UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,174
Published in 7 days
1,171
Critical in 30 days
351
Actively exploited
423

Latest vulnerabilities

40,174 vulnerabilities
  1. Unrated

    WPV-3b859375772f · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Fixed in 0.9.5 · WPVulnerability
  2. Unrated

    WPV-38f6e4067ff1 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Fixed in 3.7.1 · WPVulnerability
  3. Unrated

    WPV-37e21893252a · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Fixed in 1.7.5.5 · WPVulnerability
  4. Unrated

    WPV-353a377dfb48 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Fixed in 1.4.8.1 · WPVulnerability
  5. Unrated

    WPV-30d3487383b3 · WooCommerce

    Vulnerability in WooCommerce

    Fixed in 4.6.2 · WPVulnerability
  6. Unrated

    WPV-3076f787ede8 · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Fixed in 3.8.7 · WPVulnerability
  7. Unrated

    WPV-303dbee21964 · Yith Woocommerce Catalog Mode (WordPress plugin)

    Vulnerability in YITH WooCommerce Catalog Mode

    Fixed in 2.16.1 · WPVulnerability
  8. Unrated

    WPV-2fc5871059fb · Wordfence Security

    Vulnerability in Wordfence Security – Firewall, Malware Scan, and Login Security

    Fixed in 7.1.14 · WPVulnerability
  9. Unrated

    WPV-2ccdc7979730 · Redirection (WordPress plugin)

    Vulnerability in Redirection

    Fixed in 2.3.4 · WPVulnerability
  10. Unrated

    WPV-29a474d946c0 · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Fixed in 1.16.59 · WPVulnerability
  11. Unrated

    WPV-2878efe2a992 · WooCommerce

    Vulnerability in WooCommerce

    Fixed in 7.9 · WPVulnerability
  12. Unrated

    WPV-21f05b2f3f69 · WooCommerce

    Vulnerability in WooCommerce

    Fixed in 2.2.3 · WPVulnerability
  13. Unrated

    WPV-2008f93edab4 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    WPVulnerability
  14. Unrated

    WPV-1e4a734315a4 · Redirection (WordPress plugin)

    Vulnerability in Redirection

    Fixed in 3.6.3 · WPVulnerability
  15. Unrated

    WPV-1c266cf6e413 · Woo Discount Rules (WordPress plugin)

    Vulnerability in Discount Rules for WooCommerce

    Fixed in 2.1.0 · WPVulnerability
  16. Unrated

    WPV-154012b1e9ff · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Fixed in 2.1.6 · WPVulnerability
  17. Unrated

    WPV-11f1f444682d · WooCommerce

    Vulnerability in WooCommerce

    Fixed in 2.4.9 · WPVulnerability
  18. Unrated

    WPV-0f97e81e3326 · All in One SEO

    Vulnerability in All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    Fixed in 2.10 · WPVulnerability
  19. Unrated

    WPV-0e896cba6b5d · Redirection (WordPress plugin)

    Vulnerability in Redirection

    Fixed in 2.8 · WPVulnerability
  20. Unrated

    WPV-0d687c278bed · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Fixed in 0.9.5 · WPVulnerability
  21. Unrated

    WPV-0c8ac642a82f · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Fixed in 3.5.3 · WPVulnerability
  22. Unrated

    WPV-0a4c7732740c · WooCommerce

    Vulnerability in WooCommerce

    Fixed in 2.3.11 · WPVulnerability
  23. Unrated

    WPV-08c341d4c1a5 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Fixed in 3.3.0 · WPVulnerability
  24. Unrated

    WPV-0189d255e39e · WooCommerce

    Vulnerability in WooCommerce

    Fixed in 3.4.6 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.