Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 32,613
- Published in 7 days
- 781
- Critical in 30 days
- 193
- Actively exploited
- 401
Latest vulnerabilities
32,613 vulnerabilities- High 8.6
CVE-2024-20495 · Cisco ASA and Firepower Threat Defense
A vulnerability in the Remote Access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validation of client key data after the TLS…
Published 23 Oct 2024 · NVD - High 8.6
CVE-2024-20494 · Cisco ASA and Firepower Threat Defense
A vulnerability in the TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper data validation during the TLS 1.3 handshake. An attacker…
Published 23 Oct 2024 · NVD - Medium 5.3
CVE-2024-20493 · Cisco ASA and Firepower Threat Defense
A vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to deny further VPN user authentications for several minutes, resulting in a temporary denial of service (DoS) condition. This vulnerability is due to…
Published 23 Oct 2024 · NVD - Medium 6.7
CVE-2024-20485 · Cisco ASA and Firepower Threat Defense
A vulnerability in the VPN web server of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This vulnerability is due to improper validation of a specific file when it is read…
Published 23 Oct 2024 · NVD - Medium 5.8Actively exploited
CVE-2024-20481 · Cisco ASA and Firepower Threat Defense
A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN…
Published 23 Oct 2024 · NVD - High 8.6
CVE-2024-20426 · Cisco ASA and Firepower Threat Defense
A vulnerability in the Internet Key Exchange version 2 (IKEv2) protocol for VPN termination of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit…
Published 23 Oct 2024 · NVD - High 7.7
CVE-2024-20408 · Cisco ASA and Firepower Threat Defense
A vulnerability in the Dynamic Access Policies (DAP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly. To exploit this vulnerability, an attacker would need valid remote access VPN user credentials on the affected device. This vulnerability…
Published 23 Oct 2024 · NVD - High 8.6
CVE-2024-20402 · Cisco ASA and Firepower Threat Defense
A vulnerability in the SSL VPN feature for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to a logic error in memory management when the device is handling SSL VPN…
Published 23 Oct 2024 · NVD - Medium 5.8
CVE-2024-20384 · Cisco ASA and Firepower Threat Defense
A vulnerability in the Network Service Group (NSG) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should be denied to flow through an affected device. This vulnerability is due to a logic error that occurs when NSG…
Published 23 Oct 2024 · NVD - Medium 6.1
CVE-2024-20382 · Cisco ASA and Firepower Threat Defense
A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a browser that is accessing an affected device. This vulnerability is due to improper validation of user-supplied input to application…
Published 23 Oct 2024 · NVD - Medium 6.1
CVE-2024-20341 · Cisco ASA and Firepower Threat Defense
A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a browser that is accessing an affected device. This vulnerability is due to improper validation of user-supplied input to application…
Published 23 Oct 2024 · NVD - Medium 5.9
CVE-2024-20331 · Cisco ASA and Firepower Threat Defense
A vulnerability in the session authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to prevent users from authenticating. This vulnerability is due to insufficient entropy in the authentication process. An attacker could exploit this…
Published 23 Oct 2024 · NVD - Critical 9.9
CVE-2024-20329 · Cisco ASA and Firepower Threat Defense
A vulnerability in the SSH subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to execute operating system commands as root. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by submitting crafted input when executing remote CLI commands over SSH. A successful exploit could…
Published 23 Oct 2024 · NVD - Medium 5.8
CVE-2024-20299 · Cisco ASA and Firepower Threat Defense
A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should have been denied to flow through an affected device. This vulnerability is due to a logic error in populating group ACLs when…
Published 23 Oct 2024 · NVD - Medium 5.8
CVE-2024-20297 · Cisco ASA and Firepower Threat Defense
A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should have been denied to flow through an affected device. This vulnerability is due to a logic error in populating group ACLs when…
Published 23 Oct 2024 · NVD - High 7.7
CVE-2024-20268 · Cisco ASA and Firepower Threat Defense
A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause an unexpected reload of the device. This vulnerability is due to insufficient input validation of SNMP packets. An attacker could exploit this vulnerability by sending…
Published 23 Oct 2024 · NVD - Medium 5.9
CVE-2024-5764 · Sonatype Nexus Repository
Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database (SMTP or HTTP proxy credentials, user tokens, tokens, among others). The affected versions relied on a static hard-coded encryption passphrase. While it was possible for an administrator to define an…
Published 23 Oct 2024 · Fixed in 3.73.0 · NVD - High 8.7
CVE-2024-49370 · Pimcore
Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is set to true, the change password function in Portal Profile sets the new password. Prior to Pimcore portal engine versions 4.1.7 and 3.1.16, the password is then set without hashing so it can be read by everyone. Everyone who combines…
Published 23 Oct 2024 · Fixed in 3.1.16, 4.1.7 · NVD - Medium 5.3
CVE-2024-9287 · Python
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is…
Published 22 Oct 2024 · Fixed in 3.11.11, 3.12.8, 3.13.1 · NVD - Medium 4.8
CVE-2024-46538 · pfSense
A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.
Published 22 Oct 2024 · NVD - High 8.8
CVE-2024-45518 · Zimbra Collaboration
An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to…
Published 22 Oct 2024 · Fixed in 10.0.9 · NVD - Medium 4.2
CVE-2024-48929 · Umbraco CMS
Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7, during an explicit sign-out, the server session is not fully terminated. Versions 13.5.2 and 10.8.7 contain a patch for the issue.
Published 22 Oct 2024 · Fixed in 10.8.7, 13.5.2 · NVD - Medium 4.6
CVE-2024-48927 · Umbraco CMS
Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Versions 13.5.2, 10.8,7, and 8.18.15 contain a patch for the issue. As a workaround,…
Published 22 Oct 2024 · Fixed in 8.18.15, 10.8.7, 13.5.2 · NVD - Low 3.1
CVE-2024-48926 · Umbraco CMS
Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. The Backoffice displays the logout page with a session timeout message before the server session has fully expired, causing users to believe they have been logged out approximately 30 seconds…
Published 22 Oct 2024 · Fixed in 8.18.15, 10.8.7, 13.5.2 · NVD - Medium 6.5
CVE-2024-48925 · Umbraco CMS
Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0. The issue allows low-privilege users to access the webhook API and retrieve information that should be restricted to users with access to the settings section. Version 14.3.0 contains a patch.
Published 22 Oct 2024 · Fixed in 14.3.0 · NVD - High 8.7
CVE-2024-47819 · Umbraco CMS
Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected…
Published 22 Oct 2024 · Fixed in 14.3.1 · NVD - Medium 6.1
CVE-2024-8980 · Liferay Portal / DXP
The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute…
Published 22 Oct 2024 · Fixed in 7.1.3, 7.4.3.102, 2023.q3.5 · NVD - High 8.8
CVE-2024-38002 · Liferay Portal / DXP
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
Published 22 Oct 2024 · Fixed in 7.4.3.112, 2023.q3.9, 2023.q4.6 · NVD - High 8.8
CVE-2024-26273 · Liferay Portal / DXP
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and…
Published 22 Oct 2024 · Fixed in 7.4.3.104, 2023.q3.6, 2023.q4.3 · NVD - High 8.8
CVE-2024-26272 · Liferay Portal / DXP
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform…
Published 22 Oct 2024 · Fixed in 7.4.3.108, 2023.q3.6, 2023.q4.3 · NVD - High 8.8
CVE-2024-26271 · Liferay Portal / DXP
Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4)…
Published 22 Oct 2024 · Fixed in 7.4.3.112, 2023.q3.6, 2023.q4.3 · NVD - High 8.9
CVE-2024-49368 · Nginx UI
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.
Published 21 Oct 2024 · NVD - Medium 5.5
CVE-2024-49367 · Nginx UI
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at `/api/configs` to read directories and file contents on the server. Version 2.0.0-beta.36 fixes the issue.
Published 21 Oct 2024 · NVD - High 7.7
CVE-2024-49366 · Nginx UI
Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can construct a value value in the form of `../../`. Arbitrary files can be written to the server, which may result in loss of permissions. Version 2.0.0-beta.26 fixes the issue.
Published 21 Oct 2024 · NVD - Medium 6.5
CVE-2024-8305 · MongoDB
prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB Server v7.0 versions prior to 7.0.13 and MongoDB Server v7.3 versions prior to 7.3.4
Published 21 Oct 2024 · Fixed in 6.0.17, 7.0.13, 7.3.4 · NVD - High 8.8
CVE-2024-37404 · Ivanti Connect Secure
Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution.
Published 18 Oct 2024 · Fixed in 9.1, 22.7 · NVD - Critical 9.4
CVE-2024-9264 · Grafana
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in…
Published 18 Oct 2024 · NVD - Medium 5.7
CVE-2024-27766 · MariaDB
An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.
Published 17 Oct 2024 · NVD - Medium 5.6
CVE-2023-39593 · MariaDB
Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.
Published 17 Oct 2024 · NVD - Critical 9.8
CVE-2023-26785 · MariaDB
MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a "create function" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.
Published 17 Oct 2024 · NVD - Medium 5.9
CVE-2024-10076 · Jetpack
Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting
Published 17 Oct 2024 · Fixed in 13.8 · NVD, WPVulnerability - Medium 5.6
CVE-2024-10075 · Jetpack
Jetpack – WP Security, Backup, Speed, & Growth: Authorization Bypass Through User-Controlled Key
Published 17 Oct 2024 · Fixed in 13.8 · NVD, WPVulnerability - Medium 5.5
CVE-2024-45072 · IBM WebSphere Application Server
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.
Published 16 Oct 2024 · NVD - Medium 4.8
CVE-2024-45071 · IBM WebSphere Application Server
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Published 16 Oct 2024 · NVD - High 8.6
CVE-2024-45844 · F5 BIG-IP
BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published 16 Oct 2024 · Fixed in 15.1.10.5, 16.1.5, 17.1.1.4 · NVD - Medium 4.1
CVE-2024-45714 · SolarWinds Serv-U
Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users’ permissions can modify a variable with a payload.
Published 16 Oct 2024 · NVD - High 8.8
CVE-2024-45711 · SolarWinds Serv-U
SolarWinds Serv-U is vulnerable to a directory traversal vulnerability where remote code execution is possible depending on privileges given to the authenticated user. This issue requires a user to be authenticated and this is present when software environment variables are abused. Authentication is required for this vulnerability
Published 16 Oct 2024 · Fixed in 15.5 · NVD - High 8.1
CVE-2024-45217 · Apache Solr
Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to "trusted" ConfigSets that may not have…
Published 16 Oct 2024 · Fixed in 8.11.4, 9.7.0 · NVD - Critical 9.8
CVE-2024-45216 · Apache Solr
Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an…
Published 16 Oct 2024 · Fixed in 8.11.4, 9.7.0 · NVD - High 8.4
CVE-2023-22649 · Rancher
A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) is an opt-in feature, only deployments that have it enabled and have…
Published 16 Oct 2024 · Fixed in 2.6.14, 2.7.10, 2.8.2 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.