UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,652
Published in 7 days
782
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,652 vulnerabilities
  1. Medium 5.4

    CVE-2024-26037 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit…

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  2. Medium 5.4

    CVE-2024-26036 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  3. Critical 9.8

    CVE-2024-26029 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain disclose information. Exploitation of this issue does not require user interaction.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  4. Medium 5.4

    CVE-2024-20784 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  5. Medium 5.4

    CVE-2024-20769 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  6. Medium 4.4

    CVE-2024-4201 · GitLab

    A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting from 16.11 before 16.111.4, all versions starting from 17.0 before 17.0.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances.

    Published 12 Jun 2024 · Fixed in 16.10.7, 16.111.4, 17.0.2 · NVD
  7. Medium 6.5

    CVE-2024-1963 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.4 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's Asana integration allowed an attacker to potentially cause a regular expression denial of service by sending specially crafted requests.

    Published 12 Jun 2024 · Fixed in 16.10.7, 16.11.4, 17.0.2 · NVD
  8. Medium 6.5

    CVE-2024-1736 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's CI/CD pipeline editor could allow for denial of service attacks through maliciously crafted configuration files.

    Published 12 Jun 2024 · Fixed in 16.10.7, 16.11.4, 17.0.2 · NVD
  9. Medium 6.5

    CVE-2024-1495 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.1 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. It was possible for an attacker to cause a denial of service using maliciously crafted file.

    Published 12 Jun 2024 · Fixed in 16.10.7, 16.11.4, 17.0.2 · NVD
  10. High 7.5

    CVE-2024-5798 · HashiCorp Vault

    Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0,…

    Published 12 Jun 2024 · Fixed in 1.15.9, 1.16.3 · NVD
  11. High 8.1

    CVE-2024-34065 · Strapi

    Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction (one click). Unauthenticated…

    Published 12 Jun 2024 · Fixed in 4.24.2 · NVD
  12. Medium 6.5

    CVE-2024-31217 · Strapi

    Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause it to log the error and keep it running for other clients. This behavior, in contrast, stops the…

    Published 12 Jun 2024 · Fixed in 4.22.0 · NVD
  13. Low 3.5

    CVE-2024-29181 · Strapi

    Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create. They should see nothing but their own items they created not all items ever created. Users should…

    Published 12 Jun 2024 · Fixed in 4.19.1 · NVD
  14. Medium 6.5

    CVE-2024-23445 · Elasticsearch

    It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#security-api-create-cross-cluster-api-key-request-body  restricts search for a given index using the query or the field_security parameter, and the same cross-cluster API key also grants replication for the same index, the search…

    Published 12 Jun 2024 · Fixed in 8.14.0 · NVD
  15. High 7.5

    CVE-2024-26010 · Fortinet FortiProxy, Fortinet FortiOS

    A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.14, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9, FortiProxy 7.0.0 through…

    Published 11 Jun 2024 · Fixed in 7.2.8, 7.2.10, 7.4.4 · NVD
  16. Medium 4.8

    CVE-2024-23111 · Fortinet FortiProxy, Fortinet FortiOS

    An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions reboot page may allow a remote privileged attacker with super-admin access to execute JavaScript code via crafted HTTP GET requests.

    Published 11 Jun 2024 · Fixed in 7.2.9, 7.4.3, 7.4.4 · NVD
  17. High 7.8

    CVE-2024-23110 · Fortinet FortiOS

    A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0 all versions allows attacker to execute unauthorized code or commands via specially crafted commands

    Published 11 Jun 2024 · Fixed in 7.0.14, 7.2.7, 7.4.3 · NVD
  18. Medium 4.4

    CVE-2024-21754 · Fortinet FortiProxy, Fortinet FortiOS

    A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged attacker with super-admin profile and CLI access to decrypting the backup file.

    Published 11 Jun 2024 · Fixed in 7.2.9, 7.4.3, 7.4.4 · NVD
  19. High 7.8

    CVE-2023-46720 · Fortinet FortiOS

    A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16 and 6.0.13 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted CLI commands.

    Published 11 Jun 2024 · Fixed in 7.2.8, 7.4.3 · NVD
  20. Medium 5.3

    CVE-2023-28775 · Yoast SEO

    Missing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4.

    Published 11 Jun 2024 · Fixed in 20.5 · NVD
  21. Medium 5.5

    CVE-2024-22261 · Harbor

    SQL-Injection in Harbor allows priviledge users to leak the task IDs

    Published 11 Jun 2024 · Fixed in 2.8.6, 2.9.4, 2.10.2 · NVD
  22. Unrated

    WPV-a4fb4d839020 · WooCommerce

    Vulnerability in WooCommerce

    Published 11 Jun 2024 · Fixed in 8.9.3 · WPVulnerability
  23. Medium 5.4

    CVE-2024-4627 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 11 Jun 2024 · Fixed in 1.0.219 · WPVulnerability
  24. Medium 6.1

    CVE-2024-22244 · Harbor

    Open Redirect in Harbor  <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site.

    Published 10 Jun 2024 · Fixed in 2.8.5, 2.9.3 · NVD
  25. Critical 9.8

    CVE-2024-37014 · Langflow

    Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.

    Published 10 Jun 2024 · NVD
  26. Medium 5.4

    CVE-2024-5530 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 10 Jun 2024 · Fixed in 2.9.1 · WPVulnerability
  27. Medium 5.4

    CVE-2024-37297 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 10 Jun 2024 · Fixed in 8.8.5, 8.9.3 · NVD, WPVulnerability
  28. Critical 9.8Actively exploited

    CVE-2024-4577 · PHP

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP…

    Published 9 Jun 2024 · Fixed in 8.1.29, 8.2.20, 8.3.8 · NVD
  29. Medium 5.9

    CVE-2024-2408 · PHP

    The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to…

    Published 9 Jun 2024 · Fixed in 8.1.29, 8.2.20, 8.3.8 · NVD
  30. High 8.8

    CVE-2024-5585 · PHP

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary…

    Published 9 Jun 2024 · Fixed in 8.1.29, 8.2.20, 8.3.8 · NVD
  31. Medium 5.3

    CVE-2024-5458 · PHP

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid…

    Published 9 Jun 2024 · Fixed in 8.1.29, 8.2.20, 8.3.8 · NVD
  32. Critical 9.8

    CVE-2024-37385 · Roundcube

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.

    Published 7 Jun 2024 · Fixed in 1.5.7, 1.6.7 · NVD
  33. Medium 6.1

    CVE-2024-37384 · Roundcube

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.

    Published 7 Jun 2024 · Fixed in 1.5.7, 1.6.7 · NVD
  34. Medium 6.1Actively exploited

    CVE-2024-37383 · Roundcube

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

    Published 7 Jun 2024 · Fixed in 1.5.7, 1.6.7 · NVD
  35. High 7.2

    CVE-2024-5225 · LiteLLM

    An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidated `api_key` parameter directly into the query, making it susceptible to SQL Injection if the…

    Published 6 Jun 2024 · NVD
  36. Medium 4.9

    CVE-2024-4890 · LiteLLM

    A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'user_id' parameter, leading to potential…

    Published 6 Jun 2024 · NVD
  37. High 8.1

    CVE-2024-4888 · LiteLLM

    BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes the specified file without proper authorization or validation. This vulnerability is present in the…

    Published 6 Jun 2024 · Fixed in 1.35.19 · NVD
  38. High 7.5

    CVE-2024-2928 · MLflow

    A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local…

    Published 6 Jun 2024 · Fixed in 2.11.3 · NVD
  39. High 8.8

    CVE-2024-0520 · MLflow

    A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.http_dataset_source.py` module. Specifically, when loading a dataset from a source URL with an HTTP scheme, the filename extracted from the `Content-Disposition` header or the URL path is used to…

    Published 6 Jun 2024 · Fixed in 2.9.0 · NVD
  40. High 7.2

    CVE-2024-4889 · LiteLLM

    A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated input in the eval function within the secret management system. This vulnerability requires a valid Google KMS configuration file to be exploitable. Specifically, by setting the `UI_LOGO_PATH` variable to a remote server address in the `get_image` function, an attacker can…

    Published 6 Jun 2024 · Fixed in 1.44.16 · NVD
  41. High 7.5

    CVE-2024-37152 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

    Published 6 Jun 2024 · Fixed in 2.9.17, 2.10.12, 2.11.3 · NVD
  42. Medium 6.5

    CVE-2024-37150 · Deno

    An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno would send `.npmrc` credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private registry references tarball URLs at a different domain. This includes usage of deno install…

    Published 6 Jun 2024 · NVD
  43. Medium 4.3

    CVE-2024-36106 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

    Published 6 Jun 2024 · Fixed in 2.9.17, 2.10.12, 2.11.3 · NVD
  44. High 7.5Actively exploited

    CVE-2024-28995 · SolarWinds Serv-U

    SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.

    Published 6 Jun 2024 · Fixed in 15.4.2 · NVD
  45. Medium 6.1

    CVE-2024-4704 · Contact Form 7

    Contact Form 7: Open Redirect

    Published 5 Jun 2024 · Fixed in 5.9.5 · NVD, WPVulnerability
  46. Medium 6.5

    CVE-2024-34364 · Envoy

    Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.

    Published 4 Jun 2024 · Fixed in 1.28.4, 1.29.5, 1.30.2 · NVD
  47. High 7.5

    CVE-2024-34363 · Envoy

    Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann JSON library, the library could throw an uncaught exception from downstream data if incomplete UTF-8 strings were serialized. The uncaught exception would cause Envoy to crash.

    Published 4 Jun 2024 · Fixed in 1.28.4, 1.29.5, 1.30.2 · NVD
  48. Medium 5.9

    CVE-2024-34362 · Envoy

    Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in `HttpConnectionManager` (HCM) with `EnvoyQuicServerStream` that can crash Envoy. An attacker can exploit this vulnerability by sending a request without `FIN`, then a `RESET_STREAM` frame, and then after receiving the response, closing the connection.

    Published 4 Jun 2024 · Fixed in 1.28.4, 1.29.5, 1.30.2 · NVD
  49. High 7.5

    CVE-2024-32976 · Envoy

    Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompression of Brotli data with extra input.

    Published 4 Jun 2024 · Fixed in 1.28.4, 1.29.5, 1.30.2 · NVD
  50. High 7.5

    CVE-2024-32975 · Envoy

    Envoy is a cloud-native, open source edge and service proxy. There is a crash at `QuicheDataReader::PeekVarInt62Length()`. It is caused by integer underflow in the `QuicStreamSequencerBuffer::PeekRegion()` implementation.

    Published 4 Jun 2024 · Fixed in 1.28.4, 1.29.5, 1.30.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.