UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,613
Published in 7 days
781
Critical in 30 days
193
Actively exploited
401

Latest vulnerabilities

32,613 vulnerabilities
  1. Medium 6.1

    CVE-2024-50599 · Zimbra Collaboration

    A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endpoints. This arises from improper handling of user-supplied input, allowing an attacker to inject malicious code that is reflected back in the HTML response.

    Published 7 Nov 2024 · NVD
  2. High 7.5

    CVE-2024-43440 · Moodle

    A flaw was found in moodle. A local file may include risks when restoring block backups.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  3. High 7.5

    CVE-2024-43438 · Moodle

    A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned by the report.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  4. High 7.2

    CVE-2024-43436 · Moodle

    A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  5. High 8.1

    CVE-2024-43434 · Moodle

    The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  6. High 7.5

    CVE-2024-43431 · Moodle

    A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  7. High 7.1

    CVE-2024-43428 · Moodle

    To address a cache poisoning risk in Moodle, additional validation for local storage was required.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  8. High 7.5

    CVE-2024-43426 · Moodle

    A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  9. High 8.1

    CVE-2024-43425 · Moodle

    A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  10. High 7.5

    CVE-2024-38286 · Apache Tomcat

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be…

    Published 7 Nov 2024 · Fixed in 9.0.90, 10.1.25 · NVD
  11. Medium 6.5

    CVE-2024-9681 · curl

    When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second…

    Published 6 Nov 2024 · Fixed in 8.11.0 · NVD
  12. Critical 9.8

    CVE-2024-48061 · Langflow

    langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.

    Published 4 Nov 2024 · NVD
  13. Medium 5.5

    CVE-2024-45086 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.

    Published 4 Nov 2024 · Fixed in 8.5.5.27, 9.0.5.22 · NVD
  14. High 7.5

    CVE-2024-30619 · Chamilo LMS

    Chamilo LMS Version 1.11.26 is vulnerable to Incorrect Access Control. A non-authenticated attacker can request the number of messages and the number of online users via "/main/inc/ajax/message.ajax.php?a=get_count_message" AND "/main/inc/ajax/online.ajax.php?a=get_users_online."

    Published 4 Nov 2024 · NVD
  15. Medium 6.1

    CVE-2024-30618 · Chamilo LMS

    A Stored Cross-Site Scripting (XSS) Vulnerability in Chamilo LMS 1.11.26 allows a remote attacker to execute arbitrary JavaScript in a web browser by including a malicious payload in the 'content' parameter of 'group_topics.php'.

    Published 4 Nov 2024 · NVD
  16. Medium 5.4

    CVE-2024-30617 · Chamilo LMS

    A Cross-Site Request Forgery (CSRF) vulnerability in Chamilo LMS 1.11.26 "/main/social/home.php," allows attackers to initiate a request that posts a fake post onto the user's social wall without their consent or knowledge.

    Published 4 Nov 2024 · NVD
  17. High 8.8

    CVE-2024-30616 · Chamilo LMS

    Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a significant risk to data integrity.

    Published 4 Nov 2024 · NVD
  18. Medium 6.9

    CVE-2024-10761 · Umbraco CMS

    A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. It has been classified as problematic. Affected is an unknown function of the file /Umbraco/preview/frame?id{} of the component Dashboard. The manipulation of the argument culture leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be…

    Published 4 Nov 2024 · NVD
  19. Low 3.5

    CVE-2024-7056 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 4 Nov 2024 · Fixed in 1.9.1.6 · NVD, WPVulnerability
  20. Medium 4.6

    CVE-2024-27525 · Chamilo LMS

    Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the home.php component.

    Published 1 Nov 2024 · NVD
  21. High 7.1

    CVE-2024-27524 · Chamilo LMS

    Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the new_ticket.php component.

    Published 1 Nov 2024 · NVD
  22. High 7.5

    CVE-2024-39722 · Ollama

    An issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on which it is deployed via path traversal in the api/push route.

    Published 31 Oct 2024 · Fixed in 0.1.46 · NVD
  23. High 7.5

    CVE-2024-39721 · Ollama

    An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until completion. The req.Path parameter is user-controlled and can be set to /dev/random, which is blocking, causing the goroutine to run infinitely (even after the HTTP request is aborted by the client).

    Published 31 Oct 2024 · Fixed in 0.1.34 · NVD
  24. High 8.2

    CVE-2024-39720 · Ollama

    An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytes starting with the GGUF custom magic header. By leveraging a custom Modelfile that includes a FROM statement pointing to the attacker-controlled blob file, the attacker can crash the application through the CreateModel route, leading to a segmentation…

    Published 31 Oct 2024 · Fixed in 0.1.46 · NVD
  25. High 7.5

    CVE-2024-39719 · Ollama

    An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter that does not exist, it reflects the "File does not exist" error message to the attacker, providing a primitive for file existence on the server.

    Published 31 Oct 2024 · NVD
  26. High 7.5

    CVE-2024-8185 · HashiCorp Vault, OpenBao

    Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vault to consume excessive system memory resources, potentially leading to a crash of the underlying…

    Published 31 Oct 2024 · Fixed in 1.17.8, 1.18.1, 2.0.3 · NVD
  27. Critical 9.8

    CVE-2024-42835 · Langflow

    langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.

    Published 31 Oct 2024 · NVD
  28. Critical 9.8

    CVE-2024-51568 · CyberPanel

    CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthenticated remote code execution via shell metacharacters.

    Published 29 Oct 2024 · Fixed in 2.3.5 · NVD
  29. Critical 9.8Actively exploited

    CVE-2024-51567 · CyberPanel

    upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6…

    Published 29 Oct 2024 · Fixed in 2.3.8 · NVD
  30. Critical 9.8Actively exploited

    CVE-2024-51378 · CyberPanel

    getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX.…

    Published 29 Oct 2024 · Fixed in 2.3.8 · NVD
  31. Low 2.7

    CVE-2024-10452 · Grafana

    Organization admins can delete pending invites created in an organization they are not part of.

    Published 29 Oct 2024 · NVD
  32. High 7.5

    CVE-2024-47401 · Mattermost

    Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by sending a specially crafted request to Playbooks.

    Published 29 Oct 2024 · Fixed in 9.5.10, 9.10.3, 9.11.2 · NVD
  33. Medium 4.6

    CVE-2024-46872 · Mattermost

    Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks

    Published 29 Oct 2024 · NVD
  34. Medium 4.3

    CVE-2024-50052 · Mattermost

    Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post.

    Published 29 Oct 2024 · Fixed in 9.5.10, 9.10.3, 9.11.2 · NVD
  35. Medium 4.3

    CVE-2024-10241 · Mattermost

    Mattermost versions 9.5.x <= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by using cmd+K/ctrl+K.

    Published 29 Oct 2024 · Fixed in 9.5.10 · NVD
  36. Critical 9.8

    CVE-2024-50550 · LiteSpeed Cache

    LiteSpeed Cache: Incorrect Privilege Assignment

    Published 29 Oct 2024 · Fixed in 6.5.2 · NVD, WPVulnerability
  37. High 7.5

    CVE-2024-45802 · Squid

    Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, Premature Release of Resource During Expected Lifetime, and Missing Release of Resource after Effective Lifetime bugs, Squid is vulnerable to Denial of Service attacks by a trusted server against all clients using the proxy. This bug is fixed in the default build configuration of…

    Published 28 Oct 2024 · Fixed in 6.10 · NVD
  38. Low 3.5

    CVE-2024-10214 · Mattermost

    Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings.

    Published 28 Oct 2024 · NVD
  39. Medium 4.9

    CVE-2024-34537 · TYPO3

    TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user account via manipulated data saved in the bookmark toolbar of the backend user interface. The fixed versions are 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, and 13.3.1.

    Published 28 Oct 2024 · Fixed in 11.5.40, 12.4.21, 13.3.1 · NVD
  40. Medium 5.9

    CVE-2024-50602 · Expat

    An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

    Published 27 Oct 2024 · Fixed in 2.6.4 · NVD
  41. Medium 4.9

    CVE-2024-49757 · ZITADEL

    The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the…

    Published 25 Oct 2024 · Fixed in 2.61.4, 2.62.7, 2.63.5 · NVD
  42. Critical 9.1

    CVE-2024-49753 · ZITADEL

    Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost (127.0.0.1). The isHostBlocked check, designed to prevent such requests, can be circumvented by creating a DNS record that resolves…

    Published 25 Oct 2024 · Fixed in 2.62.8, 2.63.6, 2.64.1 · NVD
  43. High 8.6

    CVE-2024-48208 · Pure-FTPd

    pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.

    Published 24 Oct 2024 · Fixed in 1.0.52 · NVD
  44. Medium 5.4

    CVE-2024-8312 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. An attacker could inject HTML into the Global Search field on a diff view leading to XSS.

    Published 24 Oct 2024 · Fixed in 17.3.6, 17.4.3 · NVD
  45. Medium 6.5

    CVE-2024-6826 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. A denial of service could occur via importing a malicious crafted XML manifest file.

    Published 24 Oct 2024 · Fixed in 17.3.6, 17.4.3 · NVD
  46. Medium 5.4

    CVE-2026-85305 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Server-Side Request Forgery (SSRF)

    Published 24 Oct 2024 · Fixed in 10.2 · WPVulnerability
  47. Medium 5.4

    CVE-2024-50456 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Missing Authorization

    Published 24 Oct 2024 · Fixed in 8.2 · WPVulnerability
  48. Medium 4.3

    CVE-2024-50455 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Missing Authorization

    Published 24 Oct 2024 · Fixed in 8.2 · WPVulnerability
  49. Medium 5.3

    CVE-2024-50454 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Missing Authorization

    Published 24 Oct 2024 · Fixed in 8.2 · WPVulnerability
  50. Medium 5.3

    CVE-2024-20526 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the SSH server of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition for the SSH server of an affected device. This vulnerability is due to a logic error when an SSH session is established. An attacker could exploit this vulnerability by sending crafted SSH messages to an affected…

    Published 23 Oct 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.