Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 32,616
- Published in 7 days
- 784
- Critical in 30 days
- 194
- Actively exploited
- 401
Latest vulnerabilities
32,616 vulnerabilities- Medium 5.4
CVE-2024-47373 · LiteSpeed Cache
LiteSpeed Cache: Cross-site Scripting
Published 30 Sept 2024 · Fixed in 6.5.1 · NVD, WPVulnerability - Medium 6.5
CVE-2024-47077 · authentik
authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stolen by that application and used to impersonate the user against any other proxy provider. Also, a user can steal an access token they were legitimately issued for one application and use it to access another application that they aren't allowed to access.…
Published 27 Sept 2024 · Fixed in 2024.6.5, 2024.8.3 · NVD - Critical 9.0
CVE-2024-47070 · authentik
authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing password login by adding X-Forwarded-For header with an unparsable IP address, e.g. `a`. This results in a possibility of logging into any account with a known login or email address. The vulnerability requires the authentik instance to trust X-Forwarded-For…
Published 27 Sept 2024 · Fixed in 2024.6.5, 2024.8.3 · NVD - Medium 5.1
CVE-2024-9277 · Langflow
A vulnerability classified as problematic was found in Langflow up to 1.0.18. Affected by this vulnerability is an unknown functionality of the file \src\backend\base\langflow\interface\utils.py of the component HTTP POST Request Handler. The manipulation of the argument remaining_text leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be…
Published 27 Sept 2024 · NVD - Medium 4.3
CVE-2024-8974 · GitLab
Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project."
Published 26 Sept 2024 · Fixed in 17.2.8, 17.3.4 · NVD - Medium 5.3
CVE-2024-4099 · GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. An AI feature was found to read unsanitized content in a way that could have allowed an attacker to hide prompt injection.
Published 26 Sept 2024 · Fixed in 17.2.8, 17.3.4 · NVD - High 8.8
CVE-2024-7594 · HashiCorp Vault, OpenBao
Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault…
Published 26 Sept 2024 · Fixed in 1.16.10, 1.17.6, 2.0.2 · NVD - Medium 4.3
CVE-2024-9155 · Mattermost
Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view them in channels that they are a member of.
Published 26 Sept 2024 · Fixed in 9.5.9, 9.9.3, 9.10.2 · NVD - Medium 4.3
CVE-2024-47145 · Mattermost
Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links.
Published 26 Sept 2024 · Fixed in 9.5.9 · NVD - Medium 6.5
CVE-2024-47003 · Mattermost
Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.
Published 26 Sept 2024 · Fixed in 9.5.9 · NVD - Medium 5.4
CVE-2024-45843 · Mattermost
Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.
Published 26 Sept 2024 · Fixed in 9.5.9 · NVD - Medium 5.4
CVE-2024-42406 · Mattermost
Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files.
Published 26 Sept 2024 · Fixed in 9.5.9, 9.9.3, 9.10.2 · NVD - Low 2.7
CVE-2024-4278 · GitLab
An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting.
Published 26 Sept 2024 · Fixed in 17.2.8, 17.3.4 · NVD - High 7.3
CVE-2024-45817 · Xen
In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, the OS can opt to receive an interrupt when a new error occurs. It is possible to configure the error interrupt with an illegal vector, which generates an error when an error interrupt is raised. This case causes Xen to recurse through vlapic_error(). The…
Published 25 Sept 2024 · NVD - High 7.5
CVE-2024-31145 · Xen
Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions…
Published 25 Sept 2024 · NVD - Medium 6.1
CVE-2024-9148 · Flowise
Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.
Published 25 Sept 2024 · Fixed in 2.1.1 · NVD - Medium 5.1
CVE-2024-8291 · Concrete CMS
Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color. A rogue admin could add malicious code to the Thumbnails/Add-Type. The Concrete CMS Security Team gave this a CVSS v4 score of 5.1 with vector https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N…
Published 25 Sept 2024 · Fixed in 9.3.3 · NVD - Medium 4.6
CVE-2024-7398 · Concrete CMS
Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with permission to modify event calendars can execute scripts. The Concrete CMS Security Team gave this…
Published 25 Sept 2024 · Fixed in 8.5.19, 9.3.3 · NVD - Medium 5.4
CVE-2024-47048 · Rocket.Chat
Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier allows stored XSS in the description and release notes of the marketplace and private apps.
Published 25 Sept 2024 · Fixed in 6.9.7, 6.10.6, 6.11.3 · NVD - High 7.5
CVE-2024-46935 · Rocket.Chat
Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service (DoS). Attackers who craft messages with specific characters may crash the workspace due to an issue in the message parser.
Published 25 Sept 2024 · Fixed in 6.9.7, 6.10.6, 6.11.3 · NVD - Medium 6.1
CVE-2024-46934 · Rocket.Chat
Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS). Attackers may be able to abuse the UpdateOTRAck method to forge a message that contains an XSS payload.
Published 25 Sept 2024 · Fixed in 6.9.7, 6.10.6, 6.11.3 · NVD - Medium 5.4
CVE-2024-8725 · File Manager Advanced (WordPress plugin)
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Unrestricted Upload of File with Dangerous Type
Published 25 Sept 2024 · Fixed in 5.2.9 · WPVulnerability - High 7.2
CVE-2024-8704 · File Manager Advanced (WordPress plugin)
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Path Traversal
Published 25 Sept 2024 · Fixed in 5.2.9 · WPVulnerability - High 8.8
CVE-2024-8126 · File Manager Advanced (WordPress plugin)
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Unrestricted Upload of File with Dangerous Type
Published 25 Sept 2024 · Fixed in 5.2.9 · WPVulnerability - Medium 4.8
CVE-2024-9169 · LiteSpeed Cache
LiteSpeed Cache: Cross-site Scripting
Published 24 Sept 2024 · Fixed in 6.5 · NVD, WPVulnerability - Medium 5.4
CVE-2024-8668 · Woolentor Addons (WordPress plugin)
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting
Published 24 Sept 2024 · Fixed in 2.9.8 · WPVulnerability - Medium 6.5
CVE-2024-9014 · pgAdmin
pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.
Published 23 Sept 2024 · Fixed in 8.12 · NVD - High 7.5
CVE-2023-5359 · W3 Total Cache (WordPress plugin)
W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor
Published 23 Sept 2024 · Fixed in 2.7.6 · WPVulnerability - Medium 6.5
CVE-2024-47060 · ZITADEL
Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applications remain active. Users across other organizations can still log in and access through these applications, leading to unauthorized access. Additionally, if a project was deactivated access to applications was also still possible. The…
Published 20 Sept 2024 · Fixed in 2.58.5, 2.59.3, 2.60.2 · NVD - High 7.5
CVE-2024-47000 · ZITADEL
Zitadel is an open source identity management platform. ZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated service accounts retained the ability to request tokens, which could lead to unauthorized access to applications and resources. Versions 2.62.1, 2.61.1, 2.60.2, 2.59.3, 2.58.5, 2.57.5, 2.56.6, 2.55.8, and 2.54.10 have been released which…
Published 20 Sept 2024 · Fixed in 2.58.5, 2.59.3, 2.60.2 · NVD - Medium 6.5
CVE-2024-46999 · ZITADEL
Zitadel is an open source identity management platform. ZITADEL's user grants deactivation mechanism did not work correctly. Deactivated user grants were still provided in token, which could lead to unauthorized access to applications and resources. Additionally, the management and auth API always returned the state as active or did not provide any information about the state. Versions 2.62.1,…
Published 20 Sept 2024 · Fixed in 2.58.5, 2.59.3, 2.60.2 · NVD - High 7.5
CVE-2024-45810 · Envoy
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async client is handling `sendLocalReply` under some circumstance, e.g., websocket upgrade, and requests mirroring. The http async client will crash during the `sendLocalReply()` in http async client, one reason is http async client is duplicating the status code, another one is the destroy of…
Published 20 Sept 2024 · Fixed in 1.29.9, 1.30.6, 1.31.2 · NVD - High 7.5
CVE-2024-45809 · Envoy
Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires async header processing; 2. clear_route_cache is enabled on the provider; 3. header operations are enabled in JWT filter, e.g. header to claims feature; 4. the routing table is configured…
Published 20 Sept 2024 · Fixed in 1.29.9, 1.30.6, 1.31.2 · NVD - Medium 6.5
CVE-2024-45808 · Envoy
Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the `REQUESTED_SERVER_NAME` field for access loggers. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are…
Published 20 Sept 2024 · Fixed in 1.29.9, 1.30.6, 1.31.2 · NVD - High 7.5
CVE-2024-45807 · Envoy
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using `oghttp` as the default HTTP/2 codec, and there are potential bugs around stream management in the codec. To resolve this Envoy will switch off the `oghttp2` by default. The impact of this issue is that envoy will crash. This issue has been addressed in release version 1.31.2. All users are advised to…
Published 20 Sept 2024 · Fixed in 1.31.2 · NVD - Medium 6.5
CVE-2024-45806 · Envoy
Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration of internal trust boundaries, which considers all RFC1918 private address ranges as internal. The…
Published 20 Sept 2024 · Fixed in 1.29.9, 1.30.6, 1.31.2 · NVD - High 7.5
CVE-2024-45410 · Traefik
Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might…
Published 19 Sept 2024 · Fixed in 2.11.9, 3.1.3 · NVD - Medium 4.3
CVE-2024-47059 · Mautic
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification. This difference could be used to perform username enumeration.
Published 18 Sept 2024 · NVD - High 7.5
CVE-2022-25770 · Mautic
Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.
Published 18 Sept 2024 · Fixed in 4.4.13, 5.1.1 · NVD - Medium 5.4
CVE-2021-27917 · Mautic
Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.
Published 18 Sept 2024 · Fixed in 4.4.13, 5.1.1 · NVD - Medium 4.8
CVE-2024-47058 · Mautic
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
Published 18 Sept 2024 · Fixed in 4.4.13, 5.1.1 · NVD - Medium 6.1
CVE-2024-47050 · Mautic
Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.
Published 18 Sept 2024 · Fixed in 4.4.13, 5.1.1 · NVD - Medium 6.5
CVE-2022-25768 · Mautic
The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no…
Published 18 Sept 2024 · Fixed in 4.4.13, 5.1.1 · NVD - Medium 5.0
CVE-2024-46990 · Directus
Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade…
Published 18 Sept 2024 · Fixed in 10.13.3, 11.1.0 · NVD - Medium 6.5
CVE-2022-25777 · Mautic
Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery (SSRF) vulnerability.
Published 18 Sept 2024 · Fixed in 4.4.12, 5.0.4 · NVD - Medium 6.5
CVE-2022-25776 · Mautic
Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names.
Published 18 Sept 2024 · Fixed in 4.4.12, 5.0.4 · NVD - High 7.2
CVE-2022-25775 · Mautic
Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems.
Published 18 Sept 2024 · Fixed in 4.4.12, 5.0.4 · NVD - Medium 5.4
CVE-2022-25774 · Mautic
Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic. Users could inject malicious code into the notification when saving Dashboards.
Published 18 Sept 2024 · Fixed in 4.4.12 · NVD - Critical 9.1
CVE-2022-25769 · Mautic
ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.
Published 18 Sept 2024 · Fixed in 3.3.5, 4.2.0 · NVD - High 7.5
CVE-2024-46982 · Next.js
Next.js Cache Poisoning
Published 17 Sept 2024 · Fixed in 13.5.7, 14.2.10 · OSV.dev and GitHub
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.