UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,658
Published in 7 days
785
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,658 vulnerabilities
  1. Critical 9.1Actively exploited

    CVE-2024-38475 · Apache HTTP Server

    Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the…

    Published 1 Jul 2024 · Fixed in 2.4.60 · NVD
  2. Critical 9.8

    CVE-2024-38474 · Apache HTTP Server

    Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute…

    Published 1 Jul 2024 · Fixed in 2.4.60 · NVD
  3. High 8.1

    CVE-2024-38473 · Apache HTTP Server

    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

    Published 1 Jul 2024 · Fixed in 2.4.60 · NVD
  4. High 7.5

    CVE-2024-38472 · Apache HTTP Server

    SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.

    Published 1 Jul 2024 · Fixed in 2.4.60 · NVD
  5. Medium 6.1

    CVE-2024-37146 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/credentials/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the attacker…

    Published 1 Jul 2024 · NVD
  6. Medium 6.1

    CVE-2024-37145 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/chatflows-streaming/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the…

    Published 1 Jul 2024 · NVD
  7. Medium 6.1

    CVE-2024-36423 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/public-chatflows/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the…

    Published 1 Jul 2024 · NVD
  8. Medium 5.4

    CVE-2024-36387 · Apache HTTP Server

    Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

    Published 1 Jul 2024 · NVD
  9. Medium 5.3

    CVE-2024-39879 · TeamCity

    In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings

    Published 1 Jul 2024 · Fixed in 2024.03.3 · NVD
  10. Medium 5.3

    CVE-2024-39878 · TeamCity

    In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection

    Published 1 Jul 2024 · Fixed in 2024.03.3 · NVD
  11. High 8.1

    CVE-2024-36997 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in the browser context of another Splunk user through the conf-web/settings REST endpoint. This could potentially cause a persistent cross-site scripting (XSS) exploit.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  12. Medium 5.3

    CVE-2024-36996 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive from the instance when they attempt to log in. This disclosure could then lead to additional brute-force password-guessing attacks. This…

    Published 1 Jul 2024 · Fixed in 9.1.5, 9.2.2 · NVD
  13. Low 3.5

    CVE-2024-36995 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could create experimental items.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  14. Medium 5.4

    CVE-2024-36994 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View and Splunk Web Bulletin Messages that could result in execution of unauthorized JavaScript code in the browser of a user.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  15. Medium 5.4

    CVE-2024-36993 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a Splunk Web Bulletin Messages that could result in execution of unauthorized JavaScript code in the browser of a user.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  16. Medium 5.4

    CVE-2024-36992 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that could result in execution of unauthorized JavaScript code in the browser of a user. The “url” parameter of the Dashboard element does not…

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  17. High 7.5

    CVE-2024-36991 · Splunk Enterprise

    In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  18. Medium 6.5

    CVE-2024-36990 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an authenticated, low-privileged user that does not hold the admin or power Splunk roles could send a specially crafted HTTP POST request to the datamodel/web REST endpoint in Splunk Enterprise, potentially causing a denial of service.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  19. Medium 4.3

    CVE-2024-36989 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold the admin or power Splunk roles could create notifications in Splunk Web Bulletin Messages that all users on the instance receive.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  20. Medium 6.5

    CVE-2024-36987 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the admin or power Splunk roles could upload a file with an arbitrary extension using the indexing/preview REST endpoint.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  21. Medium 5.7

    CVE-2024-36986 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safeguards for risky commands in the Analytics Workspace. The vulnerability requires the authenticated user to phish the victim by tricking them into…

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  22. High 8.8

    CVE-2024-36985 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  23. High 8.8

    CVE-2024-36984 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  24. High 8.8

    CVE-2024-36983 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user could create an external lookup that calls a legacy internal function. The authenticated user could use this internal function to insert code into the Splunk platform installation directory. From there, the user could execute arbitrary code on…

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  25. High 7.5

    CVE-2024-36982 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash of the Splunk daemon.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  26. Medium 6.1

    CVE-2024-36422 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `api/v1/chatflows/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the attacker to…

    Published 1 Jul 2024 · NVD
  27. High 7.5

    CVE-2024-36421 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration (unauthenticated), arbitrary origins may be able to make requests to Flowise, stealing information from the user. This…

    Published 1 Jul 2024 · NVD
  28. High 7.5

    CVE-2024-36420 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endpoint in `index.ts` is vulnerable to arbitrary file read due to lack of sanitization of the `fileName` body parameter. No known patches for this issue are available.

    Published 1 Jul 2024 · NVD
  29. Medium 6.5

    CVE-2024-6375 · MongoDB

    A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server v5.0 versions, prior to 5.0.22, MongoDB Server v6.0 versions, prior to 6.0.11 and MongoDB Server v7.0 versions prior to…

    Published 1 Jul 2024 · Fixed in 5.0.22, 6.0.11, 7.0.3 · NVD
  30. High 8.1

    CVE-2024-6387 · OpenSSH

    A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

    Published 1 Jul 2024 · Fixed in 4.4 · NVD
  31. Critical 9.8

    CVE-2024-38371 · authentik

    authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This issue has been patched in version(s) 2024.6.0, 2024.2.4 and 2024.4.3.

    Published 28 Jun 2024 · Fixed in 2024.2.4, 2024.4.3 · NVD
  32. High 8.8

    CVE-2024-37905 · authentik

    authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik application, including resetting user passwords and more. This issue has been patched in version(s) 2024.2.4, 2024.4.2 and…

    Published 28 Jun 2024 · Fixed in 2024.2.4, 2024.4.3 · NVD
  33. High 7.5

    CVE-2024-5598 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Insecure Storage of Sensitive Information

    Published 28 Jun 2024 · Fixed in 5.2.5 · WPVulnerability
  34. Medium 4.8

    CVE-2024-37449 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 28 Jun 2024 · Fixed in 6.7.14 · NVD, WPVulnerability
  35. Medium 5.4

    CVE-2024-37437 · Elementor

    Elementor Website Builder – more than just a page builder: Path Traversal

    Published 28 Jun 2024 · Fixed in 3.22.2 · NVD, WPVulnerability
  36. Critical 9.8

    CVE-2024-5751 · LiteLLM

    BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the `add_deployment` function, which decodes and decrypts environment variables from base64 and assigns them to `os.environ`. An attacker can exploit this by sending a malicious payload to the `/config/update` endpoint, which is then processed and executed by…

    Published 27 Jun 2024 · NVD
  37. Medium 6.5

    CVE-2024-5710 · LiteLLM

    berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. The vulnerability stems from insufficient access control checks in…

    Published 27 Jun 2024 · NVD
  38. Medium 4.8

    CVE-2024-35153 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 292640.

    Published 27 Jun 2024 · Fixed in 8.5.5.26, 9.0.5.21 · NVD
  39. High 7.5

    CVE-2024-6323 · GitLab

    Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17.1.1 allows an attacker leak content of a private repository in a public project.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  40. High 8.8

    CVE-2024-5655 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to trigger a pipeline as another user under certain circumstances.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  41. Medium 4.9

    CVE-2024-5430 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.10 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows a project maintainer can delete the merge request approval policy via graphQL.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  42. Medium 5.4

    CVE-2024-4901 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, where a stored XSS vulnerability could be imported from a project with malicious commit notes.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  43. Medium 6.5

    CVE-2024-4557 · GitLab

    Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1 which allowed an attacker to cause resource exhaustion via banzai pipeline.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  44. Medium 4.3

    CVE-2024-4011 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows non-project member to promote key results to objectives.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  45. Medium 6.5

    CVE-2024-3959 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows private job artifacts can be accessed by any user.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  46. Medium 4.3

    CVE-2024-3115 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to access issues and epics without having an SSO session using Duo Chat.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  47. Medium 5.3

    CVE-2024-2191 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  48. Medium 5.5

    CVE-2024-1816 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 12.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows for an attacker to cause a denial of service using a crafted OpenAPI file.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  49. Medium 6.5

    CVE-2024-1493 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the server

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  50. Low 3.5

    CVE-2024-35777 · WooCommerce

    WooCommerce: Injection

    Published 27 Jun 2024 · Fixed in 9.0.0 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.