UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,656
Published in 7 days
784
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,656 vulnerabilities
  1. High 8.8

    CVE-2024-45498 · Apache Airflow

    Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see https://github.com/apache/airflow/pull/41873  for more information. We…

    Published 7 Sept 2024 · NVD
  2. High 8.8

    CVE-2024-45034 · Apache Airflow

    Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.

    Published 7 Sept 2024 · Fixed in 2.10.1 · NVD
  3. Critical 9.8

    CVE-2024-8517 · SPIP

    SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.

    Published 6 Sept 2024 · Fixed in 4.1.18 · NVD
  4. Critical 9.8

    CVE-2024-44000 · LiteSpeed Cache

    LiteSpeed Cache: Insufficiently Protected Credentials

    Published 5 Sept 2024 · Fixed in 6.5.0.1 · NVD, WPVulnerability
  5. High 7.5

    CVE-2024-45692 · Webmin

    Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.

    Published 4 Sept 2024 · Fixed in 2.202 · NVD
  6. Medium 6.1

    CVE-2024-20506 · ClamAV

    A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files. The vulnerability is due to allowing the ClamD process to write to its log file…

    Published 4 Sept 2024 · Fixed in 0.103.12, 1.0.7, 1.3.2 · NVD
  7. High 7.5

    CVE-2024-20505 · ClamAV

    A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an out of bounds…

    Published 4 Sept 2024 · Fixed in 0.103.12, 1.0.7, 1.3.2 · NVD
  8. High 7.5

    CVE-2024-45506 · HAProxy

    HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

    Published 4 Sept 2024 · Fixed in 2.9.10, 3.0.4 · NVD
  9. High 8.8

    CVE-2024-43402 · Rust

    `std::process::Command` batch files argument escaping could be bypassed with trailing whitespace or periods

    Published 4 Sept 2024 · Fixed in 1.81.0 · NVD, Project advisories (GitHub)
  10. Critical 9.8

    CVE-2024-45507 · Apache OFBiz

    Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

    Published 4 Sept 2024 · Fixed in 18.12.16 · NVD
  11. High 7.5Actively exploited

    CVE-2024-45195 · Apache OFBiz

    Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

    Published 4 Sept 2024 · Fixed in 18.12.16 · NVD
  12. Medium 6.1

    CVE-2024-45429 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Cross-site Scripting

    Published 4 Sept 2024 · Fixed in 6.3.6 · WPVulnerability
  13. Low 3.6

    CVE-2024-45310 · runc

    runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a race with `os.MkdirAll`. While this could be used to create empty files, existing…

    Published 3 Sept 2024 · Fixed in 1.1.14 · NVD
  14. High 7.5

    CVE-2024-41436 · ClickHouse

    ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.

    Published 3 Sept 2024 · NVD
  15. Medium 6.5

    CVE-2024-42903 · LimeSurvey

    A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain.

    Published 3 Sept 2024 · NVD
  16. High 8.8

    CVE-2024-42902 · LimeSurvey

    An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js_localize.php function

    Published 3 Sept 2024 · NVD
  17. Medium 4.8

    CVE-2024-42901 · LimeSurvey

    A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file.

    Published 3 Sept 2024 · NVD
  18. High 7.5

    CVE-2024-6119 · OpenSSL

    Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of service. Applications performing certificate name checks (e.g., TLS clients checking server…

    Published 3 Sept 2024 · Fixed in 3.1.7, 3.2.3, 3.3.2 · NVD
  19. High 7.5

    CVE-2024-6232 · Python

    There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

    Published 3 Sept 2024 · Fixed in 3.10.15, 3.11.10, 3.12.6 · NVD
  20. Medium 5.4

    CVE-2024-45621 · Rocket.Chat

    The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a separate browser upon encountering third-party external actions from PDF documents.

    Published 2 Sept 2024 · NVD
  21. Medium 6.5

    CVE-2024-8365 · HashiCorp Vault

    Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and…

    Published 2 Sept 2024 · Fixed in 1.16.9, 1.17.5 · NVD
  22. Critical 9.8

    CVE-2024-45492 · Expat

    An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

    Published 30 Aug 2024 · Fixed in 2.6.3 · NVD
  23. Critical 9.8

    CVE-2024-45491 · Expat

    An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

    Published 30 Aug 2024 · Fixed in 2.6.3 · NVD
  24. High 7.5

    CVE-2024-45490 · Expat

    An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

    Published 30 Aug 2024 · Fixed in 2.6.3 · NVD
  25. High 8.1

    CVE-2024-41964 · Kirby

    Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions. Permissions for creating and deleting languages have already existed and could be configured, but were not enforced by Kirby's frontend or backend code. A permission for updating existing languages has not existed before the…

    Published 29 Aug 2024 · Fixed in 3.9.8.2, 3.10.1.1, 4.3.1 · NVD
  26. Medium 5.3

    CVE-2024-45440 · Drupal

    core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

    Published 29 Aug 2024 · NVD
  27. High 7.5

    CVE-2024-45436 · Ollama

    extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.

    Published 29 Aug 2024 · Fixed in 0.1.47 · NVD
  28. High 7.5

    CVE-2024-8182 · Flowise

    An Unauthenticated Denial of Service (DoS) vulnerability exists in Flowise version 1.8.2 leading to a complete crash of the instance running a vulnerable version due to improper handling of user supplied input to the “/api/v1/get-upload-file” api endpoint.

    Published 27 Aug 2024 · NVD
  29. High 8.1

    CVE-2024-8181 · Flowise

    An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an administrator and allow them to access restricted functionality.

    Published 27 Aug 2024 · NVD
  30. Medium 6.7

    CVE-2024-8207 · MongoDB

    In certain highly specific configurations of the host system and MongoDB server binary installation on Linux Operating Systems, it may be possible for a unintended actor with host-level access to cause the MongoDB Server binary to load unintended actor-controlled shared libraries when the server binary is started, potentially resulting in the unintended actor gaining full control over the…

    Published 27 Aug 2024 · Fixed in 5.0.14, 6.0.3, 6.1.1 · NVD
  31. Medium 5.4

    CVE-2024-41878 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link.

    Published 23 Aug 2024 · Fixed in 6.5.20.0, 2024.03 · NVD
  32. Medium 5.4

    CVE-2024-41877 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 23 Aug 2024 · Fixed in 6.5.20.0, 2024.03 · NVD
  33. Medium 5.4

    CVE-2024-41876 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  34. Medium 5.4

    CVE-2024-41875 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  35. Medium 4.1

    CVE-2024-41849 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. An low-privileged attacker could leverage this vulnerability to slightly affect the integrity of the page. Exploitation of this issue requires user interaction and scope is changed.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  36. Medium 5.4

    CVE-2024-41848 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  37. Medium 5.4

    CVE-2024-41847 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  38. Medium 5.4

    CVE-2024-41846 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  39. Medium 5.4

    CVE-2024-41845 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  40. Medium 5.4

    CVE-2024-41844 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  41. Medium 5.4

    CVE-2024-41843 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  42. Medium 4.8

    CVE-2024-41842 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  43. Medium 5.4

    CVE-2024-41841 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  44. High 7.3

    GHSA-34qg-65m4-f23m · Froxlor

    /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains <SQL_UNPRIVILEGED_PASSWORD>

    Published 23 Aug 2024 · Project advisories (GitHub)
  45. Critical 9.8Actively exploited

    CVE-2024-40766 · SonicWall SonicOS

    An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

    Published 23 Aug 2024 · Fixed in 5.9.2.14-13o, 6.5.2.8-2n, 6.5.4.15.116n · NVD
  46. Medium 6.5

    CVE-2024-8041 · GitLab

    A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1. A denial of service could occur upon importing a maliciously crafted repository using the GitHub importer.

    Published 22 Aug 2024 · Fixed in 17.1.6, 17.2.4, 17.3.1 · NVD
  47. Medium 6.4

    CVE-2024-7110 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection.

    Published 22 Aug 2024 · Fixed in 17.1.6, 17.2.4, 17.3.1 · NVD
  48. Medium 6.5

    CVE-2024-6502 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, which allows an attacker to create a branch with the same name as a deleted tag.

    Published 22 Aug 2024 · Fixed in 17.1.6, 17.2.4, 17.3.1 · NVD
  49. Medium 4.3

    CVE-2024-43780 · Mattermost

    Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel.

    Published 22 Aug 2024 · Fixed in 9.5.8, 9.8.3, 9.9.2 · NVD
  50. Medium 4.9

    CVE-2024-42497 · Mattermost

    Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.

    Published 22 Aug 2024 · Fixed in 9.5.8, 9.8.3, 9.9.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.