Vulnerability database · updated every hour
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 9,661
- Published in 7 days
- 220
- Critical in 30 days
- 35
- Actively exploited
- 47
Latest vulnerabilities
9,661 vulnerabilities- Medium 6.5
CVE-2026-103005 · Elasticsearch
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large `description` field are created and subsequently accessed, exhausting available…
Published 6 Oct 2026 · Fixed in 8.19.23, 9.4.8, 9.5.5 · NVD - Medium 6.5
CVE-2026-102411 · Elasticsearch
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved together. A user holding the *manage_index_templates*…
Published 6 Oct 2026 · Fixed in 8.19.23, 9.4.7, 9.5.3 · NVD - Medium 6.5
CVE-2026-102409 · Elasticsearch
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
Published 6 Oct 2026 · Fixed in 9.4.8, 9.5.5 · NVD - Medium 4.3
CVE-2026-102408 · Elasticsearch
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated…
Published 6 Oct 2026 · Fixed in 8.19.22, 9.4.8, 9.5.5 · NVD - Medium 5.4
CVE-2026-102407 · Elasticsearch
Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or…
Published 6 Oct 2026 · Fixed in 8.19.19, 9.3.8, 9.4.4 · NVD - Medium 6.5
CVE-2026-102404 · Elasticsearch
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memory condition that terminates the Elasticsearch node. The condition can be triggered repeatedly,…
Published 6 Oct 2026 · Fixed in 8.19.23, 9.4.8, 9.5.5 · NVD - High
GHSA-wq5f-xc86-pv6w · sharp
sharp : Vulnerability in librsvg dependency CVE-2026-96889
Published 6 Oct 2026 · Fixed in 0.35.5 · OSV.dev and GitHub - Critical 9.3Actively exploited
CVE-2026-21589 · Confluence
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior…
Published 5 Oct 2026 · Fixed in 9.2.26, 10.2.19 · NVD - Unrated
CVE-2026-94239 · Loco Translate (WordPress plugin)
Loco Translate: Cross-site Scripting
Published 3 Oct 2026 · Fixed in 2.8.9 · WPVulnerability - Unrated
CVE-2026-94238 · Loco Translate (WordPress plugin)
Loco Translate: Path Traversal
Published 3 Oct 2026 · Fixed in 2.8.9 · WPVulnerability - Medium 6.5
CVE-2026-19856 · All in One SEO
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Injection
Published 2 Oct 2026 · Fixed in 5.0.2.1 · WPVulnerability - High 8.8
CVE-2026-93546 · Apache HTTP Server
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - Medium 5.3
CVE-2026-79768 · Apache HTTP Server
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - High 7.3
CVE-2026-73637 · Apache HTTP Server
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - High 8.1
CVE-2026-73636 · Apache HTTP Server
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to…
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - High 7.5
CVE-2026-63718 · Apache HTTP Server
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - High 7.5
CVE-2026-63686 · Apache HTTP Server
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - High 7.5
CVE-2026-63292 · Apache HTTP Server
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default. Users…
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - High 7.5
CVE-2026-63045 · Apache HTTP Server
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - Critical 9.8
CVE-2026-59797 · Apache HTTP Server
Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - High 7.5
CVE-2026-59685 · Apache HTTP Server
Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - Medium 5.3
CVE-2026-58415 · Apache HTTP Server
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - Critical 9.8
CVE-2026-57941 · Apache HTTP Server
Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - High 7.5
CVE-2026-56449 · Apache HTTP Server
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - Critical 9.8
CVE-2026-56154 · Apache HTTP Server
Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - High 7.5
CVE-2026-56153 · Apache HTTP Server
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - High 7.5
CVE-2026-48005 · Apache HTTP Server
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck . Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - High 7.5
CVE-2026-47360 · Apache HTTP Server
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - High 7.5
CVE-2026-46729 · Apache HTTP Server
NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - Medium 4.3
CVE-2026-42528 · Apache HTTP Server
A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - Low 3.7
CVE-2026-42356 · Apache HTTP Server
Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime. This issue affects Apache HTTP Server: from 2.4.60 through 2.4.68.
Published 1 Oct 2026 · Fixed in 2.4.69 · NVD - Medium 6.5
CVE-2026-100152 · All in One SEO
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Code Injection
Published 1 Oct 2026 · Fixed in 5.0.2.1 · WPVulnerability - Critical
GHSA-vcvr-r3jv-pc5j · Next.js
Next.js: Remote Code Execution in next/og ImageResponse
Published 30 Sept 2026 · Fixed in 16.3.6 · OSV.dev and GitHub - High 7.1
CVE-2026-92232 · Joomla!
Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - High 7.1
CVE-2026-92231 · Joomla!
Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing it against the "javascript:" scheme regex, however without decoding HTML5 entities beforehand, causing an XSS vector.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - High 8.2
CVE-2026-92227 · Joomla!
Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an rememberme cookie leads to a MFA bypass vulnerability.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - High 7.0
CVE-2026-92226 · Joomla!
Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - Medium 5.9
CVE-2026-92225 · Joomla!
Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied values, leading to an XSS vector.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - Medium 5.9
CVE-2026-92224 · Joomla!
Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - Medium 5.1
CVE-2026-92223 · Joomla!
Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to update the workflow stage of inaccessible contents.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - High 8.9
CVE-2026-92222 · Joomla!
Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - URLs used for serverside requests were improperly validated, leading to SSRF vectors.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - Medium 6.9
CVE-2026-90918 · Joomla!
Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - Medium 6.9
CVE-2026-90917 · Joomla!
Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view content items from inaccessible categories.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - Medium 5.1
CVE-2026-90916 · Joomla!
Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - High 7.0
CVE-2026-90915 · Joomla!
Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - Medium 5.9
CVE-2026-90914 · Joomla!
Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - High 7.0
CVE-2026-90913 · Joomla!
Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform mutation actions in access level endpoints.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - Medium 6.9
CVE-2026-90907 · Joomla!
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - Medium 5.9
CVE-2026-90906 · Joomla!
Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper.
Published 29 Sept 2026 · Fixed in 5.4.8, 6.1.3 · NVD - High 7.5
CVE-2026-84784 · OpenSSL
Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also…
Published 29 Sept 2026 · Fixed in 3.5.9, 3.6.5, 4.0.3 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.