UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,656
Published in 7 days
784
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,656 vulnerabilities
  1. Medium 4.3

    CVE-2024-39410 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor integrity changes on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation…

    Published 14 Aug 2024 · NVD
  2. Medium 4.3

    CVE-2024-39409 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor integrity changes on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation…

    Published 14 Aug 2024 · NVD
  3. Medium 4.3

    CVE-2024-39408 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor integrity changeson behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation…

    Published 14 Aug 2024 · NVD
  4. Medium 4.3

    CVE-2024-39407 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  5. Medium 6.8

    CVE-2024-39406 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue…

    Published 14 Aug 2024 · NVD
  6. Medium 4.3

    CVE-2024-39405 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  7. Medium 4.3

    CVE-2024-39404 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  8. High 7.6

    CVE-2024-39403 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is…

    Published 14 Aug 2024 · NVD
  9. High 8.4

    CVE-2024-39402 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.

    Published 14 Aug 2024 · NVD
  10. High 8.4

    CVE-2024-39401 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.

    Published 14 Aug 2024 · NVD
  11. High 8.1

    CVE-2024-39400 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious…

    Published 14 Aug 2024 · NVD
  12. High 7.7

    CVE-2024-39399 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this…

    Published 14 Aug 2024 · NVD
  13. High 7.4

    CVE-2024-39398 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user…

    Published 14 Aug 2024 · NVD
  14. Critical 9.0

    CVE-2024-39397 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution by an attacker. An attacker could exploit this vulnerability by uploading a malicious file which can then be executed on the server. Exploitation of this issue does not require user interaction,…

    Published 14 Aug 2024 · NVD
  15. High 7.5

    CVE-2024-38168 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 13 Aug 2024 · Fixed in 8.0.8 · NVD
  16. Medium 6.5

    CVE-2024-38167 · .NET

    .NET and Visual Studio Information Disclosure Vulnerability

    Published 13 Aug 2024 · Fixed in 8.0.8 · NVD
  17. Medium 5.5

    CVE-2024-36505 · Fortinet FortiOS

    An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker who has already successfully obtained write access to the underlying system (via another hypothetical exploit) to bypass the file integrity checking system.

    Published 13 Aug 2024 · Fixed in 7.0.15, 7.2.8, 7.4.4 · NVD
  18. High 8.8

    CVE-2022-45862 · Fortinet FortiProxy, Fortinet FortiOS

    An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; FortiSwitchManager 7.2.1 and below, 7.0 all versions GUI may allow attackers to re-use websessions after GUI logout, should they…

    Published 13 Aug 2024 · Fixed in 7.2.6, 7.4.0 · NVD
  19. Medium 5.3

    CVE-2024-6384 · MongoDB

    "Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versions prior to 7.3.3

    Published 13 Aug 2024 · Fixed in 6.0.16, 7.0.11, 7.3.3 · NVD
  20. High 7.2

    CVE-2024-37287 · Kibana

    A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution.

    Published 13 Aug 2024 · Fixed in 7.17.23, 8.14.2 · NVD
  21. High 8.1

    CVE-2024-41651 · PrestaShop

    An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality. NOTE: this is disputed by multiple parties, who report that exploitation requires that an attacker be able to hijack network requests made by an admin user (who, by design, is allowed to change the code that is running on the server).

    Published 12 Aug 2024 · NVD
  22. Medium 5.4

    CVE-2024-33536 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading a malicious JavaScript file, accessible externally, and crafting a URL containing its location in…

    Published 12 Aug 2024 · Fixed in 10.0.8 · NVD
  23. High 7.5

    CVE-2024-33535 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion (LFI) in a web application, specifically impacting the handling of the packages parameter. Attackers can exploit this flaw to include arbitrary local files without authentication, potentially leading to unauthorized access to sensitive information. The vulnerability…

    Published 12 Aug 2024 · Fixed in 10.0.8 · NVD
  24. Medium 5.4

    CVE-2024-33533 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0, issue 1 of 2. A reflected cross-site scripting (XSS) vulnerability has been identified in the Zimbra webmail admin interface. This vulnerability occurs due to inadequate input validation of the packages parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another…

    Published 12 Aug 2024 · Fixed in 10.0.8 · NVD
  25. Medium 6.1Actively exploited

    CVE-2024-27443 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a…

    Published 12 Aug 2024 · Fixed in 10.0.7 · NVD
  26. High 7.8

    CVE-2024-27442 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated…

    Published 12 Aug 2024 · Fixed in 10.0.7 · NVD
  27. Medium 4.6

    CVE-2024-7512 · Concrete CMS

    Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in Board instances. A rogue administrator could inject malicious code. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.6 with vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Versions below 9 are not affected. Thanks, m3dium for reporting. (CNA updated AC…

    Published 12 Aug 2024 · Fixed in 9.3.3 · NVD
  28. Medium 6.9

    CVE-2024-7272 · FFmpeg

    A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. This affects the function fill_audiodata of the file /libswresample/swresample.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. This issue was fixed in version 6.0 by 9903ba28c28ab18dc7b7b6fb8571cc8b5caae1a6 but a backport for 5.1 was forgotten. The exploit…

    Published 12 Aug 2024 · Fixed in 5.1.6 · NVD
  29. Medium 5.1

    CVE-2024-4350 · Concrete CMS

    Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later embedded into responses. A rogue administrator could inject malicious code into fields due to insufficient input validation. The Concrete CMS security team gave this vulnerability a CVSS v4 score of 5.1 with vector…

    Published 12 Aug 2024 · Fixed in 8.5.18, 9.3.3 · NVD
  30. High 7.5

    CVE-2024-36462 · Zabbix

    Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memory, or network bandwidth, without proper limitations or controls. This can cause a denial-of-service (DoS) attack or degrade the performance of the affected system.

    Published 12 Aug 2024 · NVD
  31. High 8.8

    CVE-2024-36461 · Zabbix

    Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine.

    Published 12 Aug 2024 · NVD
  32. High 8.1

    CVE-2024-36460 · Zabbix

    The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text.

    Published 12 Aug 2024 · NVD
  33. Low 2.7

    CVE-2024-22123 · Zabbix

    Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbix_server will try to communicate with it as modem. As a result, log file will be broken with AT commands and small part for log file content will be leaked to UI.

    Published 12 Aug 2024 · NVD
  34. Critical 9.1

    CVE-2024-22122 · Zabbix

    Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.

    Published 12 Aug 2024 · NVD
  35. Medium 6.1

    CVE-2024-22121 · Zabbix

    A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application.

    Published 12 Aug 2024 · NVD
  36. High 7.2

    CVE-2024-22116 · Zabbix

    An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.

    Published 12 Aug 2024 · NVD
  37. Medium 4.3

    CVE-2024-22114 · Zabbix

    User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard.

    Published 12 Aug 2024 · NVD
  38. Medium 4.6

    CVE-2024-7394 · Concrete CMS

    Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in getAttributeSetName(). A rogue administrator could inject malicious code. The Concrete CMS team gave this a CVSS v4.0 rank of 4.6 with vector https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N…

    Published 8 Aug 2024 · Fixed in 8.5.18, 9.3.3 · NVD
  39. Critical 9.8

    CVE-2024-42357 · Shopware

    Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the `aggregations` object. The `name` field in this `aggregations` object is vulnerable…

    Published 8 Aug 2024 · Fixed in 6.5.8.13, 6.6.5.1 · NVD
  40. High 7.2

    CVE-2024-42356 · Shopware

    Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. The function can be called also from Twig and as the second parameter…

    Published 8 Aug 2024 · Fixed in 6.5.8.13, 6.6.5.1 · NVD
  41. Critical 9.8

    CVE-2024-42355 · Shopware

    Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older…

    Published 8 Aug 2024 · Fixed in 6.5.8.13, 6.6.5.1 · NVD
  42. Medium 5.9

    CVE-2024-42354 · Shopware

    Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1 and 6.5.8.13, the processing of the Criteria did not considered ManyToMany associations and so they…

    Published 8 Aug 2024 · Fixed in 6.5.8.13, 6.6.5.1 · NVD
  43. High 7.5

    CVE-2024-7348 · PostgreSQL

    Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open…

    Published 8 Aug 2024 · Fixed in 14.13, 15.8, 16.4 · NVD
  44. Medium 6.5

    CVE-2024-7610 · GitLab

    A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  45. Medium 6.5

    CVE-2024-7554 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.0.6, all versions starting from 17.1 before 17.1.4, all versions starting from 17.2 before 17.2.2. Under certain conditions, access tokens may have been logged when an API request was made in a specific manner.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  46. Medium 6.5

    CVE-2024-5423 · GitLab

    Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2 which allowed an attacker to cause resource exhaustion via banzai pipeline.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  47. Medium 5.4

    CVE-2024-4207 · GitLab

    A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 prior 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  48. Medium 6.5

    CVE-2024-3958 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  49. Medium 6.5

    CVE-2024-3114 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2, with the processing logic for parsing invalid commits can lead to a regular expression DoS attack on the server.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  50. High 8.1

    CVE-2024-3035 · GitLab

    A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.