UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
9,661
Published in 7 days
215
Critical in 30 days
35
Actively exploited
47

Latest vulnerabilities

9,661 vulnerabilities
  1. High 7.5

    CVE-2026-84783 · OpenSSL

    Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server that requests client certificates, if the first certificate chains built to the same trusted CA…

    Published 29 Sept 2026 · Fixed in 4.0.3 · NVD
  2. High 8.2

    CVE-2026-84782 · OpenSSL

    Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly. Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake…

    Published 29 Sept 2026 · Fixed in 3.5.9, 3.6.5, 4.0.3 · NVD
  3. Low 3.7

    CVE-2026-77696 · OpenSSL

    Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing…

    Published 29 Sept 2026 · Fixed in 3.5.9, 3.6.5, 4.0.3 · NVD
  4. Medium 5.3

    CVE-2026-75806 · OpenSSL

    Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key…

    Published 29 Sept 2026 · Fixed in 3.5.9, 3.6.5, 4.0.3 · NVD
  5. Medium 5.3

    CVE-2026-75805 · OpenSSL

    Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A…

    Published 29 Sept 2026 · Fixed in 3.5.9, 3.6.5, 4.0.3 · NVD
  6. Medium 5.3

    CVE-2026-75804 · OpenSSL

    Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size). CWE:…

    Published 29 Sept 2026 · Fixed in 3.5.9, 3.6.5, 4.0.3 · NVD
  7. High 7.5

    CVE-2026-72897 · OpenSSL

    Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. Applications which never call SSL_set_SSL_CTX() are not affected. Impact summary: A…

    Published 29 Sept 2026 · Fixed in 3.5.9, 3.6.5, 4.0.3 · NVD
  8. Low 3.7

    CVE-2026-54875 · OpenSSL

    Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption on an affected platform can learn information about the secret scalar. CWE: CWE-208: Observable…

    Published 29 Sept 2026 · Fixed in 3.5.9, 3.6.5, 4.0.3 · NVD
  9. High 7.5

    CVE-2026-54873 · OpenSSL

    Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory remains allocated is entirely under the control of the potentially malicious remote…

    Published 29 Sept 2026 · Fixed in 3.5.9, 3.6.5, 4.0.3 · NVD
  10. Low 3.7

    CVE-2026-54872 · OpenSSL

    Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden…

    Published 29 Sept 2026 · Fixed in 3.5.9, 3.6.5, 4.0.3 · NVD
  11. Medium 5.3

    CVE-2026-42772 · OpenSSL

    Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial…

    Published 29 Sept 2026 · Fixed in 3.5.9, 3.6.5, 4.0.3 · NVD
  12. Low 3.7

    CVE-2026-35191 · OpenSSL

    Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC…

    Published 29 Sept 2026 · Fixed in 3.5.9, 3.6.5, 4.0.3 · NVD
  13. Medium 5.3

    CVE-2026-35189 · OpenSSL

    Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources…

    Published 29 Sept 2026 · Fixed in 3.5.9, 3.6.5, 4.0.3 · NVD
  14. Medium 4.3

    CVE-2026-8937 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to read private child issue contents, including titles and descriptions, from projects they had no access to, due to missing authorization checks on linked work items within visible epics.

    Published 29 Sept 2026 · Fixed in 19.2.7, 19.3.3 · NVD
  15. High 8.7

    CVE-2026-84739 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to improper sanitization of path components in the merge request diff viewer.

    Published 29 Sept 2026 · Fixed in 19.2.7, 19.3.3 · NVD
  16. Low 3.7

    CVE-2026-4523 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper authorization enforcement in the GraphQL API.

    Published 29 Sept 2026 · Fixed in 19.2.7, 19.3.3 · NVD
  17. Medium 4.3

    CVE-2026-10518 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authorized to access due to improper authorization enforcement.

    Published 29 Sept 2026 · Fixed in 19.2.7, 19.3.3 · NVD
  18. Medium 4.9

    CVE-2026-94408 · Elasticsearch

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

    Published 26 Sept 2026 · Fixed in 8.19.22, 9.4.7, 9.5.3 · NVD
  19. Medium 6.5

    CVE-2026-94399 · Elasticsearch

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

    Published 26 Sept 2026 · Fixed in 8.19.22, 9.4.7, 9.5.4 · NVD
  20. Medium 6.5

    CVE-2026-94398 · Elasticsearch

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

    Published 26 Sept 2026 · Fixed in 8.19.22, 9.4.7, 9.5.4 · NVD
  21. Medium 6.5

    CVE-2026-94397 · Elasticsearch

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

    Published 26 Sept 2026 · Fixed in 8.19.22, 9.4.7, 9.5.4 · NVD
  22. Medium 6.5

    CVE-2026-94396 · Elasticsearch

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

    Published 26 Sept 2026 · Fixed in 9.4.7, 9.5.4 · NVD
  23. Medium 6.5

    CVE-2026-82300 · Elasticsearch

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).

    Published 26 Sept 2026 · Fixed in 8.19.22, 9.4.7, 9.5.4 · NVD
  24. Medium 6.5

    CVE-2026-82294 · Elasticsearch

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).

    Published 26 Sept 2026 · Fixed in 8.19.21, 9.4.6, 9.5.3 · NVD
  25. Medium 4.3

    CVE-2026-11905 · Elementor

    Elementor Website Builder – more than just a page builder: Missing Authorization

    Published 25 Sept 2026 · Fixed in 4.2.4 · CVE Program, WPVulnerability
  26. Critical 9.9

    CVE-2026-93577 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.

    Published 24 Sept 2026 · Fixed in 19.2.7, 19.3.3 · NVD
  27. Medium 5.4

    CVE-2026-92874 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with an MCP-scoped token to perform actions beyond the intended scope of that token due to improper authorization checks.

    Published 24 Sept 2026 · Fixed in 19.2.7, 19.3.3 · NVD
  28. Low 3.1

    CVE-2026-92628 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context.

    Published 24 Sept 2026 · Fixed in 19.2.7, 19.3.3 · NVD
  29. Medium 4.3

    CVE-2026-92530 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on the target instance due to improper reliance on ephemeral cache state during Direct Transfer imports.

    Published 24 Sept 2026 · Fixed in 19.2.7, 19.3.3 · NVD
  30. Medium 4.3

    CVE-2026-92529 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls for workflows in namespaces they do not control due to improper authorization checks.

    Published 24 Sept 2026 · Fixed in 19.2.7, 19.3.3 · NVD
  31. High 7.7

    CVE-2026-92470 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks.

    Published 24 Sept 2026 · Fixed in 19.2.7, 19.3.3 · NVD
  32. Critical 9.9

    CVE-2026-89078 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.

    Published 24 Sept 2026 · Fixed in 19.2.7, 19.3.3 · NVD
  33. Medium 6.5

    CVE-2026-84744 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Code Injection

    Published 24 Sept 2026 · Fixed in 2.0.2.1 · WPVulnerability
  34. Unrated

    CVE-2026-74991 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Improper Access Control

    Published 24 Sept 2026 · Fixed in 2.0.2 · WPVulnerability
  35. Medium 4.7

    CVE-2026-101921 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 24 Sept 2026 · Fixed in 2.0.2.2 · WPVulnerability
  36. High 8.1Actively exploited

    CVE-2026-87902 · WordPress

    Unauthenticated path traversal in page-template resolution leading to conditional RCE

    Published 22 Sept 2026 · Fixed in 6.9.9, 7.0.6, 7.1.2 · NVD, WordPress
  37. Unrated

    CVE-2026-92403 · Secure Custom Fields (WordPress plugin)

    Secure Custom Fields: Incorrect Authorization

    Published 19 Sept 2026 · Fixed in 6.9.4 · WPVulnerability
  38. High 7.5

    CVE-2026-93687 · braces

    braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

    Published 18 Sept 2026 · OSV.dev and GitHub
  39. Low 1.8

    GHSA-rmpv-w5v9-rqh5 · WordPress

    HTML API: `set_modifiable_text()` allows breaking out of a comment via abrupt-closing sequences

    Published 18 Sept 2026 · Fixed in 6.8.9, 6.9.8, 7.0.5 · WordPress
  40. Medium 5.3

    GHSA-76jg-r2qr-v77f · WordPress

    Site Administrator can network-activate an installed Network-only plugin

    Published 18 Sept 2026 · Fixed in 6.8.9, 6.9.8, 7.0.5 · WordPress
  41. Medium 5.3

    GHSA-5qf7-2r5p-ppj8 · WordPress

    Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org

    Published 18 Sept 2026 · Fixed in 6.8.9, 6.9.8, 7.0.5 · WordPress
  42. Low

    GHSA-mgvw-845h-9qgq · WordPress

    A theme that supports custom-header and does not register an admin-preview-callback is vulnerable to stored XSS

    Published 18 Sept 2026 · Fixed in 6.8.9, 6.9.8, 7.0.5 · WordPress
  43. Medium

    GHSA-xhp5-863h-rhfr · WordPress

    XML-RPC can be used to publish `customize_changeset` posts that bypass checks for `edit_css`

    Published 18 Sept 2026 · Fixed in 6.9.8, 7.0.5, 7.1.1 · WordPress
  44. Medium 4.3

    GHSA-w57f-v787-qhpf · WordPress

    Authenticated Path Traversal in WP REST Templates Controller

    Published 18 Sept 2026 · Fixed in 6.9.8, 7.0.5, 7.1.1 · WordPress
  45. High

    GHSA-qg7r-fjh2-wvx8 · WordPress

    Stored cross-site scripting in `wpautop()` allows an unauthenticated visitor to inject script

    Published 18 Sept 2026 · Fixed in 6.9.8, 7.0.5, 7.1.1 · WordPress
  46. Low

    GHSA-f522-h982-63mg · WordPress

    Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+

    Published 18 Sept 2026 · Fixed in 6.9.8, 7.0.5, 7.1.1 · WordPress
  47. Medium 5.3

    GHSA-cjfg-q57r-mq45 · WordPress

    Missing `read_post` check in `attachment_submitbox_metadata()` leaks a private parent-post title

    Published 18 Sept 2026 · Fixed in 6.9.8, 7.0.5, 7.1.1 · WordPress
  48. Medium 6.5

    GHSA-33wf-p63q-w25f · WordPress

    Contributor+ Arbitrary Post Overwrite

    Published 18 Sept 2026 · Fixed in 6.9.8, 7.0.5, 7.1.1 · WordPress
  49. Medium 4.3

    GHSA-32m5-wc28-ghrr · WordPress

    Comments, including notes, can be reparented by any authenticated user

    Published 18 Sept 2026 · Fixed in 6.9.8, 7.0.5, 7.1.1 · WordPress
  50. Medium 4.4

    CVE-2026-86341 · GitLab

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval requirements, allowing unapproved deployments to reach production, due to improper access control…

    Published 16 Sept 2026 · Fixed in 19.1.8, 19.2.6, 19.3.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.