UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
9,659
Published in 7 days
218
Critical in 30 days
33
Actively exploited
47

Latest vulnerabilities

9,659 vulnerabilities
  1. Medium 4.2

    CVE-2026-5954 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to download package files from a public project due to improper authorization checks.

    Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD
  2. High 8.5

    CVE-2026-16301 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.

    Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD
  3. Medium 5.3

    CVE-2026-16275 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks.

    Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD
  4. High 8.2

    CVE-2026-14814 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper…

    Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD
  5. Medium 4.3

    CVE-2026-14552 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Guest access to read confidential epic content meant to be restricted by external authorization, due to incorrect authorization checks.

    Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD
  6. Medium 4.3

    CVE-2026-14210 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a project-scoped fine-grained Personal Access Token to permanently delete or modify group-level labels, due to incorrect authorization logic on label ownership scope validation.

    Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD
  7. Medium 4.3

    CVE-2026-105458 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a specific granular permission to obtain a GitLab Duo Agent Platform token that bypasses governance controls, due to reliance on untrusted input in a security decision.

    Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD
  8. Medium 4.3

    CVE-2026-104661 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with compliance framework administration permissions to configure and execute a specially crafted compliance pipeline across group projects due to improper privilege…

    Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD
  9. Low 2.7

    CVE-2026-103549 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certain package registry metadata that package protection rules restrict to higher roles, due to improper authorization checks.

    Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD
  10. Medium 6.2

    CVE-2026-101168 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events.

    Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD
  11. Medium 4.6

    CVE-2026-100755 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have allowed an authenticated user to poison cached page content served to other users due to improper cache key construction.

    Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD
  12. Low 3.5

    CVE-2026-100104 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a time-of-check to time-of-use race condition in URL validation during repository import operations.

    Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD
  13. Unrated

    CVE-2026-107321 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Path Traversal

    Published 10 Oct 2026 · Fixed in 2.10.6 · WPVulnerability
  14. High 7.2

    CVE-2026-106608 · WooCommerce

    Vulnerability in WooCommerce

    Published 10 Oct 2026 · Fixed in 11.2.0 · WPVulnerability
  15. Unrated

    CVE-2026-104754 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 10 Oct 2026 · Fixed in 1.0.280 · WPVulnerability
  16. Unrated

    CVE-2026-104753 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: SQL Injection

    Published 10 Oct 2026 · Fixed in 1.0.280 · WPVulnerability
  17. Unrated

    CVE-2026-104752 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Unrestricted Upload of File with Dangerous Type

    Published 10 Oct 2026 · Fixed in 1.0.280 · WPVulnerability
  18. High 7.2

    CVE-2026-107823 · MariaDB

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part…

    Published 9 Oct 2026 · Fixed in 11.8.9, 12.3.3, 13.0.2 · NVD
  19. Medium 6.4

    CVE-2026-107822 · MariaDB

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's…

    Published 9 Oct 2026 · Fixed in 11.8.9, 12.3.3, 13.0.2 · NVD
  20. High 8.0

    CVE-2026-107821 · MariaDB

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or…

    Published 9 Oct 2026 · Fixed in 11.8.9, 12.3.3, 13.0.2 · NVD
  21. High 8.4

    CVE-2026-107818 · MariaDB

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled…

    Published 9 Oct 2026 · Fixed in 11.8.9, 12.3.3, 13.0.2 · NVD
  22. Medium 4.4

    CVE-2026-107817 · MariaDB

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in…

    Published 9 Oct 2026 · Fixed in 11.8.9, 12.3.3, 13.0.2 · NVD
  23. Medium 6.4

    CVE-2026-107816 · MariaDB

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or…

    Published 9 Oct 2026 · Fixed in 11.8.9, 12.3.3, 13.0.2 · NVD
  24. High 8.5

    CVE-2026-107815 · MariaDB

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code…

    Published 9 Oct 2026 · Fixed in 11.8.9, 12.3.3, 13.0.2 · NVD
  25. High 8.4

    CVE-2026-107814 · MariaDB

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an…

    Published 9 Oct 2026 · Fixed in 11.8.9, 12.3.3, 13.0.2 · NVD
  26. High 7.5

    CVE-2026-97076 · WP Rocket (WordPress plugin)

    Vulnerability in WP Rocket

    Published 9 Oct 2026 · Fixed in 3.23.5 · WPVulnerability
  27. Medium 6.5

    CVE-2026-97075 · WP Rocket (WordPress plugin)

    Vulnerability in WP Rocket

    Published 9 Oct 2026 · Fixed in 3.23.5 · WPVulnerability
  28. Medium 4.8

    CVE-2026-106602 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 9 Oct 2026 · Fixed in 16.3 · WPVulnerability
  29. Medium 5.4

    CVE-2026-106601 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 9 Oct 2026 · Fixed in 16.3 · WPVulnerability
  30. Medium 4.2

    CVE-2026-94544 · Next.js

    Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

    Published 7 Oct 2026 · Fixed in 16.3.8 · OSV.dev and GitHub
  31. Medium 5.3

    CVE-2026-94543 · Next.js

    Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

    Published 7 Oct 2026 · Fixed in 15.5.27, 16.3.8 · OSV.dev and GitHub
  32. Low 5.4

    CVE-2026-94486 · Next.js

    Next.js has information disclosure in development server's Model Context Protocol endpoint

    Published 7 Oct 2026 · Fixed in 16.3.8 · OSV.dev and GitHub
  33. Medium 5.3

    CVE-2026-94485 · Next.js

    Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

    Published 7 Oct 2026 · Fixed in 16.3.8 · OSV.dev and GitHub
  34. Medium 4.8

    CVE-2026-94484 · Next.js

    Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

    Published 7 Oct 2026 · Fixed in 15.5.27, 16.3.8 · OSV.dev and GitHub
  35. High 6.5

    CVE-2026-94483 · Next.js

    Next.js has Server-Side Request Forgery in Image Optimization

    Published 7 Oct 2026 · Fixed in 16.3.8 · OSV.dev and GitHub
  36. High 7.8

    CVE-2026-106583 · OpenSSH

    In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.

    Published 7 Oct 2026 · Fixed in 10.6 · NVD
  37. Low 3.3

    CVE-2026-106587 · OpenSSH

    In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.

    Published 6 Oct 2026 · Fixed in 10.6 · NVD
  38. Medium 4.3

    CVE-2026-106586 · OpenSSH

    In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.

    Published 6 Oct 2026 · Fixed in 10.6 · NVD
  39. Medium 6.5

    CVE-2026-106585 · OpenSSH

    In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.

    Published 6 Oct 2026 · Fixed in 10.6 · NVD
  40. Low 3.3

    CVE-2026-106584 · OpenSSH

    In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.

    Published 6 Oct 2026 · Fixed in 10.6 · NVD
  41. Low 3.7

    CVE-2026-106582 · OpenSSH

    In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.

    Published 6 Oct 2026 · Fixed in 10.6 · NVD
  42. High 7.5

    CVE-2026-106555 · OpenSSH

    In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.

    Published 6 Oct 2026 · Fixed in 10.6 · NVD
  43. High 7.5

    CVE-2026-106553 · OpenSSH

    In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.

    Published 6 Oct 2026 · Fixed in 10.6 · NVD
  44. Medium 6.5

    CVE-2026-106552 · OpenSSH

    In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.

    Published 6 Oct 2026 · Fixed in 10.6 · NVD
  45. High 7.1

    CVE-2026-103009 · Elasticsearch

    Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization…

    Published 6 Oct 2026 · Fixed in 8.19.23, 9.4.8, 9.5.5 · NVD
  46. Medium 6.5

    CVE-2026-103008 · Elasticsearch

    Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds and serializes geometry values produced by scripted runtime fields. Unlike geometry supplied as…

    Published 6 Oct 2026 · Fixed in 8.19.23, 9.4.8, 9.5.5 · NVD
  47. High 7.2

    CVE-2026-103007 · Elasticsearch

    Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific…

    Published 6 Oct 2026 · Fixed in 8.19.22, 9.4.7, 9.5.4 · NVD
  48. Medium 6.5

    CVE-2026-103006 · Elasticsearch

    Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a specially crafted request containing deeply…

    Published 6 Oct 2026 · Fixed in 8.19.21, 9.4.6, 9.5.2 · NVD
  49. Medium 6.5

    CVE-2026-103005 · Elasticsearch

    Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large `description` field are created and subsequently accessed, exhausting available…

    Published 6 Oct 2026 · Fixed in 8.19.23, 9.4.8, 9.5.5 · NVD
  50. Medium 6.5

    CVE-2026-102411 · Elasticsearch

    Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved together. A user holding the *manage_index_templates*…

    Published 6 Oct 2026 · Fixed in 8.19.23, 9.4.7, 9.5.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.