UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,656
Published in 7 days
784
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,656 vulnerabilities
  1. Medium 4.3

    CVE-2024-6685 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2, where group runners information was disclosed to unauthorised group members.

    Published 16 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  2. Medium 6.1

    CVE-2024-4283 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 11.1 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow.

    Published 16 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  3. Medium 4.6

    CVE-2024-8661 · Concrete CMS

    Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload by executing it in the browsers of targeted users. The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 4.6 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N…

    Published 16 Sept 2024 · Fixed in 8.5.19, 9.3.4 · NVD
  4. High 7.5

    CVE-2024-46938 · Sitecore Experience Platform

    An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files.

    Published 15 Sept 2024 · NVD
  5. Medium 5.4

    CVE-2024-39926 · Vaultwarden

    An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A stored cross-site scripting (XSS) or, due to the default CSP, HTML injection vulnerability has been discovered in the admin dashboard. This potentially allows an authenticated attacker to inject malicious code into the dashboard, which is then executed or rendered in the context of an administrator's browser when viewing…

    Published 13 Sept 2024 · NVD
  6. Medium 6.5

    CVE-2024-39925 · Vaultwarden

    An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the shared organization key is not rotated when a member departs. Consequently, the departing member, whose access should be revoked, retains a copy of the organization key. Additionally, the application fails to adequately protect some…

    Published 13 Sept 2024 · NVD
  7. High 8.8

    CVE-2024-39924 · Vaultwarden

    An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A vulnerability has been identified in the authentication and authorization process of the endpoint responsible for altering the metadata of an emergency access. It permits an attacker with granted emergency access to escalate their privileges by changing the access level and modifying the wait time. Consequently, the…

    Published 13 Sept 2024 · NVD
  8. High 7.5

    CVE-2024-6587 · LiteLLM

    A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to send the request to the domain specified by `api_base`. This request includes the OpenAI API key. A malicious user can set the `api_base` to their own domain…

    Published 13 Sept 2024 · NVD
  9. High 7.5

    CVE-2024-45113 · Adobe ColdFusion

    ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does not require user interaction.

    Published 13 Sept 2024 · NVD
  10. Critical 9.8

    CVE-2024-41874 · Adobe ColdFusion

    ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability by providing crafted input to the application, which when deserialized, leads to execution of malicious code. Exploitation of this issue does not require…

    Published 13 Sept 2024 · NVD
  11. High 8.8

    CVE-2024-8641 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It may have been possible for an attacker with a victim's CI_JOB_TOKEN to obtain a GitLab session token belonging to the victim.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  12. Medium 6.5

    CVE-2024-8311 · GitLab

    An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template.

    Published 12 Sept 2024 · Fixed in 17.2.5, 17.3.2 · NVD
  13. High 8.8

    CVE-2024-6678 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  14. Medium 5.5

    CVE-2024-4472 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, where dependency proxy credentials are retained in graphql Logs.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  15. High 8.1

    CVE-2024-8754 · GitLab

    An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is configured.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  16. High 8.8

    CVE-2024-8640 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. Due to incomplete input filtering, it was possible to inject commands into a connected Cube server.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  17. Medium 6.5

    CVE-2024-8635 · GitLab

    A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy URL

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  18. High 7.2

    CVE-2024-8631 · GitLab

    A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. A user assigned the Admin Group Member custom role could have escalated their privileges to include other custom roles.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  19. High 7.5

    CVE-2024-8124 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which could cause Denial of Service via sending a specific POST request.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  20. Low 3.5

    CVE-2024-6446 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could be used to trick a victim to trust an attacker controlled application.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  21. Medium 4.3

    CVE-2024-6389 · GitLab

    An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a guest user was able to access commit information via the release Atom endpoint, contrary to permissions.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  22. Medium 6.5

    CVE-2024-5435 · GitLab

    An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2 will disclose user password from repository mirror configuration.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  23. High 7.5

    CVE-2024-4660 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2. It was possible for a guest to read the source code of a private project by using group templates.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  24. Medium 6.1

    CVE-2024-4612 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.9 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  25. Critical 9.1

    CVE-2024-2743 · GitLab

    An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  26. Medium 5.3

    CVE-2024-8691 · Palo Alto Networks PAN-OS

    A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another GlobalProtect user. Active GlobalProtect users impersonated by an attacker who is exploiting this vulnerability are disconnected from GlobalProtect. Upon exploitation, PAN-OS logs indicate that the impersonated user authenticated to…

    Published 11 Sept 2024 · Fixed in 9.1.17, 10.1.11 · NVD
  27. Medium 6.7

    CVE-2024-8688 · Palo Alto Networks PAN-OS

    An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables authenticated administrators (including read-only administrators) with access to the CLI to to read arbitrary files on the firewall.

    Published 11 Sept 2024 · Fixed in 9.1.15, 10.0.10 · NVD
  28. Medium 6.9

    CVE-2024-8687 · Palo Alto Networks PAN-OS

    An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not…

    Published 11 Sept 2024 · Fixed in 10.0.12, 10.1.9, 10.2.4 · NVD
  29. High 8.6

    CVE-2024-8686 · Palo Alto Networks PAN-OS

    A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as root on the firewall.

    Published 11 Sept 2024 · NVD
  30. Medium 6.1

    CVE-2024-8646 · Eclipse GlassFish

    In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish. This vulnerability only affects applications that are explicitly deployed to the root context ('/').

    Published 11 Sept 2024 · Fixed in 7.0.10 · NVD
  31. Medium 6.5

    CVE-2024-8096 · curl

    When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

    Published 11 Sept 2024 · Fixed in 8.10.0 · NVD
  32. Medium 6.5

    CVE-2024-45596 · Directus

    Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId and Oauth2 Directus is using the respond middleware, which by default will try to cache GET requests…

    Published 10 Sept 2024 · Fixed in 10.13.3, 11.1.0 · NVD
  33. Critical 9.8

    CVE-2024-45409 · GitLab

    The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within…

    Published 10 Sept 2024 · Fixed in 17.1.8, 17.2.7, 17.3.3 · NVD
  34. High 7.5

    CVE-2024-43474 · Microsoft SQL Server

    Microsoft SQL Server Information Disclosure Vulnerability

    Published 10 Sept 2024 · Fixed in 14.0.2060.1, 14.0.3475.1, 15.0.2120.1 · NVD
  35. Critical 9.8

    CVE-2024-37980 · Microsoft SQL Server

    Microsoft SQL Server Elevation of Privilege Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  36. High 7.1

    CVE-2024-37966 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Information Disclosure Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  37. High 8.8

    CVE-2024-37965 · Microsoft SQL Server

    Microsoft SQL Server Elevation of Privilege Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  38. Medium 4.3

    CVE-2024-37342 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Information Disclosure Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  39. Critical 9.8

    CVE-2024-37341 · Microsoft SQL Server

    Microsoft SQL Server Elevation of Privilege Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  40. High 8.8

    CVE-2024-37340 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  41. High 8.8

    CVE-2024-37339 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  42. High 8.8

    CVE-2024-37338 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  43. Medium 4.3

    CVE-2024-37337 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Information Disclosure Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  44. High 8.8

    CVE-2024-37335 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  45. High 8.8

    CVE-2024-26191 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  46. High 8.8

    CVE-2024-26186 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  47. Critical 9.8

    CVE-2024-8654 · MongoDB

    MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3.

    Published 10 Sept 2024 · NVD
  48. Medium 5.4

    CVE-2024-5416 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 10 Sept 2024 · Fixed in 3.24.0 · NVD, WPVulnerability
  49. Medium 4.8

    CVE-2024-45406 · Craft CMS

    Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.

    Published 9 Sept 2024 · Fixed in 5.1.2 · NVD
  50. High 8.8

    CVE-2024-37288 · Kibana

    A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html  and have configured an Amazon Bedrock connector…

    Published 9 Sept 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.