UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,656
Published in 7 days
783
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,656 vulnerabilities
  1. High 8.8

    CVE-2024-37326 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  2. High 8.8

    CVE-2024-37324 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  3. High 8.8

    CVE-2024-37323 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  4. High 8.8

    CVE-2024-37322 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  5. High 8.8

    CVE-2024-37321 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  6. High 8.8

    CVE-2024-37320 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  7. High 8.8

    CVE-2024-37319 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  8. High 8.8

    CVE-2024-37318 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  9. High 8.8

    CVE-2024-35272 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  10. High 8.8

    CVE-2024-35271 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  11. High 8.1

    CVE-2024-35264 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 8.0.7 · NVD
  12. High 8.8

    CVE-2024-35256 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  13. High 7.5

    CVE-2024-30105 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 9 Jul 2024 · NVD
  14. High 8.8

    CVE-2024-28928 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  15. Medium 6.1

    CVE-2024-26279 · Joomla!

    The wrapper extensions do not correctly validate inputs, leading to XSS vectors.

    Published 9 Jul 2024 · Fixed in 3.10.16, 4.4.6, 5.1.2 · NVD
  16. Medium 6.1

    CVE-2024-26278 · Joomla!

    The Custom Fields component not correctly filter inputs, leading to a XSS vector.

    Published 9 Jul 2024 · Fixed in 3.10.16, 4.4.6, 5.1.2 · NVD
  17. Medium 6.1

    CVE-2024-21731 · Joomla!

    Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.

    Published 9 Jul 2024 · NVD
  18. Medium 5.4

    CVE-2024-21730 · Joomla!

    The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector.

    Published 9 Jul 2024 · Fixed in 4.4.6, 5.1.2 · NVD
  19. Medium 6.1

    CVE-2024-21729 · Joomla!

    Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.

    Published 9 Jul 2024 · Fixed in 4.4.6, 5.1.2 · NVD
  20. High 8.8

    CVE-2024-21449 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  21. High 8.8

    CVE-2024-21428 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  22. High 8.8

    CVE-2024-21425 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  23. High 8.8

    CVE-2024-21415 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  24. High 8.8

    CVE-2024-21414 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  25. High 8.8

    CVE-2024-21398 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  26. High 8.8

    CVE-2024-21373 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  27. High 8.8

    CVE-2024-21335 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  28. High 8.8

    CVE-2024-21333 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  29. High 8.8

    CVE-2024-21332 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  30. High 8.8

    CVE-2024-21331 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  31. High 8.8

    CVE-2024-21317 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  32. High 8.8

    CVE-2024-21308 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  33. High 8.8

    CVE-2024-21303 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  34. High 8.8

    CVE-2024-20701 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · NVD
  35. Medium 4.8

    CVE-2024-33509 · Fortinet FortiWeb

    An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and unauthenticated attacker in a Man-in-the-Middle position to decipher and/or tamper with the communication channel between the device and different endpoints used to fetch data for Web Application Firewall (WAF).

    Published 9 Jul 2024 · Fixed in 7.2.2 · NVD
  36. Medium 4.7

    CVE-2024-26015 · Fortinet FortiProxy, Fortinet FortiOS

    An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.15 and below IP address validation feature may permit an unauthenticated attacker to bypass the IP blocklist via crafted requests.

    Published 9 Jul 2024 · NVD
  37. Medium 6.8

    CVE-2024-2177 · GitLab

    A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload.

    Published 9 Jul 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  38. Medium 4.3

    CVE-2024-28882 · OpenVPN

    OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session

    Published 8 Jul 2024 · Fixed in 2.6.11 · NVD
  39. Medium 5.3

    CVE-2024-39896 · Directus

    Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user belongs to another…

    Published 8 Jul 2024 · Fixed in 10.13.0 · NVD
  40. Medium 6.5

    CVE-2024-39895 · Directus

    Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources,…

    Published 8 Jul 2024 · Fixed in 10.12.0 · NVD
  41. High 7.7

    CVE-2024-39701 · Directus

    Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin operators. It evaluates empty arrays as valid so expressions like {"role": {"_in": $CURRENT_USER.some_field}} would evaluate to true allowing the request to pass. This results in Broken Access Control because the rule fails to do what it was intended to do:…

    Published 8 Jul 2024 · Fixed in 10.6.0 · NVD
  42. Medium 5.0

    CVE-2024-39699 · Directus

    Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file import. It was fixed by resolving all DNS names and checking if the requested IP is an internal IP address. However it is possible to bypass this security measure and execute a SSRF using redirects. Directus allows redirects when importing file from the URL…

    Published 8 Jul 2024 · Fixed in 10.9.3 · NVD
  43. Critical 9.8

    CVE-2024-27903 · OpenVPN

    OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.

    Published 8 Jul 2024 · Fixed in 2.5.10, 2.6.10 · NVD
  44. High 7.8

    CVE-2024-27459 · OpenVPN

    The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges.

    Published 8 Jul 2024 · Fixed in 2.5.10, 2.6.10 · NVD
  45. High 7.5

    CVE-2024-24974 · OpenVPN

    The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service.

    Published 8 Jul 2024 · Fixed in 2.5.10, 2.6.10 · NVD
  46. Low

    CVE-2024-37372 · Node.js

    Permission model improperly processes UNC paths

    Published 8 Jul 2024 · Fixed in 20.15.1, 22.4.1 · nodejs
  47. High

    CVE-2024-36138 · Node.js

    Bypass incomplete fix of CVE-2024-27980

    Published 8 Jul 2024 · Fixed in 18.20.4, 20.15.1, 22.4.1 · nodejs
  48. Low

    CVE-2024-36137 · Node.js

    fs.fchown/fchmod bypasses permission model

    Published 8 Jul 2024 · Fixed in 20.15.1, 22.4.1 · nodejs
  49. Medium

    CVE-2024-22020 · Node.js

    Bypass network import restriction via data URL

    Published 8 Jul 2024 · Fixed in 18.20.4, 20.15.1, 22.4.1 · nodejs
  50. Low

    CVE-2024-22018 · Node.js

    fs.lstat bypasses permission model

    Published 8 Jul 2024 · Fixed in 20.15.1, 22.4.1 · nodejs

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.