UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,083
Published in 7 days
642
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,083 vulnerabilities
  1. Medium 5.9

    CVE-2024-52963 · Fortinet FortiOS

    A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4.15 allows attacker to trigger a denial of service via specially crafted packets.

    Published 14 Jan 2025 · Fixed in 7.2.11, 7.4.8 · NVD
  2. Critical 9.8

    CVE-2024-48886 · Fortinet FortiProxy, Fortinet FortiOS

    A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1…

    Published 14 Jan 2025 · Fixed in 7.2.9, 7.2.11, 7.4.5 · NVD
  3. Critical 9.1

    CVE-2024-48884 · Fortinet FortiProxy, Fortinet FortiWeb, Fortinet FortiOS

    A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.9, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, FortiProxy 7.2.0…

    Published 14 Jan 2025 · Fixed in 7.2.12, 7.4.5, 7.4.6 · NVD
  4. High 7.5

    CVE-2024-46670 · Fortinet FortiOS

    An Out-of-bounds Read vulnerability [CWE-125] in FortiOS version 7.6.0, version 7.4.4 and below, version 7.2.9 and below and FortiSASE FortiOS tenant version 24.3.b IPsec IKE service may allow an unauthenticated remote attacker to trigger memory consumption leading to Denial of Service via crafted requests.

    Published 14 Jan 2025 · Fixed in 7.2.10, 7.4.5 · NVD
  5. Medium 6.5

    CVE-2024-46669 · Fortinet FortiOS

    An Integer Overflow or Wraparound vulnerability [CWE-190] in version 7.4.4 and below, version 7.2.10 and below; FortiSASE version 23.4.b FortiOS tenant IPsec IKE service may allow an authenticated attacker to crash the IPsec tunnel via crafted requests, resulting in potential denial of service.

    Published 14 Jan 2025 · Fixed in 7.4.5 · NVD
  6. High 7.5

    CVE-2024-46668 · Fortinet FortiOS

    An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiOS versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, versions 7.0.0 through 7.0.15, and versions 6.4.0 through 6.4.15 may allow an unauthenticated remote user to consume all system memory via multiple large file uploads.

    Published 14 Jan 2025 · Fixed in 7.0.16, 7.2.9, 7.4.5 · NVD
  7. Medium 5.3

    CVE-2024-46666 · Fortinet FortiOS

    An allocation of resources without limits or throttling [CWE-770] vulnerability in FortiOS versions 7.6.0, versions 7.4.4 through 7.4.0, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow a remote unauthenticated attacker to prevent access to the GUI via specially crafted requests directed at specific endpoints.

    Published 14 Jan 2025 · Fixed in 7.2.9, 7.4.5 · NVD
  8. Low 3.7

    CVE-2024-46665 · Fortinet FortiOS

    An insertion of sensitive information into sent data vulnerability [CWE-201] in FortiOS 7.6.0, 7.4.0 through 7.4.4 may allow an attacker in a man-in-the-middle position to retrieve the RADIUS accounting server shared secret via intercepting accounting-requests.

    Published 14 Jan 2025 · Fixed in 7.4.5 · NVD
  9. Medium 6.5

    CVE-2024-36504 · Fortinet FortiOS

    An out-of-bounds read vulnerability [CWE-125] in FortiOS SSLVPN web portal versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, 7.0 all verisons, and 6.4 all versions may allow an authenticated attacker to perform a denial of service on the SSLVPN web portal via a specially crafted URL.

    Published 14 Jan 2025 · Fixed in 7.2.9, 7.4.5 · NVD
  10. High 8.8

    CVE-2024-27778 · Fortinet FortiSandbox

    An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.5 through 3.0.7 allows an authenticated attacker with at least read-only permission to execute…

    Published 14 Jan 2025 · Fixed in 4.0.5, 4.2.7, 4.4.5 · NVD
  11. Medium 6.7

    CVE-2024-21758 · Fortinet FortiWeb

    A stack-based buffer overflow in Fortinet FortiWeb versions 7.2.0 through 7.2.7, and 7.4.0 through 7.4.1 may allow a privileged user to execute arbitrary code via specially crafted CLI commands, provided the user is able to evade FortiWeb stack protections.

    Published 14 Jan 2025 · Fixed in 7.2.8, 7.4.2 · NVD
  12. Medium 4.3

    CVE-2023-46715 · Fortinet FortiOS

    An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below allows an authenticated IPSec VPN user with dynamic IP addressing to send (but not receive) packets spoofing the IP of another user via crafted network packets.

    Published 14 Jan 2025 · Fixed in 7.4.2 · NVD
  13. Medium 6.5

    CVE-2023-42786 · Fortinet FortiOS

    A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a crafted http request.

    Published 14 Jan 2025 · Fixed in 7.2.6, 7.4.2 · NVD
  14. Medium 6.5

    CVE-2023-42785 · Fortinet FortiOS

    A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a crafted http request.

    Published 14 Jan 2025 · Fixed in 7.2.6, 7.4.2 · NVD
  15. Medium 6.5

    CVE-2024-55945 · TYPO3

    Cross-Site Request Forgery in DB Check Module

    Published 14 Jan 2025 · Fixed in 11.5.42 · NVD, Project advisories (GitHub)
  16. High 8.0

    CVE-2024-55924 · TYPO3

    Cross-Site Request Forgery in Scheduler Module

    Published 14 Jan 2025 · Fixed in 11.5.42 · NVD, Project advisories (GitHub)
  17. Medium 4.3

    CVE-2024-55923 · TYPO3

    Cross-Site Request Forgery in Indexed Search Module

    Published 14 Jan 2025 · Fixed in 11.5.42, 12.4.25, 13.4.3 · NVD, Project advisories (GitHub)
  18. Medium 5.4

    CVE-2024-55922 · TYPO3

    Cross-Site Request Forgery in Form Framework Module

    Published 14 Jan 2025 · Fixed in 11.5.42, 12.4.25, 13.4.3 · NVD, Project advisories (GitHub)
  19. High 8.8

    CVE-2024-55921 · TYPO3

    Cross-Site Request Forgery in Extension Manager Module

    Published 14 Jan 2025 · Fixed in 11.5.42, 12.4.25, 13.4.3 · NVD, Project advisories (GitHub)
  20. Medium 4.3

    CVE-2024-55920 · TYPO3

    Cross-Site Request Forgery in Dashboard Module

    Published 14 Jan 2025 · Fixed in 11.5.42, 12.4.25, 13.4.3 · NVD, Project advisories (GitHub)
  21. Medium 5.4

    CVE-2024-55894 · TYPO3

    Cross-Site Request Forgery in Backend User Module

    Published 14 Jan 2025 · Fixed in 11.5.42, 12.4.25, 13.4.3 · NVD, Project advisories (GitHub)
  22. Medium 4.3

    CVE-2024-55893 · TYPO3

    Cross-Site Request Forgery in Log Module

    Published 14 Jan 2025 · Fixed in 11.5.42, 12.4.25, 13.4.3 · NVD, Project advisories (GitHub)
  23. Medium 6.1

    CVE-2024-55892 · TYPO3

    Potential Open Redirect via Parsing Differences

    Published 14 Jan 2025 · Fixed in 11.5.42, 12.4.25, 13.4.3 · NVD, Project advisories (GitHub)
  24. Medium 5.3

    CVE-2024-55891 · TYPO3

    Information Disclosure via Exception Handling/Logger

    Published 14 Jan 2025 · NVD, Project advisories (GitHub)
  25. Medium 6.5

    CVE-2024-11734 · Keycloak

    Denial of Service in Keycloak Server via Security Headers

    Published 13 Jan 2025 · Fixed in 26.0.8 · Project advisories (GitHub)
  26. Medium 4.9

    CVE-2024-11736 · Keycloak

    Unrestricted admin use of system and environment variables

    Published 13 Jan 2025 · Fixed in 26.0.8 · Project advisories (GitHub)
  27. High 8.5

    CVE-2024-12365 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Missing Authorization

    Published 13 Jan 2025 · Fixed in 2.8.2 · WPVulnerability
  28. Medium 5.3

    CVE-2024-12008 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 13 Jan 2025 · Fixed in 2.8.2 · WPVulnerability
  29. Medium 5.3

    CVE-2024-12006 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Missing Authorization

    Published 13 Jan 2025 · Fixed in 2.8.2 · WPVulnerability
  30. High 7.2

    CVE-2024-46210 · REDAXO

    An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file.

    Published 10 Jan 2025 · NVD
  31. Medium 5.4

    CVE-2024-55226 · Vaultwarden

    Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs.

    Published 9 Jan 2025 · NVD
  32. Critical 9.8

    CVE-2024-55225 · Vaultwarden

    An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.

    Published 9 Jan 2025 · Fixed in 1.32.5 · NVD
  33. Critical 9.6

    CVE-2024-55224 · Vaultwarden

    An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.

    Published 9 Jan 2025 · Fixed in 1.32.5 · NVD
  34. Medium 5.4

    CVE-2024-42898 · Nagios XI

    A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Account Settings page.

    Published 9 Jan 2025 · NVD
  35. Low 3.8

    CVE-2025-22449 · Mattermost

    Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.

    Published 9 Jan 2025 · Fixed in 9.11.6 · NVD
  36. Medium 5.3

    CVE-2025-22445 · Mattermost

    Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting.

    Published 9 Jan 2025 · Fixed in 10.3.0 · NVD
  37. Medium 6.5

    CVE-2025-20033 · Mattermost

    Mattermost versions 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.

    Published 9 Jan 2025 · Fixed in 10.0.4, 10.1.4, 10.2.1 · NVD
  38. Critical 9.8Actively exploited

    CVE-2024-53704 · SonicWall SonicOS

    An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.

    Published 9 Jan 2025 · NVD
  39. Medium 5.4

    CVE-2024-13041 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. As a result, the user may not be marked as external thereby giving those users access to internal…

    Published 9 Jan 2025 · Fixed in 17.5.5, 17.6.3, 17.7.1 · NVD
  40. Medium 4.3

    CVE-2024-6324 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. It was possible to trigger a DoS by creating cyclic references between epics.

    Published 9 Jan 2025 · Fixed in 17.5.5, 17.6.3, 17.7.1 · NVD
  41. Medium 5.1

    CVE-2024-13209 · REDAXO

    Stored XSS on REDAXO 5.18.1 - Article / "content/edit"

    Published 9 Jan 2025 · Fixed in 5.18.2 · NVD, Project advisories (GitHub)
  42. High 7.0

    CVE-2025-0283 · Ivanti Connect Secure

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges.

    Published 8 Jan 2025 · Fixed in 9.1, 22.7 · NVD
  43. Critical 9.0Actively exploited

    CVE-2025-0282 · Ivanti Connect Secure

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

    Published 8 Jan 2025 · NVD
  44. Medium 4.3

    CVE-2024-12431 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 15.5 before 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1, in which unauthorized users could manipulate the status of issues in public projects.

    Published 8 Jan 2025 · Fixed in 17.5.5, 17.6.3, 17.7.1 · NVD
  45. Medium 6.5

    CVE-2025-0194 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner.

    Published 8 Jan 2025 · Fixed in 17.5.5, 17.6.3, 17.7.1 · NVD
  46. High 7.5

    CVE-2024-40749 · Joomla!

    Improper Access Controls allows access to protected views.

    Published 7 Jan 2025 · Fixed in 3.10.20, 4.4.10, 5.2.3 · NVD
  47. High 7.5

    CVE-2024-40748 · Joomla!

    Lack of output escaping in the id attribute of menu lists.

    Published 7 Jan 2025 · Fixed in 3.10.20, 4.4.10, 5.2.3 · NVD
  48. Medium 6.1

    CVE-2024-40747 · Joomla!

    Various module chromes didn't properly process inputs, leading to XSS vectors.

    Published 7 Jan 2025 · Fixed in 4.4.10, 5.2.3 · NVD
  49. Critical 9.8

    CVE-2024-46981 · Redis

    Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua…

    Published 6 Jan 2025 · Fixed in 6.2.17, 7.2.7, 7.4.2 · NVD
  50. High 7.5

    CVE-2025-21620 · Deno

    fetch: Authorization headers not dropped when redirecting cross-origin

    Published 6 Jan 2025 · Fixed in 2.1.2 · Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.