UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,656
Published in 7 days
784
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,656 vulnerabilities
  1. Medium 5.4

    CVE-2024-45843 · Mattermost

    Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.

    Published 26 Sept 2024 · Fixed in 9.5.9 · NVD
  2. Medium 5.4

    CVE-2024-42406 · Mattermost

    Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files.

    Published 26 Sept 2024 · Fixed in 9.5.9, 9.9.3, 9.10.2 · NVD
  3. Low 2.7

    CVE-2024-4278 · GitLab

    An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting.

    Published 26 Sept 2024 · Fixed in 17.2.8, 17.3.4 · NVD
  4. High 7.3

    CVE-2024-45817 · Xen

    In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, the OS can opt to receive an interrupt when a new error occurs. It is possible to configure the error interrupt with an illegal vector, which generates an error when an error interrupt is raised. This case causes Xen to recurse through vlapic_error(). The…

    Published 25 Sept 2024 · NVD
  5. High 7.5

    CVE-2024-31145 · Xen

    Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions…

    Published 25 Sept 2024 · NVD
  6. Medium 6.1

    CVE-2024-9148 · Flowise

    Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.

    Published 25 Sept 2024 · Fixed in 2.1.1 · NVD
  7. Medium 5.1

    CVE-2024-8291 · Concrete CMS

    Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color.  A rogue admin could add malicious code to the Thumbnails/Add-Type. The Concrete CMS Security Team gave this a CVSS v4 score of 5.1 with vector https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N…

    Published 25 Sept 2024 · Fixed in 9.3.3 · NVD
  8. Medium 4.6

    CVE-2024-7398 · Concrete CMS

    Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with permission to modify event calendars can execute scripts. The Concrete CMS Security Team gave this…

    Published 25 Sept 2024 · Fixed in 8.5.19, 9.3.3 · NVD
  9. Medium 5.4

    CVE-2024-47048 · Rocket.Chat

    Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier allows stored XSS in the description and release notes of the marketplace and private apps.

    Published 25 Sept 2024 · Fixed in 6.9.7, 6.10.6, 6.11.3 · NVD
  10. High 7.5

    CVE-2024-46935 · Rocket.Chat

    Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service (DoS). Attackers who craft messages with specific characters may crash the workspace due to an issue in the message parser.

    Published 25 Sept 2024 · Fixed in 6.9.7, 6.10.6, 6.11.3 · NVD
  11. Medium 6.1

    CVE-2024-46934 · Rocket.Chat

    Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS). Attackers may be able to abuse the UpdateOTRAck method to forge a message that contains an XSS payload.

    Published 25 Sept 2024 · Fixed in 6.9.7, 6.10.6, 6.11.3 · NVD
  12. Medium 5.4

    CVE-2024-8725 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Unrestricted Upload of File with Dangerous Type

    Published 25 Sept 2024 · Fixed in 5.2.9 · WPVulnerability
  13. High 7.2

    CVE-2024-8704 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Path Traversal

    Published 25 Sept 2024 · Fixed in 5.2.9 · WPVulnerability
  14. High 8.8

    CVE-2024-8126 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Unrestricted Upload of File with Dangerous Type

    Published 25 Sept 2024 · Fixed in 5.2.9 · WPVulnerability
  15. Medium 4.8

    CVE-2024-9169 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 24 Sept 2024 · Fixed in 6.5 · NVD, WPVulnerability
  16. Medium 5.4

    CVE-2024-8668 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 24 Sept 2024 · Fixed in 2.9.8 · WPVulnerability
  17. Medium 6.5

    CVE-2024-9014 · pgAdmin

    pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

    Published 23 Sept 2024 · Fixed in 8.12 · NVD
  18. High 7.5

    CVE-2023-5359 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 23 Sept 2024 · Fixed in 2.7.6 · WPVulnerability
  19. Medium 6.5

    CVE-2024-47060 · ZITADEL

    Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applications remain active. Users across other organizations can still log in and access through these applications, leading to unauthorized access. Additionally, if a project was deactivated access to applications was also still possible. The…

    Published 20 Sept 2024 · Fixed in 2.58.5, 2.59.3, 2.60.2 · NVD
  20. High 7.5

    CVE-2024-47000 · ZITADEL

    Zitadel is an open source identity management platform. ZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated service accounts retained the ability to request tokens, which could lead to unauthorized access to applications and resources. Versions 2.62.1, 2.61.1, 2.60.2, 2.59.3, 2.58.5, 2.57.5, 2.56.6, 2.55.8, and 2.54.10 have been released which…

    Published 20 Sept 2024 · Fixed in 2.58.5, 2.59.3, 2.60.2 · NVD
  21. Medium 6.5

    CVE-2024-46999 · ZITADEL

    Zitadel is an open source identity management platform. ZITADEL's user grants deactivation mechanism did not work correctly. Deactivated user grants were still provided in token, which could lead to unauthorized access to applications and resources. Additionally, the management and auth API always returned the state as active or did not provide any information about the state. Versions 2.62.1,…

    Published 20 Sept 2024 · Fixed in 2.58.5, 2.59.3, 2.60.2 · NVD
  22. High 7.5

    CVE-2024-45810 · Envoy

    Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async client is handling `sendLocalReply` under some circumstance, e.g., websocket upgrade, and requests mirroring. The http async client will crash during the `sendLocalReply()` in http async client, one reason is http async client is duplicating the status code, another one is the destroy of…

    Published 20 Sept 2024 · Fixed in 1.29.9, 1.30.6, 1.31.2 · NVD
  23. High 7.5

    CVE-2024-45809 · Envoy

    Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires async header processing; 2. clear_route_cache is enabled on the provider; 3. header operations are enabled in JWT filter, e.g. header to claims feature; 4. the routing table is configured…

    Published 20 Sept 2024 · Fixed in 1.29.9, 1.30.6, 1.31.2 · NVD
  24. Medium 6.5

    CVE-2024-45808 · Envoy

    Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the `REQUESTED_SERVER_NAME` field for access loggers. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are…

    Published 20 Sept 2024 · Fixed in 1.29.9, 1.30.6, 1.31.2 · NVD
  25. High 7.5

    CVE-2024-45807 · Envoy

    Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using `oghttp` as the default HTTP/2 codec, and there are potential bugs around stream management in the codec. To resolve this Envoy will switch off the `oghttp2` by default. The impact of this issue is that envoy will crash. This issue has been addressed in release version 1.31.2. All users are advised to…

    Published 20 Sept 2024 · Fixed in 1.31.2 · NVD
  26. Medium 6.5

    CVE-2024-45806 · Envoy

    Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration of internal trust boundaries, which considers all RFC1918 private address ranges as internal. The…

    Published 20 Sept 2024 · Fixed in 1.29.9, 1.30.6, 1.31.2 · NVD
  27. High 7.5

    CVE-2024-45410 · Traefik

    Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might…

    Published 19 Sept 2024 · Fixed in 2.11.9, 3.1.3 · NVD
  28. Medium 4.3

    CVE-2024-47059 · Mautic

    When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification. This difference could be used to perform username enumeration.

    Published 18 Sept 2024 · NVD
  29. High 7.5

    CVE-2022-25770 · Mautic

    Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.

    Published 18 Sept 2024 · Fixed in 4.4.13, 5.1.1 · NVD
  30. Medium 5.4

    CVE-2021-27917 · Mautic

    Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.

    Published 18 Sept 2024 · Fixed in 4.4.13, 5.1.1 · NVD
  31. Medium 4.8

    CVE-2024-47058 · Mautic

    With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.

    Published 18 Sept 2024 · Fixed in 4.4.13, 5.1.1 · NVD
  32. Medium 6.1

    CVE-2024-47050 · Mautic

    Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.

    Published 18 Sept 2024 · Fixed in 4.4.13, 5.1.1 · NVD
  33. Medium 6.5

    CVE-2022-25768 · Mautic

    The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no…

    Published 18 Sept 2024 · Fixed in 4.4.13, 5.1.1 · NVD
  34. Medium 5.0

    CVE-2024-46990 · Directus

    Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade…

    Published 18 Sept 2024 · Fixed in 10.13.3, 11.1.0 · NVD
  35. Medium 6.5

    CVE-2022-25777 · Mautic

    Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery (SSRF) vulnerability.

    Published 18 Sept 2024 · Fixed in 4.4.12, 5.0.4 · NVD
  36. Medium 6.5

    CVE-2022-25776 · Mautic

    Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names.

    Published 18 Sept 2024 · Fixed in 4.4.12, 5.0.4 · NVD
  37. High 7.2

    CVE-2022-25775 · Mautic

    Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems.

    Published 18 Sept 2024 · Fixed in 4.4.12, 5.0.4 · NVD
  38. Medium 5.4

    CVE-2022-25774 · Mautic

    Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic. Users could inject malicious code into the notification when saving Dashboards.

    Published 18 Sept 2024 · Fixed in 4.4.12 · NVD
  39. Critical 9.1

    CVE-2022-25769 · Mautic

    ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

    Published 18 Sept 2024 · Fixed in 3.3.5, 4.2.0 · NVD
  40. High 7.5

    CVE-2024-46982 · Next.js

    Next.js Cache Poisoning

    Published 17 Sept 2024 · Fixed in 13.5.7, 14.2.10 · OSV.dev and GitHub
  41. Medium 4.3

    CVE-2024-45606 · Sentry

    Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we have identified no instances where alerts have been muted by unauthorized parties. A patch was…

    Published 17 Sept 2024 · Fixed in 24.9.0 · NVD
  42. Medium 4.3

    CVE-2024-45605 · Sentry

    Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to…

    Published 17 Sept 2024 · Fixed in 24.9.0 · NVD
  43. Medium 4.3

    CVE-2024-45604 · Contao

    Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability.

    Published 17 Sept 2024 · Fixed in 4.13.49 · NVD
  44. High 8.8

    CVE-2024-45398 · Contao

    Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to configure their web server so it does not execute PHP files and other scripts in the Contao file upload directory.

    Published 17 Sept 2024 · Fixed in 4.13.49, 5.3.15, 5.4.3 · NVD
  45. Medium 4.6

    CVE-2024-8660 · Concrete CMS

    Concrete CMS versions 9.0.0 through 9.3.3 are affected by a stored XSS vulnerability in the "Top Navigator Bar" block. Since the "Top Navigator Bar" output was not sufficiently sanitized, a rogue administrator could add a malicious payload that could be executed when targeted users visited the home page.The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 4.6 with vector…

    Published 17 Sept 2024 · Fixed in 9.3.4 · NVD
  46. Medium 5.3

    CVE-2024-45612 · Contao

    Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings.

    Published 17 Sept 2024 · Fixed in 4.13.49, 5.3.15, 5.4.3 · NVD
  47. Critical 9.8Actively exploited

    CVE-2024-38813 · VMware vCenter Server

    The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.

    Published 17 Sept 2024 · NVD
  48. Critical 9.8Actively exploited

    CVE-2024-38812 · VMware vCenter Server

    The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

    Published 17 Sept 2024 · NVD
  49. High 8.1

    CVE-2021-27916 · Mautic

    Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete files other than those in the media folders such as system files, libraries or other important files. This vulnerability exists in the implementation of the GrapesJS builder in Mautic.

    Published 17 Sept 2024 · Fixed in 4.4.12, 5.0.4 · NVD
  50. Critical 9.0

    CVE-2021-27915 · Mautic

    Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in user of Mautic with the appropriate permissions. This could lead to the user having elevated access to the system.

    Published 17 Sept 2024 · Fixed in 4.4.12 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.