UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,656
Published in 7 days
784
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,656 vulnerabilities
  1. High 7.5

    CVE-2024-2800 · GitLab

    ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE/CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allows denial of service via Regex backtracking.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  2. High 7.5

    CVE-2024-6329 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which causes the web interface to fail to render the diff correctly when the path is encoded.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  3. Medium 5.4

    CVE-2024-4784 · GitLab

    An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the password re-entry requirement to approve a policy.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  4. Medium 6.5

    CVE-2024-4210 · GitLab

    A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 12.6 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause a denial of service using crafted adoc files.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  5. High 8.8

    CVE-2024-6707 · Open WebUI

    Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability.

    Published 7 Aug 2024 · NVD
  6. Medium 6.1

    CVE-2024-6706 · Open WebUI

    Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.

    Published 7 Aug 2024 · NVD
  7. Medium 6.3

    CVE-2024-43045 · Jenkins

    Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views".

    Published 7 Aug 2024 · Fixed in 2.452.4, 2.471 · NVD
  8. High 8.8

    CVE-2024-43044 · Jenkins

    Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.

    Published 7 Aug 2024 · Fixed in 2.452.4, 2.471 · NVD
  9. High 7.8

    CVE-2024-7553 · MongoDB

    Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0…

    Published 7 Aug 2024 · Fixed in 6.0.16, 7.0.12, 7.3.3 · NVD
  10. High 7.8

    CVE-2024-43114 · TeamCity

    In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions

    Published 6 Aug 2024 · Fixed in 2024.07.1 · NVD
  11. Medium 6.9

    CVE-2024-7055 · FFmpeg

    A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is…

    Published 6 Aug 2024 · Fixed in 5.1.6, 6.1.2, 7.0.2 · NVD
  12. Critical 9.3Actively exploited

    CVE-2024-42009 · Roundcube

    A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

    Published 5 Aug 2024 · Fixed in 1.5.8, 1.6.8 · NVD
  13. Critical 9.3

    CVE-2024-42008 · Roundcube

    A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

    Published 5 Aug 2024 · Fixed in 1.5.8, 1.6.8 · NVD
  14. Critical 9.8Actively exploited

    CVE-2024-38856 · Apache OFBiz

    Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on…

    Published 5 Aug 2024 · Fixed in 18.12.15 · NVD
  15. High 8.6

    CVE-2024-39713 · Rocket.Chat

    A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.

    Published 5 Aug 2024 · Fixed in 6.10.1 · NVD
  16. High 7.7

    CVE-2024-3056 · Podman

    A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least one other container, can create a large number of IPC resources in /dev/shm. The malicious container will continue to exhaust resources until it is out-of-memory (OOM) killed. While the malicious container's cgroup will be removed, the IPC…

    Published 2 Aug 2024 · NVD
  17. Medium 4.3

    CVE-2024-22278 · Harbor

    Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.

    Published 2 Aug 2024 · Fixed in 2.9.5, 2.10.3 · NVD
  18. High 8.8

    CVE-2024-7031 · Filester (WordPress plugin)

    File Manager Pro – Filester: Missing Authorization

    Published 2 Aug 2024 · Fixed in 1.8.3 · WPVulnerability
  19. Medium 4.6

    CVE-2024-4353 · Concrete CMS

    Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. The Name input field does not check the input sufficiently letting a rogue administrator have the capability to inject malicious JavaScript code. The Concrete CMS security team gave this vulnerability a CVSS v4 score of 4.6 with a vector of…

    Published 1 Aug 2024 · Fixed in 9.3.3 · NVD
  20. Medium 4.3

    CVE-2024-41926 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.

    Published 1 Aug 2024 · Fixed in 9.5.7 · NVD
  21. Medium 4.3

    CVE-2024-41162 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when shared channels are enabled, which allows a malicious remote to make an arbitrary local channel read-only.

    Published 1 Aug 2024 · Fixed in 9.5.7, 9.7.6, 9.8.2 · NVD
  22. High 7.1

    CVE-2024-41144 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled,  which allows a malicious remote to create/update/delete arbitrary posts in arbitrary channels

    Published 1 Aug 2024 · Fixed in 9.5.7, 9.7.6, 9.8.2 · NVD
  23. Medium 4.3

    CVE-2024-39839 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow users to set their own remote username, when shared channels were enabled, which allows a user on a remote to set their remote username prop to an arbitrary string, which would be then synced to the local server as long as the user hadn't been synced before.

    Published 1 Aug 2024 · Fixed in 9.5.7, 9.7.6, 9.8.2 · NVD
  24. Medium 5.4

    CVE-2024-39837 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled.

    Published 1 Aug 2024 · Fixed in 9.5.7 · NVD
  25. High 8.7

    CVE-2024-39832 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly safeguard an error handling which allows a malicious remote to permanently delete local data by abusing dangerous error handling, when share channels were enabled.

    Published 1 Aug 2024 · Fixed in 9.5.7, 9.7.6, 9.8.2 · NVD
  26. Critical 9.6

    CVE-2024-39777 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local channel will then become shared without the consent of the local admin.

    Published 1 Aug 2024 · Fixed in 9.5.7, 9.7.6, 9.8.2 · NVD
  27. Medium 6.5

    CVE-2024-39274 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to properly validate that the channel that comes from the sync message is a shared channel, when shared channels are enabled, which allows a malicious remote to add users to arbitrary teams and channels

    Published 1 Aug 2024 · Fixed in 9.5.7, 9.7.6, 9.8.2 · NVD
  28. Medium 6.4

    CVE-2024-36492 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow the modification of local users when syncing users in shared channels. which allows a malicious remote to overwrite an existing local user.

    Published 1 Aug 2024 · Fixed in 9.5.7, 9.7.6, 9.8.2 · NVD
  29. Medium 4.3

    CVE-2024-29977 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allows a malicious remote to create arbitrary reactions on arbitrary posts

    Published 1 Aug 2024 · Fixed in 9.5.7 · NVD
  30. High 7.5

    CVE-2024-23444 · Elasticsearch

    It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.

    Published 31 Jul 2024 · Fixed in 7.17.23, 8.13.0 · NVD
  31. Medium 6.1

    CVE-2024-41953 · ZITADEL

    Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That information can be entered by users or administrators. Due to a missing output sanitization, these emails could include malicious code. This may potentially lead to a threat where an attacker, without privileges, could send out altered…

    Published 31 Jul 2024 · Fixed in 2.54.8, 2.55.5, 2.56.2 · NVD
  32. Medium 5.3

    CVE-2024-41952 · ZITADEL

    Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report "Username or Password invalid". Due to a implementation change to prevent deadlocks calling the…

    Published 31 Jul 2024 · Fixed in 2.54.8, 2.55.5, 2.56.2 · NVD
  33. Medium 6.5

    CVE-2024-7264 · curl

    libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also…

    Published 31 Jul 2024 · Fixed in 8.9.1 · NVD
  34. Medium 6.5

    CVE-2024-37281 · Kibana

    An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint.

    Published 30 Jul 2024 · Fixed in 7.17.23, 8.14.0 · NVD
  35. High 8.8

    CVE-2024-7297 · Langflow

    Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint.

    Published 30 Jul 2024 · Fixed in 1.0.13 · NVD
  36. Medium 6.1

    CVE-2024-39320 · Discourse

    Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed_iframes setting. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.

    Published 30 Jul 2024 · Fixed in 3.2.5 · NVD
  37. High 7.5

    CVE-2024-37299 · Discourse

    Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, crafting requests to submit very long tag group names can reduce the availability of a Discourse instance. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.

    Published 30 Jul 2024 · Fixed in 3.2.5 · NVD
  38. Medium 6.1

    CVE-2024-37165 · Discourse

    Discourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. This vulnerability is fixed in 3.2.3 and 3.3.0.beta3.

    Published 30 Jul 2024 · Fixed in 3.2.3 · NVD
  39. High 7.8

    CVE-2024-41817 · ImageMagick

    ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick` might use an empty path when setting `MAGICK_CONFIGURE_PATH` and `LD_LIBRARY_PATH` environment variables while executing, which might lead to arbitrary code execution by loading malicious configuration files or shared libraries in the current working…

    Published 29 Jul 2024 · Fixed in 7.1.1-36 · NVD
  40. Critical 9.8

    CVE-2024-6576 · MOVEit Transfer

    Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.12, from 2023.1.0 before 2023.1.7, from 2024.0.0 before 2024.0.3.

    Published 29 Jul 2024 · Fixed in 2023.0.12, 2023.1.7, 2024.0.3 · NVD
  41. High 8.2

    CVE-2024-35296 · Apache Traffic Server

    Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.

    Published 26 Jul 2024 · Fixed in 8.1.11, 9.2.5 · NVD
  42. High 7.5

    CVE-2024-35161 · Apache Traffic Server

    Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users can set a new setting (proxy.config.http.drop_chunked_trailers) not to forward chunked…

    Published 26 Jul 2024 · Fixed in 8.1.11, 9.2.5 · NVD
  43. High 7.5

    CVE-2023-38522 · Apache Traffic Server

    Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or…

    Published 26 Jul 2024 · Fixed in 8.1.11, 9.2.5 · NVD
  44. Medium 6.5

    CVE-2023-49921 · Elasticsearch

    An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the…

    Published 26 Jul 2024 · Fixed in 7.17.16, 8.11.2 · NVD
  45. Medium 6.1

    CVE-2024-41801 · OpenProject

    OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST header in the default configuration of packaged installations and using the "Login required" setting, an attacker could redirect to a remote host to initiate a phishing attack against an OpenProject user's account. This vulnerability affects default packaged installation of OpenProject without…

    Published 25 Jul 2024 · Fixed in 14.3.0 · NVD
  46. High 7.5

    CVE-2024-41800 · Craft CMS

    Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.

    Published 25 Jul 2024 · Fixed in 5.2.3 · NVD
  47. Medium 4.3

    CVE-2024-7057 · GitLab

    An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where job artifacts can be inappropriately exposed to users lacking the proper authorization level.

    Published 25 Jul 2024 · Fixed in 17.0.5, 17.1.3, 17.2.1 · NVD
  48. Medium 5.4

    CVE-2024-7047 · GitLab

    A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user.

    Published 25 Jul 2024 · Fixed in 17.0.5, 17.1.3 · NVD
  49. Medium 5.0

    CVE-2024-7091 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where it was possible to disclose limited information of an exported group or project to another user.

    Published 24 Jul 2024 · Fixed in 17.0.5, 17.1.3, 17.2.1 · NVD
  50. Medium 6.5

    CVE-2024-7060 · GitLab

    An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows unauthorized users to view the resultant export.

    Published 24 Jul 2024 · Fixed in 17.0.5, 17.1.3, 17.2.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.