UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,616
Published in 7 days
784
Critical in 30 days
194
Actively exploited
401

Latest vulnerabilities

32,616 vulnerabilities
  1. Medium 5.1

    CVE-2024-9471 · Palo Alto Networks PAN-OS

    A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator. For example, an administrator with "Virtual system administrator (read-only)" access could use an XML API key of a "Virtual system…

    Published 9 Oct 2024 · Fixed in 10.1.11, 10.2.8, 11.0.3 · NVD
  2. High 8.2

    CVE-2024-9468 · Palo Alto Networks PAN-OS

    A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode.

    Published 9 Oct 2024 · Fixed in 11.0.4, 11.0.6, 11.1.3 · NVD
  3. High 7.5

    CVE-2024-46292 · ModSecurity

    A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NOTE: this is disputed by the Supplier because it cannot be reproduced. Also, the product's documentation indicates that it is not guaranteed to be usable with very large values of SecRequestBodyNoFilesLimit (which are required by the claimed issue).

    Published 9 Oct 2024 · NVD
  4. Medium 4.2

    CVE-2024-47822 · Directus

    Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in `req.query` is not redacted when the `LOG_STYLE` is set to `raw`. If these logs are not properly sanitized or protected, an attacker with access to it can potentially gain…

    Published 8 Oct 2024 · Fixed in 10.13.2 · NVD
  5. Medium 4.3

    CVE-2024-47780 · TYPO3

    TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected users could not manipulate these pages. Users are advised to update to TYPO3 versions 10.4.46 ELTS,…

    Published 8 Oct 2024 · Fixed in 11.5.40, 12.4.21, 13.3.1 · NVD
  6. High 8.2

    CVE-2024-47773 · Discourse

    Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without any preloaded data. This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable anonymous cache by setting the…

    Published 8 Oct 2024 · Fixed in 3.3.2 · NVD
  7. High 7.5

    CVE-2024-43485 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 8 Oct 2024 · Fixed in 6.0.35, 8.0.10 · NVD
  8. High 7.5

    CVE-2024-43484 · .NET

    .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

    Published 8 Oct 2024 · Fixed in 6.0.35, 8.0.10 · NVD
  9. High 7.5

    CVE-2024-43483 · .NET

    .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

    Published 8 Oct 2024 · Fixed in 6.0.35, 8.0.10 · NVD
  10. High 8.1

    CVE-2024-38229 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 8 Oct 2024 · Fixed in 8.0.10 · NVD
  11. Medium 5.4

    CVE-2024-47951 · TeamCity

    In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings

    Published 8 Oct 2024 · Fixed in 2024.07.3 · NVD
  12. Medium 5.4

    CVE-2024-47950 · TeamCity

    In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings

    Published 8 Oct 2024 · Fixed in 2024.07.03 · NVD
  13. High 7.5

    CVE-2024-47949 · TeamCity

    In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location

    Published 8 Oct 2024 · Fixed in 2024.07.3 · NVD
  14. High 7.5

    CVE-2024-47948 · TeamCity

    In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups

    Published 8 Oct 2024 · Fixed in 2024.07.3 · NVD
  15. Medium 6.5

    CVE-2024-47161 · TeamCity

    In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API

    Published 8 Oct 2024 · Fixed in 2024.07.3 · NVD
  16. Low 3.3

    CVE-2024-9026 · PHP

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to…

    Published 8 Oct 2024 · Fixed in 8.1.30, 8.2.24, 8.3.12 · NVD
  17. High 7.5

    CVE-2024-8927 · PHP

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain…

    Published 8 Oct 2024 · Fixed in 8.1.30, 8.2.24, 8.3.12 · NVD
  18. High 8.8

    CVE-2024-8926 · PHP

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to…

    Published 8 Oct 2024 · Fixed in 8.1.30, 8.2.24, 8.3.12 · NVD
  19. Medium 5.3

    CVE-2024-8925 · PHP

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

    Published 8 Oct 2024 · Fixed in 8.1.30, 8.2.24, 8.3.12 · NVD
  20. Medium 6.1

    CVE-2024-47772 · Discourse

    Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by sending a maliciously crafted chat message and replying to it. This issue only affects sites with CSP disabled. This problem is patched in the latest version of Discourse. All users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the…

    Published 7 Oct 2024 · Fixed in 3.3.2, 3.4.0 · NVD
  21. Medium 4.3

    CVE-2024-45297 · Discourse

    Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 7 Oct 2024 · Fixed in 3.3.2, 3.4.0 · NVD
  22. High 8.2

    CVE-2024-45051 · Discourse

    Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known workarounds for this…

    Published 7 Oct 2024 · Fixed in 3.3.2, 3.4.0 · NVD
  23. Medium 4.3

    CVE-2024-43789 · Discourse

    Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them all at once. This can potentially reduce the availability of a Discourse instance. This problem has been patched in the latest version of Discourse. All users area are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 7 Oct 2024 · Fixed in 3.3.1 · NVD
  24. High 8.8

    CVE-2024-31449 · Redis

    Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to…

    Published 7 Oct 2024 · Fixed in 6.2.16, 7.2.6 · NVD
  25. Medium 6.5

    CVE-2024-31228 · Redis

    Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process…

    Published 7 Oct 2024 · Fixed in 6.2.16, 7.2.6 · NVD
  26. Medium 4.4

    CVE-2024-31227 · Redis

    Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 7 Oct 2024 · Fixed in 7.2.6 · NVD
  27. Medium 6.1

    CVE-2024-28710 · LimeSurvey

    Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the Alert Widget's message component.

    Published 7 Oct 2024 · Fixed in 6.5.0\+240319 · NVD
  28. Medium 6.1

    CVE-2024-28709 · LimeSurvey

    Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and comment fields.

    Published 7 Oct 2024 · Fixed in 6.5.12\+240611 · NVD
  29. Medium 5.4

    CVE-2024-45153 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 7 Oct 2024 · Fixed in 6.5.21.0, 2024.5.0 · NVD
  30. Medium 6.6

    CVE-2024-9529 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Code Injection

    Published 7 Oct 2024 · Fixed in 6.3.8, 6.3.9 · NVD, WPVulnerability
  31. Medium 5.3

    CVE-2024-47913 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not authorized to view the log details for the filter.

    Published 4 Oct 2024 · Fixed in 1.39.9, 1.41.3, 1.42.2 · NVD
  32. High 7.2

    CVE-2024-47911 · SonarQube Server

    In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint that allows SonarQube users with the administrator role to inject blind SQL commands.

    Published 4 Oct 2024 · Fixed in 10.6 · NVD
  33. High 8.1

    CVE-2024-47183 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.

    Published 4 Oct 2024 · Fixed in 6.5.9, 7.3.0 · NVD
  34. High 7.2

    CVE-2024-9314 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Deserialization of Untrusted Data

    Published 4 Oct 2024 · Fixed in 1.0.229 · WPVulnerability
  35. Medium 6.5

    CVE-2024-9161 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization

    Published 4 Oct 2024 · Fixed in 1.0.229 · WPVulnerability
  36. Medium 5.9

    CVE-2024-34535 · Mastodon

    In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.

    Published 3 Oct 2024 · NVD
  37. Medium 5.3

    CVE-2024-8508 · Unbound

    NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well…

    Published 3 Oct 2024 · Fixed in 1.21.1 · NVD
  38. Critical 9.8Actively exploited

    CVE-2024-45519 · Zimbra Collaboration

    The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

    Published 2 Oct 2024 · Fixed in 8.8.15, 10.0.9 · NVD
  39. Medium 5.4

    CVE-2024-45965 · Contao

    Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6.

    Published 2 Oct 2024 · Fixed in 4.13.54, 5.3.30, 5.5.6 · NVD
  40. Medium 4.7

    CVE-2024-45962 · October CMS

    October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted JavaScript to the target.

    Published 2 Oct 2024 · NVD
  41. Medium 4.3

    CVE-2024-47804 · Jenkins

    If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to…

    Published 2 Oct 2024 · Fixed in 2.462.3, 2.479 · NVD
  42. Medium 4.3

    CVE-2024-47803 · Jenkins

    Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `secretTextarea` form field.

    Published 2 Oct 2024 · Fixed in 2.462.3, 2.479 · NVD
  43. High 7.5

    CVE-2024-33662 · Portainer

    Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.

    Published 2 Oct 2024 · Fixed in 2.20.2 · NVD
  44. Critical 9.1

    CVE-2023-3441 · GitLab

    An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4. The product did not sufficiently warn about security implications of granting merge rights to protected branches.

    Published 1 Oct 2024 · Fixed in 16.4.0 · NVD
  45. Medium 6.1

    CVE-2024-9225 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 1 Oct 2024 · Fixed in 8.2 · WPVulnerability
  46. Medium 4.8

    CVE-2024-45073 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

    Published 30 Sept 2024 · NVD
  47. Medium 6.9

    CVE-2024-9329 · Eclipse GlassFish

    In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

    Published 30 Sept 2024 · Fixed in 7.0.17 · NVD
  48. Medium 5.4

    CVE-2024-8107 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 30 Sept 2024 · Fixed in 6.7.19 · NVD, WPVulnerability
  49. High 8.8

    CVE-2024-47637 · LiteSpeed Cache

    LiteSpeed Cache: Path Traversal

    Published 30 Sept 2024 · Fixed in 6.5.1 · NVD, WPVulnerability
  50. Medium 6.1

    CVE-2024-47374 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 30 Sept 2024 · Fixed in 6.5.1 · NVD, WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.