UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,629
Published in 7 days
756
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,629 vulnerabilities
  1. Medium 5.3

    CVE-2024-34358 · TYPO3

    TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the `ShowImageController` (`_eID tx_cms_showpic_`) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3&...&frame=12345`). This allows adversaries to instruct the system…

    Published 14 May 2024 · Fixed in 11.5.37, 12.4.15, 13.1.1 · NVD
  2. Medium 5.4

    CVE-2024-34357 · TYPO3

    TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with…

    Published 14 May 2024 · Fixed in 11.5.37, 12.4.15, 13.1.1 · NVD
  3. Medium 5.4

    CVE-2024-34356 · TYPO3

    TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15…

    Published 14 May 2024 · Fixed in 11.5.37, 12.4.15, 13.1.1 · NVD
  4. Medium 5.4

    CVE-2024-34355 · TYPO3

    TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes…

    Published 14 May 2024 · Fixed in 13.1.1 · NVD
  5. Medium 5.4

    CVE-2024-32077 · Apache Airflow

    Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs.  Users are recommended to upgrade to version 2.9.1, which fixes this issue.

    Published 14 May 2024 · NVD
  6. Medium 6.5

    CVE-2024-4597 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. An attacker could force a user with an active SAML session to approve an MR via CSRF.

    Published 14 May 2024 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  7. Medium 6.5

    CVE-2024-4539 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 where abusing the API to filter branch and tags could lead to Denial of Service.

    Published 14 May 2024 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  8. Medium 4.3

    CVE-2024-4317 · PostgreSQL

    Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes…

    Published 14 May 2024 · Fixed in 14.12, 15.7, 16.3 · NVD
  9. Medium 5.4

    CVE-2024-4107 · Elementor

    The Elementor Website Builder – More than Just a Page Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in versions up to, and including, 3.21.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages…

    Published 14 May 2024 · Fixed in 3.21.1 · NVD
  10. Medium 5.4

    CVE-2024-34899 · AVideo

    WWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS).

    Published 14 May 2024 · NVD
  11. Medium 5.4

    CVE-2024-34709 · Directus

    Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they are not actually invalidated when logging out. The `directus_session` gets destroyed and the cookie gets deleted but if the cookie value is captured, it will still work for the entire expiry time which is set to 1 day by default. Making…

    Published 14 May 2024 · Fixed in 10.11.0 · NVD
  12. Medium 4.9

    CVE-2024-34708 · Directus

    Directus is a real-time API and App dashboard for managing SQL database content. A user with permission to view any collection using redacted hashed fields can get access the raw stored version using the `alias` functionality on the API. Normally, these redacted fields will return `**********` however if we change the request to `?alias[workaround]=redacted` we can instead retrieve the plain…

    Published 14 May 2024 · Fixed in 10.11.0 · NVD
  13. High 7.5

    CVE-2024-34459 · libxml2

    An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.

    Published 14 May 2024 · Fixed in 2.11.8, 2.12.7 · NVD
  14. Medium 6.5

    CVE-2024-32476 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.

    Published 14 May 2024 · Fixed in 2.8.17, 2.9.13, 2.10.8 · NVD
  15. Medium 6.5

    CVE-2024-2651 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. It was possible for an attacker to cause a denial of service using maliciously crafted markdown content.

    Published 14 May 2024 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  16. Medium 6.5

    CVE-2024-2454 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. The pins endpoint is susceptible to DoS through a crafted request.

    Published 14 May 2024 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  17. Medium 6.1

    CVE-2024-22910 · CrushFTP

    Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code via a crafted payload.

    Published 14 May 2024 · Fixed in 10.6.1 · NVD
  18. Medium 6.5

    CVE-2023-6688 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.11 prior to 16.11.2. A problem with the processing logic for Google Chat Messages integration may lead to a regular expression DoS attack on the server.

    Published 14 May 2024 · Fixed in 16.11.2 · NVD
  19. Medium 6.5

    CVE-2023-6682 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. A problem with the processing logic for Discord Integrations Chat Messages can lead to a regular expression DoS attack on the server.

    Published 14 May 2024 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  20. Medium 6.4

    CVE-2024-4984 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 14 May 2024 · Fixed in 22.7 · WPVulnerability
  21. Medium 5.4

    CVE-2024-4392 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting

    Published 13 May 2024 · Fixed in 13.4 · NVD, WPVulnerability
  22. Critical 9.6

    CVE-2024-34070 · Froxlor

    Blind XSS Leading to Froxlor Application Compromise

    Published 10 May 2024 · Fixed in 2.1.9 · Project advisories (GitHub)
  23. High 7.5

    CVE-2024-34351 · Next.js

    Next.js Server-Side Request Forgery in Server Actions

    Published 9 May 2024 · Fixed in 14.1.1 · OSV.dev and GitHub
  24. High 7.5

    CVE-2024-34350 · Next.js

    Next.js Vulnerable to HTTP Request Smuggling

    Published 9 May 2024 · Fixed in 13.5.1 · OSV.dev and GitHub
  25. High 7.5

    CVE-2024-33608 · F5 BIG-IP

    When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 8 May 2024 · NVD
  26. Medium 6.1

    CVE-2024-33604 · F5 BIG-IP

    A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    Published 8 May 2024 · Fixed in 15.1.10.4, 16.1.4.3, 17.1.1.3 · NVD
  27. Medium 6.5

    CVE-2024-32761 · F5 BIG-IP

    Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. This leak occurs randomly and cannot be deliberately triggered. If it occurs, it may leak up to 64 bytes of non-contiguous randomized bytes. Under rare conditions, this may lead to a TMM restart, affecting availability.  Note: Software versions…

    Published 8 May 2024 · Fixed in 15.1.10 · NVD
  28. Critical 9.8Actively exploited

    CVE-2024-32113 · Apache OFBiz

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.

    Published 8 May 2024 · Fixed in 18.12.13 · NVD
  29. High 8.0

    CVE-2024-31156 · F5 BIG-IP

    A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 8 May 2024 · Fixed in 15.1.10.4, 16.1.4.3, 17.1.1.3 · NVD
  30. Medium 5.9

    CVE-2024-28889 · F5 BIG-IP

    When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 8 May 2024 · Fixed in 15.1.10.4, 16.1.4.3, 17.1.1.3 · NVD
  31. High 7.4

    CVE-2024-28883 · F5 BIG-IP

    An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may allow an attacker to bypass F5 endpoint inspection. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 8 May 2024 · Fixed in 15.1.10.3, 16.1.4.2 · NVD
  32. Medium 4.7

    CVE-2024-27202 · F5 BIG-IP

    A DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 8 May 2024 · Fixed in 15.1.10.4, 16.1.4.3, 17.1.1.3 · NVD
  33. High 7.5

    CVE-2024-25560 · F5 BIG-IP

    When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 8 May 2024 · Fixed in 15.1.10.8, 16.1.4 · NVD
  34. Critical 9.0

    CVE-2024-34346 · Deno

    Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading `/proc/self/environ` may provide access equivalent to `--allow-env`, and writing `/proc/self/mem` may provide access equivalent to…

    Published 7 May 2024 · Fixed in 1.43.1 · NVD
  35. Medium 6.5

    CVE-2024-31456 · GLPI

    GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. This vulnerability is fixed in 10.0.15.

    Published 7 May 2024 · Fixed in 10.0.15 · NVD
  36. High 8.1

    CVE-2024-29889 · GLPI

    GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15.

    Published 7 May 2024 · Fixed in 10.0.15 · NVD
  37. Medium 4.3

    CVE-2024-28148 · Apache Superset

    An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue.

    Published 7 May 2024 · Fixed in 4.0.0 · NVD
  38. High 7.4

    CVE-2024-33602 · GNU C Library

    nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

    Published 6 May 2024 · Fixed in 2.40 · NVD
  39. High 7.3

    CVE-2024-33601 · GNU C Library

    nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd…

    Published 6 May 2024 · Fixed in 2.40 · NVD
  40. Medium 5.9

    CVE-2024-33600 · GNU C Library

    nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

    Published 6 May 2024 · Fixed in 2.40 · NVD
  41. High 8.1

    CVE-2024-33599 · GNU C Library

    nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

    Published 6 May 2024 · Fixed in 2.40 · NVD
  42. High 7.6

    CVE-2024-3661 · F5 BIG-IP

    DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

    Published 6 May 2024 · NVD
  43. Medium 6.1

    CVE-2024-4041 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 6 May 2024 · Fixed in 22.6 · WPVulnerability
  44. High 7.4

    CVE-2024-34507 · MediaWiki

    An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occur because of mishandling of the 0x1b character, as demonstrated by Special:RecentChanges#%1b0000000.

    Published 5 May 2024 · Fixed in 1.39.7, 1.40.3, 1.41.1 · NVD
  45. High 7.5

    CVE-2024-34506 · MediaWiki

    An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. If a user with the necessary rights to move the page opens Special:MovePage for a page with tens of thousands of subpages, then the page will exceed the maximum request time, leading to a denial of service.

    Published 5 May 2024 · Fixed in 1.39.7, 1.40.3, 1.41.1 · NVD
  46. Critical 9.8

    CVE-2024-34502 · MediaWiki

    An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.

    Published 5 May 2024 · Fixed in 1.39.6, 1.40.2, 1.41.1 · NVD
  47. Medium 6.1

    CVE-2024-34500 · MediaWiki

    An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.

    Published 5 May 2024 · Fixed in 1.39.6, 1.40.2, 1.41.1 · NVD
  48. Medium 4.9

    CVE-2024-28072 · SolarWinds Serv-U

    A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly.

    Published 3 May 2024 · Fixed in 15.4.2 · NVD
  49. Medium 6.1

    CVE-2024-4439 · WordPress

    WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In…

    Published 3 May 2024 · NVD
  50. High 8.8

    CVE-2023-42123 · Control Web Panel

    Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability. The specific flaw exists within the mysql_manager module. The issue results from the lack of proper validation of a user-supplied string…

    Published 3 May 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.