UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,658
Published in 7 days
785
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,658 vulnerabilities
  1. Medium 5.4

    CVE-2024-25637 · October CMS

    October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX handler name and allows unescaped HTML to be reflected back. There is no impact since this vulnerability cannot be exploited through normal browser interactions. This unescaped value is only detectable when using a proxy interception tool. This issue has been…

    Published 26 Jun 2024 · Fixed in 3.5.15 · NVD
  2. Medium 4.8

    CVE-2024-24764 · October CMS

    October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (`october://`) allowed external links, therefore allowing an open redirect outside the scope of the active host. This vulnerability has been patched in version…

    Published 26 Jun 2024 · Fixed in 3.5.15 · NVD
  3. Medium 4.3

    CVE-2024-37251 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Cross-Site Request Forgery (CSRF)

    Published 26 Jun 2024 · Fixed in 6.3.2 · WPVulnerability
  4. Medium 5.4

    CVE-2024-37250 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Missing Authorization

    Published 26 Jun 2024 · Fixed in 6.3.2 · WPVulnerability
  5. Medium 4.3

    CVE-2024-37249 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Missing Authorization

    Published 26 Jun 2024 · Fixed in 6.3.2 · WPVulnerability
  6. Critical 9.8

    CVE-2024-37843 · Craft CMS

    Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

    Published 25 Jun 2024 · Fixed in 3.7.31 · NVD
  7. Medium 6.3

    CVE-2024-37894 · Squid

    Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.

    Published 25 Jun 2024 · Fixed in 6.10 · NVD
  8. Medium 5.3

    CVE-2024-6238 · pgAdmin

    pgAdmin <= 8.8 has an installation Directory permission issue. Because of this issue, attackers can gain unauthorised access to the installation directory on the Debian or RHEL 8 platforms.

    Published 25 Jun 2024 · Fixed in 8.9 · NVD
  9. Critical 9.8

    CVE-2024-5806 · MOVEit Transfer

    Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.

    Published 25 Jun 2024 · Fixed in 2023.0.11, 2023.1.6 · NVD
  10. Medium 5.3

    CVE-2024-37087 · VMware vCenter Server

    The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition.

    Published 25 Jun 2024 · NVD
  11. Medium 6.8

    CVE-2024-37086 · VMware ESXi

    VMware ESXi contains an out-of-bounds read vulnerability. A malicious actor with local administrative privileges on a virtual machine with an existing snapshot may trigger an out-of-bounds read leading to a denial-of-service condition of the host.

    Published 25 Jun 2024 · NVD
  12. High 7.2Actively exploited

    CVE-2024-37085 · VMware ESXi

    VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was…

    Published 25 Jun 2024 · NVD
  13. Medium 5.4

    CVE-2024-34142 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 25 Jun 2024 · Fixed in 6.5.21.0, 2024.5.0 · NVD
  14. Medium 5.4

    CVE-2024-34141 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 25 Jun 2024 · Fixed in 6.5.21.0, 2024.5.0 · NVD
  15. Unrated

    WPV-11f7e3fe76dc · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Vulnerability in Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing

    Published 25 Jun 2024 · Fixed in 1.43.4 · WPVulnerability
  16. High 7.2

    CVE-2024-21519 · OpenCart

    This affects versions of the package opencart/opencart from 4.0.0.0. An Arbitrary File Creation issue was identified via the database restoration functionality. By injecting PHP code into the database, an attacker with admin privileges can create a backup file with an arbitrary filename (including the extension), within /system/storage/backup. **Note:** It is less likely for the created file to…

    Published 22 Jun 2024 · NVD
  17. High 7.2

    CVE-2024-21518 · OpenCart

    This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An attacker can create arbitrary files in the web root of the application and overwrite other existing files…

    Published 22 Jun 2024 · NVD
  18. Low 1.2

    CVE-2024-21517 · OpenCart

    This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the redirect parameter of customer account/login route. An attacker can inject arbitrary HTML and Javascript into the page response. As this vulnerability is present in the account functionality it could be used to target and attack customers of the OpenCart shop. **Notes:** 1) The fix…

    Published 22 Jun 2024 · NVD
  19. Low 1.2

    CVE-2024-21516 · OpenCart

    This affects versions of the package opencart/opencart from 4.0.0.0 and before 4.1.0.0. A reflected XSS issue was identified in the directory parameter of admin common/filemanager.list route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login and redirected again upon authentication with the payload automatically…

    Published 22 Jun 2024 · NVD
  20. Low 1.2

    CVE-2024-21515 · OpenCart

    This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login and redirected again upon authentication with the payload automatically executing. If the attacked…

    Published 22 Jun 2024 · NVD
  21. High 8.1

    CVE-2024-21514 · OpenCart

    This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9. As an anonymous unauthenticated user, if the Divido payment module is installed (it does not have to be enabled), it is possible to exploit SQL injection to gain unauthorised access to the backend…

    Published 22 Jun 2024 · NVD
  22. Medium 4.3

    CVE-2024-37236 · Loco Translate (WordPress plugin)

    Loco Translate: Cross-Site Request Forgery (CSRF)

    Published 21 Jun 2024 · Fixed in 2.6.10 · WPVulnerability
  23. High 8.6

    CVE-2024-37818 · Strapi

    Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request. NOTE: The Strapi Development Community argues that this issue is not valid. They contend that "the strapi/admin was wrongly attributed a flaw that only pertains…

    Published 20 Jun 2024 · NVD
  24. Medium 5.5

    CVE-2024-37674 · Moodle

    Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.

    Published 20 Jun 2024 · NVD
  25. High 8.8

    CVE-2024-37532 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. IBM X-Force ID: 294721.

    Published 20 Jun 2024 · NVD
  26. Medium 5.3

    CVE-2024-34693 · Apache Superset

    Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the…

    Published 20 Jun 2024 · Fixed in 3.1.3, 4.0.1 · NVD
  27. Medium 6.5

    CVE-2024-29013 · SonicWall SonicOS

    Heap-based buffer overflow vulnerability in the SonicOS SSL-VPN allows an authenticated remote attacker to cause Denial of Service (DoS) via memcpy function.

    Published 20 Jun 2024 · Fixed in 7.0.1-5161, 7.1.1-7058, 7.1.2-7019 · NVD
  28. High 7.5

    CVE-2024-29012 · SonicWall SonicOS

    Stack-based buffer overflow vulnerability in the SonicOS HTTP server allows an authenticated remote attacker to cause Denial of Service (DoS) via sscanf function.

    Published 20 Jun 2024 · Fixed in 7.0.1-5161, 7.1.1-7058, 7.1.2-7019 · NVD
  29. Medium 4.9

    CVE-2024-23443 · Kibana

    A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.

    Published 19 Jun 2024 · Fixed in 7.17.22, 8.14.0 · NVD
  30. Medium 5.4

    CVE-2024-1168 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 19 Jun 2024 · Fixed in 7.9.1 · WPVulnerability
  31. Medium 5.4

    CVE-2024-38277 · Moodle

    A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.

    Published 18 Jun 2024 · Fixed in 4.1.11, 4.2.8, 4.3.5 · NVD
  32. High 8.8

    CVE-2024-38276 · Moodle

    Incorrect CSRF token checks resulted in multiple CSRF risks.

    Published 18 Jun 2024 · Fixed in 4.1.10, 4.2.8, 4.3.5 · NVD
  33. High 7.5

    CVE-2024-38275 · Moodle

    The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

    Published 18 Jun 2024 · Fixed in 4.1.11, 4.2.8, 4.3.5 · NVD
  34. Medium 6.1

    CVE-2024-38274 · Moodle

    Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.

    Published 18 Jun 2024 · Fixed in 4.1.11, 4.2.8, 4.3.5 · NVD
  35. Medium 5.4

    CVE-2024-38273 · Moodle

    Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.

    Published 18 Jun 2024 · Fixed in 4.1.11, 4.2.8, 4.3.5 · NVD
  36. High 8.8

    CVE-2024-37821 · Dolibarr ERP CRM

    An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file.

    Published 18 Jun 2024 · Fixed in 19.0.2 · NVD
  37. Medium 6.5

    CVE-2024-21685 · Jira

    This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center. This Information Disclosure vulnerability, with a CVSS Score of 7.4, allows an unauthenticated attacker to view sensitive information via an Information Disclosure vulnerability which has high impact to confidentiality, no impact to integrity, no impact to…

    Published 18 Jun 2024 · Fixed in 9.4.21, 9.12.8, 9.16.0 · NVD
  38. High 7.8

    CVE-2024-37081 · VMware vCenter Server

    The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.

    Published 18 Jun 2024 · NVD
  39. Critical 9.8

    CVE-2024-37080 · VMware vCenter Server

    vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

    Published 18 Jun 2024 · NVD
  40. Critical 9.8Actively exploited

    CVE-2024-37079 · VMware vCenter Server

    vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

    Published 18 Jun 2024 · NVD
  41. Critical 9.8

    CVE-2024-5488 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Deserialization of Untrusted Data

    Published 18 Jun 2024 · Fixed in 7.9 · WPVulnerability
  42. Critical 9.1

    CVE-2024-34451 · Ghost

    Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers.

    Published 16 Jun 2024 · NVD
  43. Medium 6.5

    CVE-2024-38460 · SonarQube Server

    In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).

    Published 16 Jun 2024 · Fixed in 9.9.4, 10.4 · NVD
  44. High 8.8

    CVE-2024-38458 · XenForo

    Xenforo before 2.2.16 allows code injection.

    Published 16 Jun 2024 · Fixed in 2.2.16 · NVD
  45. High 8.8

    CVE-2024-38457 · XenForo

    Xenforo before 2.2.16 allows CSRF.

    Published 16 Jun 2024 · Fixed in 2.2.16 · NVD
  46. Low 3.5

    CVE-2024-37887 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that the Nextcloud Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1 and that the Nextcloud Enterprise Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1.

    Published 14 Jun 2024 · Fixed in 27.1.10, 28.0.6 · NVD
  47. Medium 5.4

    CVE-2024-37884 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3.

    Published 14 Jun 2024 · Fixed in 26.0.13, 27.1.8, 28.0.4 · NVD
  48. High 8.1

    CVE-2024-37882 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4 and that the Nextcloud Enterprise Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4.

    Published 14 Jun 2024 · Fixed in 26.0.13, 27.1.8, 28.0.4 · NVD
  49. Medium 4.3

    CVE-2024-37315 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled. It is recommended that the Nextcloud Server is upgraded to 26.0.12, 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 23.0.12.16, 24.0.12.12, 25.0.13.6, 26.0.12, 27.1.7 or 28.0.3.

    Published 14 Jun 2024 · Fixed in 26.0.12, 27.1.7, 28.0.3 · NVD
  50. Low 3.5

    CVE-2024-37314 · Nextcloud

    Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud Enterprise Server is upgraded to 25.0.7 or 26.0.2.

    Published 14 Jun 2024 · Fixed in 25.0.7, 26.0.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.