Vulnerability database · updated every hour
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 11,047
- Published in 7 days
- 172
- Critical in 30 days
- 40
- Actively exploited
- 62
Latest vulnerabilities
11,047 vulnerabilities- Medium 4.9
CVE-2025-21531 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…
Published 21 Jan 2025 · NVD - Medium 4.9
CVE-2025-21529 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…
Published 21 Jan 2025 · NVD - Medium 4.9
CVE-2025-21525 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…
Published 21 Jan 2025 · NVD - Medium 4.9
CVE-2025-21523 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…
Published 21 Jan 2025 · NVD - Medium 6.5
CVE-2025-21522 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…
Published 21 Jan 2025 · NVD - High 7.5
CVE-2025-21521 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…
Published 21 Jan 2025 · NVD - Low 1.8
CVE-2025-21520 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person…
Published 21 Jan 2025 · NVD - Medium 4.4
CVE-2025-21519 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in…
Published 21 Jan 2025 · NVD - Medium 6.5
CVE-2025-21518 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…
Published 21 Jan 2025 · NVD - Medium 4.9
CVE-2025-21505 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in…
Published 21 Jan 2025 · NVD - Medium 4.9
CVE-2025-21504 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…
Published 21 Jan 2025 · NVD - Medium 4.9
CVE-2025-21503 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…
Published 21 Jan 2025 · NVD - Medium 4.8
CVE-2025-21502 · Java
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM Enterprise Edition: 20.3.16 and 21.3.12. Difficult to exploit vulnerability allows…
Published 21 Jan 2025 · NVD - Medium 6.5
CVE-2025-21501 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…
Published 21 Jan 2025 · NVD - Medium 6.5
CVE-2025-21500 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…
Published 21 Jan 2025 · NVD - Medium 4.9
CVE-2025-21499 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…
Published 21 Jan 2025 · NVD - Medium 5.5
CVE-2025-21497 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…
Published 21 Jan 2025 · NVD - Medium 4.1
CVE-2025-21494 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can…
Published 21 Jan 2025 · NVD - Medium 4.4
CVE-2025-21493 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…
Published 21 Jan 2025 · NVD - Medium 4.9
CVE-2025-21492 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…
Published 21 Jan 2025 · NVD - Medium 4.9
CVE-2025-21491 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…
Published 21 Jan 2025 · NVD - Medium 4.9
CVE-2025-21490 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…
Published 21 Jan 2025 · NVD - High 7.5
CVE-2024-43709 · Elasticsearch
An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.
Published 21 Jan 2025 · Fixed in 7.17.21, 8.13.3 · NVD - Medium
CVE-2025-23085 · Node.js
GOAWAY HTTP/2 frames cause memory leak outside heap
Published 21 Jan 2025 · Fixed in 20.18.2, 22.13.1, 23.6.1 · nodejs - Medium 5.5
CVE-2025-23084 · Node.js
Path traversal by drive name in Windows environment
Published 21 Jan 2025 · Fixed in 20.18.2, 22.13.1, 23.6.1 · NVD, nodejs - High
CVE-2025-23083 · Node.js
Worker permission bypass via InternalWorker leak in diagnostics
Published 21 Jan 2025 · Fixed in 20.18.2, 22.13.1, 23.6.1 · nodejs - High 7.5
CVE-2024-13333 · File Manager Advanced (WordPress plugin)
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Unrestricted Upload of File with Dangerous Type
Published 16 Jan 2025 · Fixed in 5.2.14 · WPVulnerability - Medium 6.1
CVE-2025-0215 · UpdraftPlus
UpdraftPlus: WP Backup & Migration Plugin: Cross-site Scripting
Published 15 Jan 2025 · Fixed in 1.25.1 · WPVulnerability - High 8.8
CVE-2025-21176 · .NET
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
Published 14 Jan 2025 · NVD - High 7.3
CVE-2025-21173 · .NET
.NET Elevation of Privilege Vulnerability
Published 14 Jan 2025 · NVD - High 7.5
CVE-2025-21172 · .NET
.NET and Visual Studio Remote Code Execution Vulnerability
Published 14 Jan 2025 · NVD - High 7.5
CVE-2025-21171 · .NET
.NET Remote Code Execution Vulnerability
Published 14 Jan 2025 · NVD - High 8.5
CVE-2024-12365 · W3 Total Cache (WordPress plugin)
W3 Total Cache: Missing Authorization
Published 13 Jan 2025 · Fixed in 2.8.2 · WPVulnerability - Medium 5.3
CVE-2024-12008 · W3 Total Cache (WordPress plugin)
W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor
Published 13 Jan 2025 · Fixed in 2.8.2 · WPVulnerability - Medium 5.3
CVE-2024-12006 · W3 Total Cache (WordPress plugin)
W3 Total Cache: Missing Authorization
Published 13 Jan 2025 · Fixed in 2.8.2 · WPVulnerability - Medium 5.4
CVE-2024-13041 · GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. As a result, the user may not be marked as external thereby giving those users access to internal…
Published 9 Jan 2025 · Fixed in 17.5.5, 17.6.3, 17.7.1 · NVD - Medium 4.3
CVE-2024-6324 · GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. It was possible to trigger a DoS by creating cyclic references between epics.
Published 9 Jan 2025 · Fixed in 17.5.5, 17.6.3, 17.7.1 · NVD - Medium 4.3
CVE-2024-12431 · GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 15.5 before 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1, in which unauthorized users could manipulate the status of issues in public projects.
Published 8 Jan 2025 · Fixed in 17.5.5, 17.6.3, 17.7.1 · NVD - Medium 6.5
CVE-2025-0194 · GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner.
Published 8 Jan 2025 · Fixed in 17.5.5, 17.6.3, 17.7.1 · NVD - High 7.5
CVE-2024-40749 · Joomla!
Improper Access Controls allows access to protected views.
Published 7 Jan 2025 · Fixed in 3.10.20, 4.4.10, 5.2.3 · NVD - High 7.5
CVE-2024-40748 · Joomla!
Lack of output escaping in the id attribute of menu lists.
Published 7 Jan 2025 · Fixed in 3.10.20, 4.4.10, 5.2.3 · NVD - Medium 6.1
CVE-2024-40747 · Joomla!
Various module chromes didn't properly process inputs, leading to XSS vectors.
Published 7 Jan 2025 · Fixed in 4.4.10, 5.2.3 · NVD - Medium 4.4
CVE-2024-51741 · Redis
Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2.
Published 6 Jan 2025 · Fixed in 7.2.7, 7.4.2 · NVD - Critical 9.8
CVE-2024-46981 · Redis
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua…
Published 6 Jan 2025 · Fixed in 6.2.17, 7.2.7, 7.4.2 · NVD - Medium 5.3
CVE-2024-56332 · Next.js
Next.js Allows a Denial of Service (DoS) with Server Actions
Published 3 Jan 2025 · Fixed in 13.5.8, 14.2.21, 15.1.2 · OSV.dev and GitHub - High 8.8
CVE-2024-56276 · WPForms, WPForms Lite
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Missing Authorization
Published 3 Jan 2025 · Fixed in 1.9.2.3 · NVD, WPVulnerability - High 8.8
CVE-2024-10957 · UpdraftPlus
UpdraftPlus: WP Backup & Migration Plugin: Deserialization of Untrusted Data
Published 3 Jan 2025 · Fixed in 1.24.12 · WPVulnerability - Low 3.7
CVE-2023-5117 · GitLab
An issue was discovered in GitLab CE/EE affecting all versions before 17.6.0 in which users were unaware that files uploaded to comments on confidential issues and epics of public projects could be accessed without authentication via a direct link to the uploaded file URL.
Published 25 Dec 2024 · Fixed in 17.6.0 · NVD - Critical 9.8
CVE-2024-56337 · Apache Tomcat
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for…
Published 20 Dec 2024 · Fixed in 9.0.98, 10.1.34, 11.0.2 · NVD - Medium 6.5
CVE-2024-51915 · LiteSpeed Cache
LiteSpeed Cache: Cross-site Scripting
Published 20 Dec 2024 · Fixed in 6.5.3 · WPVulnerability
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.