UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,656
Published in 7 days
784
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,656 vulnerabilities
  1. High 7.5

    CVE-2024-42490 · authentik

    authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs/<uuid>/view_certificate/, /api/v3/crypto/certificatekeypairs/<uuid>/view_private_key/, and /api/v3/.../used_by/. Note that all of the affected API endpoints require the knowledge…

    Published 22 Aug 2024 · Fixed in 2024.4.4, 2024.6.4 · NVD
  2. Low 2.7

    CVE-2024-40884 · Mattermost

    Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL.

    Published 22 Aug 2024 · Fixed in 9.5.8 · NVD
  3. Medium 4.3

    CVE-2024-3127 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL allowing unauthorised users to perform some actions at the group level.

    Published 22 Aug 2024 · Fixed in 17.1.6, 17.2.4 · NVD
  4. High 7.2

    CVE-2024-8071 · Mattermost

    Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role (e.g. member) to include the `manage_system` permission, effectively becoming a System Admin.

    Published 22 Aug 2024 · Fixed in 9.8.3, 9.9.2, 9.10.1 · NVD
  5. Medium 4.3

    CVE-2024-43813 · Mattermost

    Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any channel inside any team as read for any user.

    Published 22 Aug 2024 · Fixed in 9.5.8, 9.10.1 · NVD
  6. Medium 5.3

    CVE-2024-42411 · Mattermost

    Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to manipulate the creation date in POST /api/v4/users tricking the admin into believing their account is much older.

    Published 22 Aug 2024 · Fixed in 9.8.3, 9.9.2, 9.10.1 · NVD
  7. High 8.8

    CVE-2024-40886 · Mattermost

    Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console.

    Published 22 Aug 2024 · Fixed in 9.8.3, 9.9.2, 9.10.1 · NVD
  8. Medium 6.5

    CVE-2024-39836 · Mattermost

    Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset passwords, when they are valid, functional emails.

    Published 22 Aug 2024 · Fixed in 9.8.3, 9.9.2, 9.10.1 · NVD
  9. Medium 4.9

    CVE-2024-39810 · Mattermost

    Mattermost versions 9.5.x <= 9.5.7 and 9.10.x <= 9.10.0 fail to time limit and size limit the CA path file in the ElasticSearch configuration which allows a System Role with access to the Elasticsearch system console to add any file as a CA path field, such as /dev/zero and, after testing the connection, cause the application to crash.

    Published 22 Aug 2024 · Fixed in 9.5.8, 9.10.1 · NVD
  10. Low 3.7

    CVE-2024-32939 · Mattermost

    Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server."

    Published 22 Aug 2024 · Fixed in 9.8.3, 9.9.2, 9.10.1 · NVD
  11. Medium 6.1

    CVE-2024-41937 · Apache Airflow

    Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link. Users should upgrade to 2.10.0 or later, which fixes this vulnerability.

    Published 21 Aug 2024 · Fixed in 2.10.0 · NVD
  12. High 8.2

    CVE-2024-21690 · Confluence

    This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.1, 8.8.0, and 8.9.0 of Confluence Data Center and Server. This Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability, with a CVSS Score of 7.1, allows an unauthenticated attacker to execute arbitrary HTML…

    Published 21 Aug 2024 · NVD
  13. Medium 6.1

    CVE-2024-40743 · Joomla!

    The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.

    Published 20 Aug 2024 · Fixed in 3.10.17, 4.4.6, 5.1.3 · NVD
  14. High 7.5

    CVE-2024-27187 · Joomla!

    Improper Access Controls allows backend users to overwrite their username when disallowed.

    Published 20 Aug 2024 · Fixed in 4.4.7, 5.1.3 · NVD
  15. Medium 6.1

    CVE-2024-27186 · Joomla!

    The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.

    Published 20 Aug 2024 · Fixed in 4.4.7, 5.1.3 · NVD
  16. Critical 9.1

    CVE-2024-27185 · Joomla!

    The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.

    Published 20 Aug 2024 · Fixed in 3.10.17, 4.4.7, 5.1.3 · NVD
  17. Medium 6.1

    CVE-2024-27184 · Joomla!

    Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not..

    Published 20 Aug 2024 · Fixed in 3.10.17, 4.4.7, 5.1.3 · NVD
  18. Medium 6.5

    CVE-2024-43409 · Ghost

    Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.

    Published 20 Aug 2024 · Fixed in 5.89.5 · NVD
  19. Medium 4.3

    CVE-2024-43377 · Umbraco CMS

    Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2.

    Published 20 Aug 2024 · Fixed in 14.1.2 · NVD
  20. Medium 5.3

    CVE-2024-43376 · Umbraco CMS

    Umbraco is an ASP.NET CMS. Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode. This vulnerability is fixed in 14.1.2.

    Published 20 Aug 2024 · Fixed in 14.1.2 · NVD
  21. High 7.5

    CVE-2024-7592 · Python

    There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.

    Published 19 Aug 2024 · Fixed in 3.10.15, 3.11.10, 3.12.6 · NVD
  22. Critical 9.8

    CVE-2024-28000 · LiteSpeed Cache

    LiteSpeed Cache: Incorrect Privilege Assignment

    Published 19 Aug 2024 · Fixed in 6.4 · NVD, WPVulnerability
  23. Medium 5.1

    CVE-2024-7887 · LimeSurvey

    A vulnerability was found in LimeSurvey 6.3.0-231016 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php of the component File Upload. The manipulation of the argument size leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about…

    Published 17 Aug 2024 · NVD
  24. Medium 5.4

    CVE-2024-25837 · October CMS

    A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section.

    Published 16 Aug 2024 · NVD
  25. Medium 5.4

    CVE-2024-43810 · TeamCity

    In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin

    Published 16 Aug 2024 · Fixed in 2024.07.1 · NVD
  26. Medium 6.1

    CVE-2024-43809 · TeamCity

    In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page

    Published 16 Aug 2024 · Fixed in 2024.07.1 · NVD
  27. Medium 5.4

    CVE-2024-43808 · TeamCity

    In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin

    Published 16 Aug 2024 · Fixed in 2024.07.1 · NVD
  28. Medium 5.4

    CVE-2024-43807 · TeamCity

    In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page

    Published 16 Aug 2024 · Fixed in 2024.07.1 · NVD
  29. Medium 5.9

    CVE-2024-39666 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 16 Aug 2024 · Fixed in 9.1.3 · WPVulnerability
  30. Medium 4.3

    CVE-2024-6534 · Directus

    Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets' request but not in the PATCH request. When chained with CVE-2024-6533, it could result in account takeover.

    Published 15 Aug 2024 · NVD
  31. Medium 5.4

    CVE-2024-6533 · Directus

    Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.

    Published 15 Aug 2024 · NVD
  32. Medium 4.4

    CVE-2022-3399 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 15 Aug 2024 · Fixed in 2.4.18 · WPVulnerability
  33. High 7.5

    CVE-2023-50314 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.8 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 274713.

    Published 14 Aug 2024 · NVD
  34. Medium 6.0

    CVE-2024-5916 · Palo Alto Networks PAN-OS

    An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. A read-only administrator who has access to the config log, can read secrets, passwords, and tokens to external systems.

    Published 14 Aug 2024 · Fixed in 10.2.8, 11.0.4 · NVD
  35. Medium 5.9

    CVE-2023-50315 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 274714.

    Published 14 Aug 2024 · NVD
  36. Medium 5.7

    CVE-2024-7347 · nginx

    NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker…

    Published 14 Aug 2024 · Fixed in 1.26.2 · NVD
  37. High 8.7

    CVE-2024-41727 · F5 BIG-IP

    In BIG-IP tenants running on r2000 and r4000 series hardware, or BIG-IP Virtual Edition (VEs) using Intel E810 SR-IOV NIC, undisclosed traffic can cause an increase in memory resource utilization.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 14 Aug 2024 · Fixed in 16.1.5 · NVD
  38. Medium 5.3

    CVE-2024-41723 · F5 BIG-IP

    Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 14 Aug 2024 · Fixed in 16.1.5 · NVD
  39. High 8.2

    CVE-2024-41164 · F5 BIG-IP

    When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 14 Aug 2024 · Fixed in 16.1.5 · NVD
  40. High 8.7

    CVE-2024-39778 · F5 BIG-IP

    When a stateless virtual server is configured on BIG-IP system with a High-Speed Bridge (HSB), undisclosed requests can cause TMM to terminate.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 14 Aug 2024 · Fixed in 16.1.5 · NVD
  41. Medium 6.5

    CVE-2024-25157 · GoAnywhere MFT

    An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification.

    Published 14 Aug 2024 · Fixed in 7.6.0 · NVD
  42. Medium 4.3

    CVE-2024-39419 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  43. Medium 5.4

    CVE-2024-39418 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures to view and edit low-sensitivity information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  44. Medium 4.3

    CVE-2024-39417 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  45. Medium 4.3

    CVE-2024-39416 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  46. Medium 4.3

    CVE-2024-39415 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  47. Medium 4.3

    CVE-2024-39414 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  48. Medium 4.3

    CVE-2024-39413 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  49. Medium 4.3

    CVE-2024-39412 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and perform a minor integrity change. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  50. Medium 4.3

    CVE-2024-39411 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.