab OAuth Secrets Leak

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.361, 4.0.0 · NVD, Project advisories (GitHub)
  39. Low 1.3

    CVE-2025-24025 · Coolify

    Reflected XSS on Tag Search

    Published 24 Jan 2025 · Fixed in 4.0.0-beta.361, 4.0.0 · NVD, Project advisories (GitHub)
  40. Medium 6.1

    CVE-2025-0314 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of certain file types lead to cross-site scripting.

    Published 24 Jan 2025 · Fixed in 17.6.4, 17.7.3 · NVD
  41. Medium 5.3

    CVE-2024-11931 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.6.4, from 17.7 prior to 17.7.3, and from 17.8 prior to 17.8.1. Under certain conditions, it may have been possible for users with developer role to exfiltrate protected CI variables via CI lint.

    Published 24 Jan 2025 · Fixed in 17.6.4, 17.7.3 · NVD
  42. Medium 4.3

    CVE-2025-21567 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL…

    Published 21 Jan 2025 · NVD
  43. Medium 6.5

    CVE-2025-21566 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 21 Jan 2025 · NVD
  44. Medium 5.5

    CVE-2025-21559 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 21 Jan 2025 · NVD
  45. Medium 5.5

    CVE-2025-21555 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 21 Jan 2025 · NVD
  46. Low 3.8

    CVE-2025-21546 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in…

    Published 21 Jan 2025 · NVD
  47. Medium 4.9

    CVE-2025-21543 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…

    Published 21 Jan 2025 · NVD
  48. Medium 5.4

    CVE-2025-21540 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in…

    Published 21 Jan 2025 · NVD
  49. Medium 4.9

    CVE-2025-21536 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…

    Published 21 Jan 2025 · NVD
  50. Medium 4.9

    CVE-2025-21534 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Performance Schema). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 21 Jan 2025 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.