UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,629
Published in 7 days
756
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,629 vulnerabilities
  1. High 7.8

    CVE-2023-42122 · Control Web Panel

    Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Control Web Panel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the cwpsrv process, which listens…

    Published 3 May 2024 · NVD
  2. Critical 9.8

    CVE-2023-42121 · Control Web Panel

    Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of authentication within the web interface. The issue results from the lack of…

    Published 3 May 2024 · NVD
  3. High 8.8

    CVE-2023-42120 · Control Web Panel

    Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability. The specific flaw exists within the dns_zone_editor module. The issue results from the lack of proper validation of a user-supplied…

    Published 3 May 2024 · NVD
  4. Low 3.1

    CVE-2023-42119 · Exim

    Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of…

    Published 3 May 2024 · Fixed in 4.96.2 · NVD
  5. Critical 9.8

    CVE-2023-42117 · Exim

    Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of…

    Published 3 May 2024 · Fixed in 4.96.2 · NVD
  6. Critical 9.8

    CVE-2023-42116 · Exim

    Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NTLM challenge requests. The issue results from the lack of proper validation of the length of…

    Published 3 May 2024 · Fixed in 4.96.1 · NVD
  7. Critical 9.8

    CVE-2023-42115 · Exim

    Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied…

    Published 3 May 2024 · Fixed in 4.96.1 · NVD
  8. Medium 5.3

    CVE-2023-42114 · Exim

    Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NTLM challenge requests. The issue results from the lack of proper validation of user-supplied…

    Published 3 May 2024 · Fixed in 4.96.1 · NVD
  9. High 7.5

    CVE-2023-32154 · MikroTik RouterOS

    Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Router Advertisement Daemon. The issue results from the lack of proper validation of…

    Published 3 May 2024 · Fixed in 6.48.7 · NVD
  10. Medium 5.4

    CVE-2024-4335 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 3 May 2024 · Fixed in 1.0.218 · WPVulnerability
  11. Medium 5.3

    CVE-2024-34383 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Authorization Bypass Through User-Controlled Key

    Published 3 May 2024 · Fixed in 7.7 · WPVulnerability
  12. Medium 5.3

    CVE-2023-6327 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Missing Authorization

    Published 3 May 2024 · Fixed in 2.8.8 · WPVulnerability
  13. Medium 5.4

    CVE-2024-4216 · pgAdmin

    pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end.

    Published 2 May 2024 · Fixed in 8.6 · NVD
  14. High 8.8

    CVE-2024-4215 · pgAdmin

    pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.

    Published 2 May 2024 · Fixed in 8.6 · NVD
  15. Medium 6.3

    CVE-2024-32638 · Apache APISIX

    Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.

    Published 2 May 2024 · NVD
  16. High 8.8

    CVE-2024-32114 · Apache ActiveMQ

    In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST…

    Published 2 May 2024 · Fixed in 6.1.2 · NVD
  17. Medium 5.4

    CVE-2024-3991 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 2 May 2024 · Fixed in 2.8.8 · WPVulnerability
  18. High 8.8

    CVE-2024-33775 · Nagios XI

    An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet.

    Published 1 May 2024 · NVD
  19. Medium 5.3

    CVE-2024-32967 · ZITADEL

    Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no workaround since a patch is already available. Users are advised to upgrade.

    Published 1 May 2024 · Fixed in 2.48.5, 2.49.5, 2.50.3 · NVD
  20. Medium 5.0

    CVE-2024-23336 · MyBB

    MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`.…

    Published 1 May 2024 · Fixed in 1.8.38 · NVD
  21. Medium 4.7

    CVE-2024-23335 · MyBB

    MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability

    Published 1 May 2024 · Fixed in 1.8.38 · NVD
  22. Medium 5.3

    CVE-2024-3649 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: External Control of Assumed-Immutable Web Parameter

    Published 1 May 2024 · Fixed in 1.8.8.2 · WPVulnerability
  23. Medium 5.5

    CVE-2024-2877 · HashiCorp Vault

    Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext. This vulnerability, CVE-2024-2877, was fixed in Vault Enterprise 1.15.8.

    Published 30 Apr 2024 · Fixed in 1.15.8 · NVD
  24. Medium 5.4

    CVE-2024-4092 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 30 Apr 2024 · Fixed in 6.7.8 · NVD, WPVulnerability
  25. High 7.6

    CVE-2024-31621 · Flowise

    An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.

    Published 29 Apr 2024 · NVD
  26. Medium 6.5

    CVE-2024-3096 · PHP

    In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

    Published 29 Apr 2024 · Fixed in 8.1.28, 8.2.18, 8.3.5 · NVD
  27. High 7.5

    CVE-2024-2757 · PHP

    In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.

    Published 29 Apr 2024 · Fixed in 8.3.5 · NVD
  28. Critical 9.4

    CVE-2024-1874 · PHP

    In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

    Published 29 Apr 2024 · Fixed in 8.1.28, 8.2.18, 8.3.5 · NVD
  29. Medium 5.4

    CVE-2024-3554 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting

    Published 29 Apr 2024 · Fixed in 4.6.1.1 · WPVulnerability
  30. Medium 6.1

    CVE-2024-3368 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting

    Published 29 Apr 2024 · Fixed in 4.6.1.1 · WPVulnerability
  31. Medium 5.5

    CVE-2023-52722 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 10.03.1. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standard.

    Published 28 Apr 2024 · Fixed in 10.03.1 · NVD
  32. High 7.8

    CVE-2023-51794 · FFmpeg

    Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/af_stereowiden.c:120:69.

    Published 26 Apr 2024 · NVD
  33. Low 2.7

    CVE-2024-4198 · Mattermost

    Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.

    Published 26 Apr 2024 · Fixed in 8.1.12, 9.5.3 · NVD
  34. Low 2.7

    CVE-2024-4195 · Mattermost

    Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote guests to team admins via crafted HTTP requests.

    Published 26 Apr 2024 · Fixed in 8.1.12, 9.5.3 · NVD
  35. Medium 6.5

    CVE-2024-4183 · Mattermost

    Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.

    Published 26 Apr 2024 · Fixed in 9.4.5, 9.5.3, 9.6.1 · NVD
  36. Medium 4.3

    CVE-2024-4182 · Mattermost

    Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.

    Published 26 Apr 2024 · Fixed in 9.4.5, 9.5.3, 9.6.1 · NVD
  37. Medium 4.3

    CVE-2024-32046 · Mattermost

    Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored

    Published 26 Apr 2024 · Fixed in 9.4.5, 9.5.3, 9.6.1 · NVD
  38. Medium 6.5

    CVE-2024-22091 · Mattermost

    Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause excessive resource consumption, possibly leading to a DoS via sending large request paths

    Published 26 Apr 2024 · Fixed in 8.1.12, 9.5.3, 9.6.1 · NVD
  39. Critical 9.1

    CVE-2024-33661 · Portainer

    Portainer before 2.20.0 allows redirects when the target is not index.yaml.

    Published 26 Apr 2024 · Fixed in 2.20.0 · NVD
  40. High 8.1

    CVE-2024-32868 · ZITADEL

    ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks. This issue has been patched in version 2.50.0.

    Published 26 Apr 2024 · Fixed in 2.50.0 · NVD
  41. High 8.8

    CVE-2024-4024 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user's Bitbucket account, if Bitbucket is used as an OAuth…

    Published 25 Apr 2024 · Fixed in 16.9.6, 16.10.4 · NVD
  42. Medium 4.3

    CVE-2024-4006 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1 where personal access scopes were not honored by GraphQL subscriptions

    Published 25 Apr 2024 · Fixed in 16.9.6, 16.10.4 · NVD
  43. High 7.5

    CVE-2024-25026 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 281516.

    Published 25 Apr 2024 · NVD
  44. High 7.5

    CVE-2024-2829 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. A crafted wildcard filter in FileFinder may lead to a denial of service.

    Published 25 Apr 2024 · Fixed in 16.9.6, 16.10.4 · NVD
  45. High 8.1

    CVE-2024-2434 · GitLab

    An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where path traversal could lead to DoS and restricted file read.

    Published 25 Apr 2024 · Fixed in 16.9.6, 16.10.4 · NVD
  46. Medium 5.3

    CVE-2024-1347 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group.

    Published 25 Apr 2024 · Fixed in 16.9.6, 16.10.4 · NVD
  47. Medium 6.7

    CVE-2024-20358 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Cisco Adaptive Security Appliance (ASA) restore functionality that is available in Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This…

    Published 24 Apr 2024 · NVD
  48. Medium 6.0Actively exploited

    CVE-2024-20359 · Cisco ASA and Firepower Threat Defense

    A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this…

    Published 24 Apr 2024 · NVD
  49. High 8.6Actively exploited

    CVE-2024-20353 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker…

    Published 24 Apr 2024 · NVD
  50. Critical 10.0Actively exploited

    CVE-2024-4040 · CrushFTP

    A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

    Published 22 Apr 2024 · Fixed in 10.7.1, 11.1.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.