UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,613
Published in 7 days
781
Critical in 30 days
193
Actively exploited
401

Latest vulnerabilities

32,613 vulnerabilities
  1. High 8.8

    CVE-2024-49004 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  2. High 8.8

    CVE-2024-49003 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  3. High 8.8

    CVE-2024-49002 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  4. High 8.8

    CVE-2024-49001 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  5. High 8.8

    CVE-2024-49000 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  6. High 8.8

    CVE-2024-48999 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  7. High 8.8

    CVE-2024-48998 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  8. High 8.8

    CVE-2024-48997 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  9. High 8.8

    CVE-2024-48996 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  10. High 8.8

    CVE-2024-48995 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  11. High 8.8

    CVE-2024-48994 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  12. High 8.8

    CVE-2024-48993 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  13. High 7.5

    CVE-2024-43499 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 12 Nov 2024 · NVD
  14. Critical 9.8

    CVE-2024-43498 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 12 Nov 2024 · NVD
  15. High 8.8

    CVE-2024-43462 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  16. High 8.8

    CVE-2024-43459 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  17. High 8.8

    CVE-2024-38255 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  18. High 7.7

    CVE-2024-49521 · Magento / Adobe Commerce

    Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could result in the bypassing of security measures such as firewalls. Exploitation of this issue does not…

    Published 12 Nov 2024 · Fixed in 3.2.6 · NVD
  19. High 7.2

    CVE-2024-11006 · Ivanti Connect Secure

    Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution.

    Published 12 Nov 2024 · Fixed in 9.1, 22.7 · NVD
  20. High 7.2

    CVE-2024-11005 · Ivanti Connect Secure

    Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution.

    Published 12 Nov 2024 · Fixed in 9.1, 22.7 · NVD
  21. Medium 6.1

    CVE-2024-11004 · Ivanti Connect Secure

    Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required.

    Published 12 Nov 2024 · Fixed in 22.7 · NVD
  22. High 8.8

    CVE-2024-9420 · Ivanti Connect Secure

    A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker to achieve remote code execution

    Published 12 Nov 2024 · Fixed in 9.1, 22.7 · NVD
  23. High 7.5

    CVE-2024-8495 · Ivanti Connect Secure

    A null pointer dereference in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to cause a denial of service.

    Published 12 Nov 2024 · Fixed in 22.7 · NVD
  24. Medium 4.9

    CVE-2024-47909 · Ivanti Connect Secure

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to cause a denial of service.

    Published 12 Nov 2024 · Fixed in 22.7 · NVD
  25. High 7.5

    CVE-2024-47907 · Ivanti Connect Secure

    A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service.

    Published 12 Nov 2024 · Fixed in 22.7 · NVD
  26. High 7.8

    CVE-2024-47906 · Ivanti Connect Secure

    Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.2 (Not Applicable to 9.1Rx) allows a local authenticated attacker to escalate privileges.

    Published 12 Nov 2024 · Fixed in 9.1, 22.7 · NVD
  27. Medium 4.9

    CVE-2024-47905 · Ivanti Connect Secure

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to cause a denial of service.

    Published 12 Nov 2024 · Fixed in 22.7 · NVD
  28. High 7.2

    CVE-2024-11007 · Ivanti Connect Secure

    Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution.

    Published 12 Nov 2024 · Fixed in 22.7 · NVD
  29. Medium 4.3

    CVE-2024-10593 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-Site Request Forgery (CSRF)

    Published 12 Nov 2024 · Fixed in 1.9.2.1 · NVD, WPVulnerability
  30. Medium 4.8

    CVE-2024-45087 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

    Published 11 Nov 2024 · NVD
  31. Medium 6.1

    CVE-2024-43439 · Moodle

    A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk.

    Published 11 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  32. Medium 6.1

    CVE-2024-43437 · Moodle

    A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup files.

    Published 11 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  33. Medium 5.3

    CVE-2024-43435 · Moodle

    A flaw was found in moodle. Insufficient capability checks make it possible for users with access to restore glossaries in courses to restore them into the global site glossary.

    Published 11 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  34. Medium 5.3

    CVE-2024-43433 · Moodle

    A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users.

    Published 11 Nov 2024 · Fixed in 4.3.6, 4.4.2 · NVD
  35. Medium 5.3

    CVE-2024-43432 · Moodle

    A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

    Published 11 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  36. Medium 5.3

    CVE-2024-43430 · Moodle

    A flaw was found in moodle. External API access to Quiz can override contained insufficient access control.

    Published 11 Nov 2024 · Fixed in 4.4.2 · NVD
  37. Medium 5.3

    CVE-2024-43429 · Moodle

    A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information.

    Published 11 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  38. Low 3.7

    CVE-2024-43427 · Moodle

    A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.

    Published 11 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  39. High 7.8

    CVE-2024-46956 · Ghostscript

    An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution.

    Published 10 Nov 2024 · Fixed in 10.04.0 · NVD
  40. Medium 5.5

    CVE-2024-46955 · Ghostscript

    An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bounds read when reading color in Indexed color space.

    Published 10 Nov 2024 · Fixed in 10.04.0 · NVD
  41. High 7.8

    CVE-2024-46954 · Ghostscript

    An issue was discovered in decode_utf8 in base/gp_utf8.c in Artifex Ghostscript before 10.04.0. Overlong UTF-8 encoding leads to possible ../ directory traversal.

    Published 10 Nov 2024 · Fixed in 10.04.0 · NVD
  42. High 7.8

    CVE-2024-46953 · Ghostscript

    An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output filename) results in path truncation, and possible path traversal and code execution.

    Published 10 Nov 2024 · Fixed in 10.04.0 · NVD
  43. High 7.8

    CVE-2024-46952 · Ghostscript

    An issue was discovered in pdf/pdf_xref.c in Artifex Ghostscript before 10.04.0. There is a buffer overflow during handling of a PDF XRef stream (related to W array values).

    Published 10 Nov 2024 · Fixed in 10.04.0 · NVD
  44. High 7.8

    CVE-2024-46951 · Ghostscript

    An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in Pattern color space could lead to arbitrary code execution.

    Published 10 Nov 2024 · Fixed in 10.04.0 · NVD
  45. Medium 4.3

    CVE-2024-52032 · Mattermost

    Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fail to properly query ElasticSearch when searching for the channel name in channel switcher which allows an attacker to get private channels names of channels that they are not a member of, when Elasticsearch v8 was enabled.

    Published 9 Nov 2024 · Fixed in 9.11.3 · NVD
  46. Medium 4.3

    CVE-2024-42000 · Mattermost

    Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels  which allows a User or System Manager, with "Read Groups" permission but with no access for channels to retrieve details about private channels that they were not a member of by sending a request to /api/v4/channels.

    Published 9 Nov 2024 · Fixed in 9.5.10, 9.10.3, 9.11.2 · NVD
  47. Medium 4.8

    CVE-2024-36250 · Mattermost

    Mattermost versions 9.11.x <= 9.11.2, and 9.5.x <= 9.5.10 fail to protect the mfa code against replay attacks, which allows an attacker to reuse the MFA code within ~30 seconds

    Published 9 Nov 2024 · Fixed in 9.5.11, 9.11.3 · NVD
  48. Medium 4.9

    CVE-2024-50378 · Apache Airflow

    Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is…

    Published 8 Nov 2024 · Fixed in 2.10.3 · NVD
  49. Medium 5.4

    CVE-2024-49524 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of…

    Published 7 Nov 2024 · Fixed in 6.5.21.0, 2024.5.0 · NVD
  50. Medium 5.4

    CVE-2024-49523 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 7 Nov 2024 · Fixed in 6.5.21.0, 2024.5.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.