UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,656
Published in 7 days
784
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,656 vulnerabilities
  1. Medium 4.8

    CVE-2024-21145 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows…

    Published 16 Jul 2024 · NVD
  2. Low 3.7

    CVE-2024-21144 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23; Oracle GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle…

    Published 16 Jul 2024 · NVD
  3. Medium 4.9

    CVE-2024-21142 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 16 Jul 2024 · NVD
  4. Medium 4.8

    CVE-2024-21140 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability…

    Published 16 Jul 2024 · NVD
  5. Low 3.7

    CVE-2024-21138 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability…

    Published 16 Jul 2024 · NVD
  6. Medium 4.9

    CVE-2024-21137 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 16 Jul 2024 · NVD
  7. Medium 4.9

    CVE-2024-21135 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 16 Jul 2024 · NVD
  8. Medium 4.3

    CVE-2024-21134 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause…

    Published 16 Jul 2024 · NVD
  9. Low 3.7

    CVE-2024-21131 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability…

    Published 16 Jul 2024 · NVD
  10. Medium 4.9

    CVE-2024-21130 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 16 Jul 2024 · NVD
  11. Medium 4.9

    CVE-2024-21129 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jul 2024 · NVD
  12. Medium 4.9

    CVE-2024-21127 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jul 2024 · NVD
  13. Medium 4.9

    CVE-2024-21125 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jul 2024 · NVD
  14. Medium 4.9

    CVE-2024-20996 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jul 2024 · NVD
  15. High 8.7

    CVE-2024-21686 · Confluence

    This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This Stored XSS vulnerability, with a CVSS Score of 7.3, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to confidentiality, high impact to integrity, no impact to availability, and requires user interaction.…

    Published 16 Jul 2024 · Fixed in 7.19.22, 8.5.9, 8.9.1 · NVD
  16. Critical 9.8

    CVE-2024-39887 · Apache Superset

    An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the…

    Published 16 Jul 2024 · Fixed in 4.0.2 · NVD
  17. Medium 4.9

    CVE-2024-38360 · Discourse

    Discourse is an open source platform for community discussion. In affected versions by creating replacement words with an almost unlimited number of characters, a moderator can reduce the availability of a Discourse instance. This issue has been addressed in stable version 3.2.3 and in current betas. Users are advised to upgrade. Users unable to upgrade may manually remove the long watched words…

    Published 15 Jul 2024 · Fixed in 3.3.0, 3.3.2 · NVD
  18. High 7.5

    CVE-2024-6468 · HashiCorp Vault

    Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxy_protocol_behavior, was set to deny_unauthorized. When receiving a request from a source IP address that was not listed in proxy_protocol_authorized_addrs, the Vault API server would shut down and no longer respond to any HTTP requests, potentially resulting…

    Published 11 Jul 2024 · Fixed in 1.15.12, 1.16.6, 1.17.2 · NVD
  19. Medium 4.9

    CVE-2024-39317 · Wagtail

    Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail…

    Published 11 Jul 2024 · Fixed in 5.2.6, 6.0.6, 6.1.3 · NVD
  20. Critical 9.8

    CVE-2024-6385 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows an attacker to trigger a pipeline as another user under certain circumstances.

    Published 11 Jul 2024 · Fixed in 16.11.6, 17.0.4, 17.1.2 · NVD
  21. Low 2.7

    CVE-2024-5470 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with `admin_push_rules` permission may have been able to create project-level deploy tokens.

    Published 11 Jul 2024 · Fixed in 17.0.4, 17.1.2 · NVD
  22. Low 2.7

    CVE-2024-5257 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Developer user with `admin_compliance_framework` custom role may have been able to modify the URL for a group namespace.

    Published 11 Jul 2024 · Fixed in 17.0.4, 17.1.2 · NVD
  23. Low 2.7

    CVE-2024-2880 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 in which a user with `admin_group_member` custom role permission could ban group members.

    Published 11 Jul 2024 · Fixed in 16.11.6, 17.0.4, 17.1.2 · NVD
  24. High 8.8

    CVE-2024-37149 · GLPI

    GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this malicious script. Upgrade to 10.0.16.

    Published 10 Jul 2024 · Fixed in 10.0.16 · NVD
  25. High 8.1

    CVE-2024-37148 · GLPI

    GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrade to 10.0.16.

    Published 10 Jul 2024 · Fixed in 10.0.16 · NVD
  26. Medium 6.8

    CVE-2024-5913 · Palo Alto Networks PAN-OS

    An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the physical file system to elevate privileges.

    Published 10 Jul 2024 · Fixed in 11.0.5, 11.1.4, 11.2.1 · NVD
  27. High 7.0

    CVE-2024-5911 · Palo Alto Networks PAN-OS

    An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panorama to enter maintenance mode, which requires manual intervention to bring the Panorama back online.

    Published 10 Jul 2024 · Fixed in 10.1.9, 10.2.4 · NVD
  28. Medium 5.1

    CVE-2024-5492 · NetScaler ADC and Gateway

    Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites in NetScaler ADC and NetScaler Gateway

    Published 10 Jul 2024 · Fixed in 13.1-37.183, 13.1-53.17, 14.1-25.53 · NVD
  29. High 7.2

    CVE-2024-5491 · NetScaler ADC and Gateway

    Denial of Service in NetScaler ADC and NetScaler Gateway in NetScaler

    Published 10 Jul 2024 · Fixed in 13.1-37.183, 13.1-53.17, 14.1-25.53 · NVD
  30. Medium 4.3

    CVE-2024-37147 · GLPI

    GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16.

    Published 10 Jul 2024 · Fixed in 10.0.16 · NVD
  31. High 7.5

    CVE-2024-39693 · Next.js

    Next.js Denial of Service (DoS) condition

    Published 10 Jul 2024 · Fixed in 13.5.0 · OSV.dev and GitHub
  32. Medium 6.1

    CVE-2024-36453 · Webmin

    Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product. As a result, a webpage may be altered or sensitive information such as a credential may be disclosed.

    Published 10 Jul 2024 · Fixed in 1.970 · NVD
  33. Low 3.1

    CVE-2024-36452 · Webmin

    Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003. If this vulnerability is exploited, unintended operations may be performed when a user views a malicious page while logged in. As a result, data within a system may be referred, a webpage may be altered, or a server may be permanently halted.

    Published 10 Jul 2024 · Fixed in 2.003 · NVD
  34. High 8.8

    CVE-2024-36451 · Webmin

    Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploited, a console session may be hijacked by an unauthorized user. As a result, data within a system may be referred, a webpage may be altered, or a server may be permanently halted.

    Published 10 Jul 2024 · Fixed in 2.003 · NVD
  35. Medium 5.4

    CVE-2024-36450 · Webmin

    Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product. As a result, a session ID may be obtained, a webpage may be altered, or a server may be halted.

    Published 10 Jul 2024 · Fixed in 1.910 · NVD
  36. High 7.2

    CVE-2024-35154 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code. Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 292641.

    Published 9 Jul 2024 · NVD
  37. High 8.8

    CVE-2024-39063 · LimeSurvey

    Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). The YII_CSRF_TOKEN is only checked when passed in the body of POST requests, but the same check isn't performed in the equivalent GET requests.

    Published 9 Jul 2024 · NVD
  38. High 7.5

    CVE-2024-38095 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 9 Jul 2024 · Fixed in 8.0.7 · NVD
  39. High 8.8

    CVE-2024-38088 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  40. High 8.8

    CVE-2024-38087 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  41. High 7.3

    CVE-2024-38081 · .NET

    .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

    Published 9 Jul 2024 · Fixed in 6.0.32 · NVD
  42. High 8.8

    CVE-2024-37336 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  43. High 8.8

    CVE-2024-37334 · Microsoft SQL Server

    Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  44. High 8.8

    CVE-2024-37333 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  45. High 8.8

    CVE-2024-37332 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  46. High 8.8

    CVE-2024-37331 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  47. High 8.8

    CVE-2024-37330 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  48. High 8.8

    CVE-2024-37329 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  49. High 8.8

    CVE-2024-37328 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  50. High 8.8

    CVE-2024-37327 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.