UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,613
Published in 7 days
781
Critical in 30 days
193
Actively exploited
401

Latest vulnerabilities

32,613 vulnerabilities
  1. Medium 6.5

    CVE-2024-45736 · Splunk Enterprise

    In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query with an improperly formatted "INGEST_EVAL" parameter as part of a [Field…

    Published 14 Oct 2024 · Fixed in 9.1.6, 9.2.3 · NVD
  2. Medium 4.3

    CVE-2024-45735 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the "admin" or "power" Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App.

    Published 14 Oct 2024 · Fixed in 9.1.6, 9.2.3 · NVD
  3. Medium 4.3

    CVE-2024-45734 · Splunk Enterprise

    In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source…

    Published 14 Oct 2024 · Fixed in 9.1.6, 9.2.3 · NVD
  4. High 8.8

    CVE-2024-45733 · Splunk Enterprise

    In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration.

    Published 14 Oct 2024 · Fixed in 9.1.6, 9.2.3 · NVD
  5. Medium 6.5

    CVE-2024-45732 · Splunk Enterprise

    In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially…

    Published 14 Oct 2024 · Fixed in 9.2.3 · NVD
  6. High 8.0

    CVE-2024-45731 · Splunk Enterprise

    In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive.

    Published 14 Oct 2024 · Fixed in 9.1.6, 9.2.3 · NVD
  7. Medium 6.5

    CVE-2024-8184 · Eclipse Jetty

    There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.

    Published 14 Oct 2024 · Fixed in 10.0.24, 11.0.24, 12.0.9 · NVD
  8. Medium 5.3

    CVE-2024-6763 · Eclipse Jetty

    Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC.…

    Published 14 Oct 2024 · Fixed in 9.4.57 · NVD
  9. Medium 6.5

    CVE-2024-6762 · Eclipse Jetty

    Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.

    Published 14 Oct 2024 · Fixed in 10.0.18, 11.0.18, 12.0.4 · NVD
  10. High 8.8

    CVE-2023-50780 · Apache ActiveMQ Artemis

    Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly…

    Published 14 Oct 2024 · Fixed in 2.29.0 · NVD
  11. High 7.5

    CVE-2024-9823 · Eclipse Jetty

    There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally.

    Published 14 Oct 2024 · Fixed in 10.0.18, 11.0.18, 12.0.3 · NVD
  12. Medium 6.1

    CVE-2024-9944 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 14 Oct 2024 · Fixed in 9.1.0 · NVD, WPVulnerability
  13. Medium 4.3

    CVE-2024-9926 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Incorrect Authorization

    Published 14 Oct 2024 · Fixed in 13.4.4, 13.8.2, 13.9.1 · NVD, WPVulnerability
  14. Medium 4.3

    CVE-2024-6757 · Elementor

    Elementor Website Builder – more than just a page builder: Exposure of Sensitive Information to an Unauthorized Actor

    Published 14 Oct 2024 · Fixed in 3.24.6 · NVD, WPVulnerability
  15. High 8.8

    CVE-2024-9164 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches.

    Published 11 Oct 2024 · Fixed in 17.2.9, 17.3.5, 17.4.2 · NVD
  16. High 8.8

    CVE-2024-8970 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user under certain circumstances.

    Published 11 Oct 2024 · Fixed in 17.2.9, 17.3.5, 17.4.2 · NVD
  17. Medium 4.3

    CVE-2024-5005 · GitLab

    An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 11.4 before 17.2.9, all versions starting from 17.3 before 17.3.5, all versions starting from 17.4 before 17.4.2 It was possible for guest users to disclose project templates using the API.

    Published 11 Oct 2024 · Fixed in 17.2.9, 17.3.5, 17.4.2 · NVD
  18. High 7.2

    CVE-2024-9180 · HashiCorp Vault, OpenBao

    A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.

    Published 10 Oct 2024 · Fixed in 1.16.11, 1.18.0, 2.0.3 · NVD
  19. Medium 5.4

    CVE-2024-6530 · GitLab

    A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 17.1 prior 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2. When adding a authorizing an application, it can be made to render as HTML under specific circumstances.

    Published 10 Oct 2024 · Fixed in 17.2.9, 17.3.5, 17.4.2 · NVD
  20. Medium 6.5

    CVE-2024-9623 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository.

    Published 10 Oct 2024 · Fixed in 17.2.9, 17.3.5, 17.4.2 · NVD
  21. Medium 5.3

    CVE-2024-9596 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. It was possible for an unauthenticated attacker to determine the GitLab version number for a GitLab instance.

    Published 10 Oct 2024 · Fixed in 17.2.9, 17.3.5, 17.4.2 · NVD
  22. High 8.1

    CVE-2024-8977 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks.

    Published 10 Oct 2024 · Fixed in 17.2.9, 17.3.5, 17.4.2 · NVD
  23. Low 2.7

    CVE-2024-45149 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  24. High 8.8

    CVE-2024-45148 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to gain unauthorized access without proper credentials. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  25. Low 2.7

    CVE-2024-45135 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An admin attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  26. Low 2.7

    CVE-2024-45134 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An admin attacker could leverage this vulnerability to have a low impact on confidentiality which may aid in further attacks. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  27. Low 2.7

    CVE-2024-45133 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An admin attacker could leverage this vulnerability to have a low impact on confidentiality which may aid in further attacks. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  28. Medium 6.5

    CVE-2024-45132 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and affect confidentiality. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  29. Medium 5.4

    CVE-2024-45131 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality and integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  30. Medium 4.3

    CVE-2024-45130 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  31. Medium 4.3

    CVE-2024-45129 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  32. Medium 5.4

    CVE-2024-45128 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity and availability. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  33. Medium 4.8

    CVE-2024-45127 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Oct 2024 · NVD
  34. Medium 4.3

    CVE-2024-45125 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to have a low impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  35. Medium 5.3

    CVE-2024-45124 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  36. Medium 6.1

    CVE-2024-45123 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 10 Oct 2024 · NVD
  37. Medium 4.3

    CVE-2024-45122 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  38. Medium 4.3

    CVE-2024-45121 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  39. Low 3.1

    CVE-2024-45120 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to a security feature bypass. An attacker could exploit this vulnerability to alter a condition between the check and the use of a resource, having a low impact on integrity. Exploitation of this issue requires user…

    Published 10 Oct 2024 · NVD
  40. Medium 4.9

    CVE-2024-45119 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  41. Medium 6.5

    CVE-2024-45118 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have high impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  42. High 7.6

    CVE-2024-45117 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to read files from the system outside of the intended directories via PHP filter chain and also can have a low-availability impact on the service. Exploitation of…

    Published 10 Oct 2024 · NVD
  43. High 8.1

    CVE-2024-45116 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code. If an admin attacker can trick a user into clicking a specially crafted link or submitting a form, malicious scripts may be executed within the context of the victim's browser and have high impact on…

    Published 10 Oct 2024 · NVD
  44. Critical 9.8

    CVE-2024-45115 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  45. Medium 5.4

    CVE-2024-7048 · Open WebUI

    In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this vulnerability, an attacker can view metadata of files uploaded by an admin and overwrite these files,…

    Published 10 Oct 2024 · NVD
  46. Medium 6.5

    CVE-2024-9538 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Exposure of Sensitive Information to an Unauthorized Actor

    Published 10 Oct 2024 · Fixed in 2.9.9 · WPVulnerability
  47. Medium 6.5

    CVE-2024-7041 · Open WebUI

    An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.

    Published 9 Oct 2024 · NVD
  48. Medium 5.1

    CVE-2024-9471 · Palo Alto Networks PAN-OS

    A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator. For example, an administrator with "Virtual system administrator (read-only)" access could use an XML API key of a "Virtual system…

    Published 9 Oct 2024 · Fixed in 10.1.11, 10.2.8, 11.0.3 · NVD
  49. High 8.2

    CVE-2024-9468 · Palo Alto Networks PAN-OS

    A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode.

    Published 9 Oct 2024 · Fixed in 11.0.4, 11.0.6, 11.1.3 · NVD
  50. High 7.5

    CVE-2024-46292 · ModSecurity

    A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NOTE: this is disputed by the Supplier because it cannot be reproduced. Also, the product's documentation indicates that it is not guaranteed to be usable with very large values of SecRequestBodyNoFilesLimit (which are required by the claimed issue).

    Published 9 Oct 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.