Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 32,658
- Published in 7 days
- 785
- Critical in 30 days
- 194
- Actively exploited
- 405
Latest vulnerabilities
32,658 vulnerabilities- Medium
CVE-2024-22020 · Node.js
Bypass network import restriction via data URL
Published 8 Jul 2024 · Fixed in 18.20.4, 20.15.1, 22.4.1 · nodejs - Low
CVE-2024-22018 · Node.js
fs.lstat bypasses permission model
Published 8 Jul 2024 · Fixed in 20.15.1, 22.4.1 · nodejs - Medium 4.8
CVE-2024-40605 · MediaWiki
An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.
Published 7 Jul 2024 · NVD - Medium 4.8
CVE-2024-40604 · MediaWiki
An issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sidebar menu and submenu entries.
Published 7 Jul 2024 · NVD - Medium 4.3
CVE-2024-40603 · MediaWiki
An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request.
Published 7 Jul 2024 · NVD - Medium 4.8
CVE-2024-40602 · MediaWiki
An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.
Published 7 Jul 2024 · NVD - Medium 6.5
CVE-2024-40601 · MediaWiki
An issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1. CSRF can occur in API modules.
Published 7 Jul 2024 · NVD - Medium 4.8
CVE-2024-40600 · MediaWiki
An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.
Published 7 Jul 2024 · NVD - Medium 4.8
CVE-2024-40599 · MediaWiki
An issue was discovered in the GuMaxDD skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.
Published 7 Jul 2024 · NVD - Medium 4.3
CVE-2024-40598 · MediaWiki
An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can expose suppressed information for log events. (The log_deleted attribute is not applied to entries.)
Published 7 Jul 2024 · NVD - High 7.5
CVE-2024-40597 · MediaWiki
An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. It can expose suppressed information for log events. (The log_deleted attribute is not respected.)
Published 7 Jul 2024 · NVD - Medium 4.3
CVE-2024-40596 · MediaWiki
An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed information for log events. (TimelineService does not support properly suppressing.)
Published 7 Jul 2024 · NVD - High 7.5
CVE-2024-39321 · Traefik
Traefik is an HTTP reverse proxy and load balancer. Versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3 have a vulnerability that allows bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses. Versions 2.11.6, 3.0.4, and 3.1.0-rc3 contain a patch for this issue. No known workarounds are available.
Published 5 Jul 2024 · Fixed in 2.11.6, 3.0.4 · NVD - High 8.2
CVE-2024-37903 · Mastodon
Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue.
Published 5 Jul 2024 · Fixed in 4.1.18, 4.2.10 · NVD - High 7.7
CVE-2024-39933 · Gogs
Gogs through 0.13.0 allows argument injection during the tagging of a new release.
Published 4 Jul 2024 · NVD - Critical 9.9
CVE-2024-39932 · Gogs
Gogs through 0.13.0 allows argument injection during the previewing of changes.
Published 4 Jul 2024 · NVD - Critical 9.9
CVE-2024-39931 · Gogs
Gogs through 0.13.0 allows deletion of internal files.
Published 4 Jul 2024 · NVD - Critical 9.9
CVE-2024-39930 · Gogs
The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected.
Published 4 Jul 2024 · NVD - Medium 5.4
CVE-2024-39929 · Exim
Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.
Published 4 Jul 2024 · NVD - Medium 6.2
CVE-2024-39884 · Apache HTTP Server
A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61,…
Published 4 Jul 2024 · NVD - Medium 6.5
CVE-2024-39683 · ZITADEL
ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent (browser). Starting in version 2.53.0 and prior to versions 2.53.8, 2.54.5, and 2.55.1, due to a missing check, user sessions without that information (e.g. when created though the session service) were incorrectly listed exposing potentially other user's…
Published 3 Jul 2024 · Fixed in 2.53.8, 2.54.5 · NVD - Medium 5.3
CVE-2024-37157 · Discourse
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, a malicious actor could get the FastImage library to redirect requests to an internal Discourse IP. This issue is patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches. No…
Published 3 Jul 2024 · Fixed in 3.2.3, 3.3.0 · NVD - Medium 4.3
CVE-2024-36122 · Discourse
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, moderators using the review queue to review users may see a users email address even when the Allow moderators to view email addresses setting is disabled. This issue is patched in version 3.2.3 on the `stable` branch and version…
Published 3 Jul 2024 · Fixed in 3.2.3, 3.3.0 · NVD - High 7.5
CVE-2024-34750 · Apache Tomcat
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been…
Published 3 Jul 2024 · Fixed in 9.0.90, 10.1.25 · NVD - Medium 6.5
CVE-2024-36113 · Discourse
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch, and version 3.3.0.beta4-dev on the `tests-passed` branch, a rogue staff user could suspend other staff users preventing them from logging in to the site. The issue is patched in version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch,…
Published 3 Jul 2024 · Fixed in 3.2.3, 3.3.0 · NVD - Medium 6.1
CVE-2024-35234 · Discourse
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version…
Published 3 Jul 2024 · Fixed in 3.2.3, 3.3.0 · NVD - High 8.8
CVE-2024-33871 · Ghostscript
An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded.
Published 3 Jul 2024 · Fixed in 10.03.1 · NVD - Medium 6.3
CVE-2024-33870 · Ghostscript
An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript document) to arbitrary files if the current directory is in the permitted paths. For example, there can be a transformation of ../../foo to ./../../foo and this will grant access if ./ is permitted.
Published 3 Jul 2024 · Fixed in 10.03.1 · NVD - Medium 5.3
CVE-2024-33869 · Ghostscript
An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename.
Published 3 Jul 2024 · Fixed in 10.03.1 · NVD - High 7.5
CVE-2024-29511 · Ghostscript
Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary files) via OCRLanguage. For example, exploitation can use debug_file /tmp/out and user_patterns_file /etc/passwd.
Published 3 Jul 2024 · Fixed in 10.03.1 · NVD - Medium 6.3
CVE-2024-29510 · Ghostscript
Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.
Published 3 Jul 2024 · Fixed in 10.03.1 · NVD - Medium 5.4
CVE-2024-29507 · Ghostscript
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.
Published 3 Jul 2024 · Fixed in 10.03.0 · NVD - High 7.5
CVE-2024-35227 · Discourse
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, Oneboxing against a carefully crafted malicious URL can reduce the availability of a Discourse instance. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. There are no known…
Published 3 Jul 2024 · NVD - High 8.8
CVE-2024-29509 · Ghostscript
Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a \000 byte in the middle.
Published 3 Jul 2024 · Fixed in 10.03.0 · NVD - Low 3.3
CVE-2024-29508 · Ghostscript
Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc.
Published 3 Jul 2024 · Fixed in 10.03.0 · NVD - High 8.8
CVE-2024-29506 · Ghostscript
Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfi_apply_filter() function via a long PDF filter name.
Published 3 Jul 2024 · Fixed in 10.03.0 · NVD - Medium 6.5
CVE-2024-6428 · Mattermost
Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2, 9.5.x <= 9.5.5 fail to prevent specifying a RemoteId when creating a new user which allows an attacker to specify both a remoteId and the user ID, resulting in creating a user with a user-defined user ID. This can cause some broken functionality in User Management such administrative actions against the user not working.
Published 3 Jul 2024 · Fixed in 9.6.3, 9.7.5, 9.8.1 · NVD - Medium 5.9
CVE-2024-39830 · Mattermost
Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled, fail to use constant time comparison for remote cluster tokens which allows an attacker to retrieve the remote cluster token via a timing attack during remote cluster token comparison.
Published 3 Jul 2024 · Fixed in 9.6.3, 9.7.5, 9.8.1 · NVD - Medium 5.3
CVE-2024-39807 · Mattermost
Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring webhook events to retrieve the channel IDs of archived or restored channels.
Published 3 Jul 2024 · Fixed in 9.5.6, 9.8.1 · NVD - Medium 5.4
CVE-2024-39361 · Mattermost
Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5 fail to prevent users from specifying a RemoteId for their posts which allows an attacker to specify both a remoteId and the post ID, resulting in creating a post with a user-defined post ID. This can cause some broken functionality in the channel or thread with user-defined posts
Published 3 Jul 2024 · Fixed in 9.6.3, 9.7.4, 9.8.1 · NVD - Low 2.7
CVE-2024-39353 · Mattermost
Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to sanitize the RemoteClusterFrame payloads before audit logging them which allows a high privileged attacker with access to the audit logs to read message contents.
Published 3 Jul 2024 · Fixed in 9.5.6 · NVD - Medium 5.3
CVE-2024-36257 · Mattermost
Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A requesting the server B to update the profile picture of a user is the remote that actually has the user as a local one . This allows a malicious remote A to change the profile images of users that belong to another remote server C that is…
Published 3 Jul 2024 · Fixed in 9.5.6 · NVD - Unrated
WPV-f1f8e8d7ebc0 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)
Vulnerability in Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing
Published 3 Jul 2024 · Fixed in 1.43.4 · WPVulnerability - Critical 9.1
CVE-2024-39305 · Envoy
Envoy is a cloud-native, open source edge and service proxy. Prior to versions 1.30.4, 1.29.7, 1.28.5, and 1.27.7. Envoy references already freed memory when route hash policy is configured with cookie attributes. Note that this vulnerability has been fixed in the open as the effect would be immediately apparent if it was configured. Memory allocated for holding attribute values is freed after…
Published 1 Jul 2024 · NVD - High 7.8
CVE-2024-32230 · FFmpeg
FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0
Published 1 Jul 2024 · NVD - High 8.4
CVE-2024-32229 · FFmpeg
FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column.
Published 1 Jul 2024 · NVD - Medium 6.6
CVE-2024-32228 · FFmpeg
FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end.
Published 1 Jul 2024 · NVD - High 7.5
CVE-2024-39573 · Apache HTTP Server
Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Published 1 Jul 2024 · Fixed in 2.4.60 · NVD - High 7.5
CVE-2024-38477 · Apache HTTP Server
null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Published 1 Jul 2024 · Fixed in 2.4.60 · NVD - Critical 9.8
CVE-2024-38476 · Apache HTTP Server
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Published 1 Jul 2024 · Fixed in 2.4.60 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.