UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,652
Published in 7 days
770
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,652 vulnerabilities
  1. High 7.5

    CVE-2024-32974 · Envoy

    Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after `StopReading()` being called on the stream. As after `StopReading()`, the HCM's `ActiveStream` might have already be destroyed and any up calls from QUICHE…

    Published 4 Jun 2024 · Fixed in 1.28.4, 1.29.5, 1.30.2 · NVD
  2. High 8.2

    CVE-2024-23326 · Envoy

    Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade,…

    Published 4 Jun 2024 · Fixed in 1.28.4, 1.29.5, 1.30.2 · NVD
  3. High 7.5

    CVE-2024-32871 · Pimcore

    Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing the file extension or scaling factor of the requested thumbnail, attackers can create files that are much larger in file size than the original. This vulnerability is fixed in 11.2.4.

    Published 4 Jun 2024 · Fixed in 11.2.4 · NVD
  4. High 8.8

    CVE-2024-37061 · MLflow

    Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run.

    Published 4 Jun 2024 · NVD
  5. High 8.8

    CVE-2024-37060 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run.

    Published 4 Jun 2024 · NVD
  6. High 8.8

    CVE-2024-37059 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  7. High 8.8

    CVE-2024-37058 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  8. High 8.8

    CVE-2024-37057 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  9. High 8.8

    CVE-2024-37056 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  10. High 8.8

    CVE-2024-37055 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  11. High 8.8

    CVE-2024-37054 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  12. High 8.8

    CVE-2024-37053 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  13. High 8.8

    CVE-2024-37052 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  14. Critical 9.1

    CVE-2024-36104 · Apache OFBiz

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.

    Published 4 Jun 2024 · Fixed in 18.12.14 · NVD
  15. High 7.5

    CVE-2024-36128 · Directus

    Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions depend on the…

    Published 3 Jun 2024 · Fixed in 10.11.2 · NVD
  16. High 8.8

    CVE-2024-23665 · Fortinet FortiWeb

    Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and below, version 6.4.3 and below, version 6.3.23 and below may allow an authenticated attacker to perform unauthorized ADOM operations via crafted requests.

    Published 3 Jun 2024 · Fixed in 7.2.8, 7.4.3 · NVD
  17. Medium 5.5

    CVE-2024-23107 · Fortinet FortiWeb

    An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions may allow an authenticated attacker to read password hashes of other administrators via CLI commands.

    Published 3 Jun 2024 · Fixed in 7.0.9, 7.2.5 · NVD
  18. Medium 6.1

    CVE-2024-4900 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Open Redirect

    Published 3 Jun 2024 · Fixed in 7.8 · WPVulnerability
  19. Medium 5.0

    CVE-2024-4899 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 3 Jun 2024 · Fixed in 7.8 · WPVulnerability
  20. Medium 5.4

    CVE-2024-4637 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 3 Jun 2024 · Fixed in 6.7.11 · NVD, WPVulnerability
  21. Medium 5.4

    CVE-2024-4581 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 3 Jun 2024 · Fixed in 6.7.11 · NVD, WPVulnerability
  22. High 7.5

    CVE-2024-34009 · Moodle

    Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.

    Published 31 May 2024 · Fixed in 4.3.4 · NVD
  23. High 8.8

    CVE-2024-34008 · Moodle

    Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  24. High 8.8

    CVE-2024-34007 · Moodle

    The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.

    Published 31 May 2024 · Fixed in 4.3.4 · NVD
  25. Medium 4.3

    CVE-2024-34006 · Moodle

    The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  26. Medium 6.5

    CVE-2024-34005 · Moodle

    In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  27. Medium 6.5

    CVE-2024-34004 · Moodle

    In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  28. Medium 5.9

    CVE-2024-34003 · Moodle

    In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  29. Medium 6.5

    CVE-2024-34002 · Moodle

    In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  30. High 8.4

    CVE-2024-34001 · Moodle

    Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  31. Medium 4.3

    CVE-2024-34000 · Moodle

    ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  32. Critical 9.8

    CVE-2024-33999 · Moodle

    The referrer URL used by MFA required additional sanitizing, rather than being used directly.

    Published 31 May 2024 · Fixed in 4.3.4 · NVD
  33. Medium 5.4

    CVE-2024-33998 · Moodle

    Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  34. Medium 6.1

    CVE-2024-33997 · Moodle

    Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  35. Medium 6.2

    CVE-2024-33996 · Moodle

    Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  36. High 8.8

    CVE-2024-37032 · Ollama

    Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.

    Published 31 May 2024 · Fixed in 0.1.34 · NVD
  37. Medium 6.5

    CVE-2024-4565 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Improper Access Control

    Published 30 May 2024 · Fixed in 6.3, 6.3.0 · NVD, WPVulnerability
  38. Medium 5.9

    CVE-2024-34385 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Cross-site Scripting

    Published 30 May 2024 · Fixed in 3.33.0 · WPVulnerability
  39. Medium 5.3

    CVE-2024-35200 · nginx

    When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.

    Published 29 May 2024 · Fixed in 1.26.1 · NVD
  40. Medium 5.3

    CVE-2024-34161 · nginx

    When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.

    Published 29 May 2024 · Fixed in 1.26.1 · NVD
  41. Medium 6.5

    CVE-2024-32760 · nginx

    When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.

    Published 29 May 2024 · Fixed in 1.26.1 · NVD
  42. Medium 4.8

    CVE-2024-31079 · nginx

    When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.

    Published 29 May 2024 · Fixed in 1.26.1 · NVD
  43. Critical 9.8

    CVE-2024-36470 · TeamCity

    In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases

    Published 29 May 2024 · Fixed in 2022.10.6, 2023.05.6, 2023.11.5 · NVD
  44. High 7.5

    CVE-2024-36378 · TeamCity

    In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens

    Published 29 May 2024 · Fixed in 2024.03.2 · NVD
  45. High 8.1

    CVE-2024-36377 · TeamCity

    In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions

    Published 29 May 2024 · Fixed in 2024.03.2 · NVD
  46. High 8.1

    CVE-2024-36376 · TeamCity

    In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions

    Published 29 May 2024 · Fixed in 2024.03.2 · NVD
  47. Medium 5.3

    CVE-2024-36375 · TeamCity

    In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed

    Published 29 May 2024 · Fixed in 2024.03.2 · NVD
  48. Medium 5.4

    CVE-2024-36374 · TeamCity

    In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible

    Published 29 May 2024 · Fixed in 2024.03.2 · NVD
  49. Medium 5.4

    CVE-2024-36373 · TeamCity

    In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible

    Published 29 May 2024 · Fixed in 2024.03.2 · NVD
  50. Medium 6.1

    CVE-2024-36372 · TeamCity

    In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible

    Published 29 May 2024 · Fixed in 2023.05.6 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.