UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,083
Published in 7 days
642
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,083 vulnerabilities
  1. Medium 4.4

    CVE-2024-51741 · Redis

    Denial-of-service due to malformed ACL selectors

    Published 6 Jan 2025 · Fixed in 7.2.7, 7.4.2, 8.0.0 · NVD, Project advisories (GitHub)
  2. Medium 5.4

    CVE-2024-46209 · REDAXO

    A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parameter.

    Published 6 Jan 2025 · NVD
  3. Medium 6.1

    CVE-2024-35498 · Grav

    A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

    Published 6 Jan 2025 · NVD
  4. High 7.2

    CVE-2023-6605 · FFmpeg

    A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs.

    Published 6 Jan 2025 · NVD
  5. Medium 5.3

    CVE-2023-6604 · FFmpeg

    A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.

    Published 6 Jan 2025 · NVD
  6. Medium 4.7

    CVE-2023-6601 · FFmpeg

    A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions.

    Published 6 Jan 2025 · NVD
  7. Critical 9.1

    CVE-2024-5594 · OpenVPN

    OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.

    Published 6 Jan 2025 · Fixed in 2.6.11 · NVD
  8. Medium 5.4

    CVE-2025-22300 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Cross-Site Request Forgery (CSRF)

    Published 6 Jan 2025 · Fixed in 10.0.2 · WPVulnerability
  9. Medium 5.3

    CVE-2024-56332 · Next.js

    Next.js Allows a Denial of Service (DoS) with Server Actions

    Published 3 Jan 2025 · Fixed in 13.5.8, 14.2.21, 15.1.2 · OSV.dev and GitHub
  10. Medium 6.2

    CVE-2024-36613 · FFmpeg

    FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior.

    Published 3 Jan 2025 · NVD
  11. High 8.8

    CVE-2024-35365 · FFmpeg

    FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function.

    Published 3 Jan 2025 · NVD
  12. High 8.8

    CVE-2024-56276 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Missing Authorization

    Published 3 Jan 2025 · Fixed in 1.9.2.3 · NVD, WPVulnerability
  13. High 8.8

    CVE-2024-10957 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Deserialization of Untrusted Data

    Published 3 Jan 2025 · Fixed in 1.24.12 · WPVulnerability
  14. High 7.5

    CVE-2023-6603 · FFmpeg

    A flaw was found in FFmpeg's HLS playlist parsing. This vulnerability allows a denial of service via a maliciously crafted HLS playlist that triggers a null pointer dereference during initialization.

    Published 31 Dec 2024 · NVD
  15. Medium 5.3

    CVE-2023-6602 · FFmpeg

    A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists.

    Published 31 Dec 2024 · NVD
  16. High 8.8

    CVE-2024-12828 · Webmin

    Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of CGI requests. The issue results from the lack of proper validation of a user-supplied string before using it to execute…

    Published 30 Dec 2024 · NVD
  17. High 8.7Actively exploited

    CVE-2024-3393 · Palo Alto Networks PAN-OS

    A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

    Published 27 Dec 2024 · Fixed in 11.2.3 · NVD
  18. Low 3.7

    CVE-2023-5117 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions before 17.6.0 in which users were unaware that files uploaded to comments on confidential issues and epics of public projects could be accessed without authentication via a direct link to the uploaded file URL.

    Published 25 Dec 2024 · Fixed in 17.6.0 · NVD
  19. High 8.1

    CVE-2024-53961 · Adobe ColdFusion

    ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access files or directories that are outside of the restricted directory set by the application. This could lead to the disclosure of…

    Published 23 Dec 2024 · NVD
  20. Critical 9.1

    CVE-2024-40896 · libxml2

    In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

    Published 23 Dec 2024 · Fixed in 2.11.9, 2.12.9, 2.13.3 · NVD
  21. High 8.7

    CVE-2024-54148 · Gogs

    Path Traversal in file editing UI

    Published 23 Dec 2024 · Fixed in 0.13.1 · NVD, Project advisories (GitHub)
  22. High 8.7

    CVE-2024-55947 · Gogs

    Path Traversal in file update API

    Published 23 Dec 2024 · Fixed in 0.13.1 · NVD, Project advisories (GitHub)
  23. High 7.5

    CVE-2024-56335 · Vaultwarden

    Privilege escalation allows organization groups to be updated/deleted if their UUID is known

    Published 20 Dec 2024 · Fixed in 1.32.6, 1.32.7 · NVD, Project advisories (GitHub)
  24. Critical 9.8

    CVE-2024-56337 · Apache Tomcat

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for…

    Published 20 Dec 2024 · Fixed in 9.0.98, 10.1.34, 11.0.2 · NVD
  25. High 7.1

    CVE-2024-56356 · TeamCity

    In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack

    Published 20 Dec 2024 · Fixed in 2024.12 · NVD
  26. Medium 5.4

    CVE-2024-56355 · TeamCity

    In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS

    Published 20 Dec 2024 · Fixed in 2024.12 · NVD
  27. Medium 4.9

    CVE-2024-56354 · TeamCity

    In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission

    Published 20 Dec 2024 · Fixed in 2024.12 · NVD
  28. Medium 6.5

    CVE-2024-56353 · TeamCity

    In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies

    Published 20 Dec 2024 · Fixed in 2024.12 · NVD
  29. Medium 5.4

    CVE-2024-56352 · TeamCity

    In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page

    Published 20 Dec 2024 · Fixed in 2024.12 · NVD
  30. High 8.8

    CVE-2024-56351 · TeamCity

    In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles

    Published 20 Dec 2024 · Fixed in 2024.12 · NVD
  31. Medium 4.3

    CVE-2024-56350 · TeamCity

    In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects

    Published 20 Dec 2024 · Fixed in 2024.12 · NVD
  32. Medium 5.3

    CVE-2024-56349 · TeamCity

    In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs

    Published 20 Dec 2024 · Fixed in 2024.12 · NVD
  33. Medium 4.3

    CVE-2024-56348 · TeamCity

    In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents

    Published 20 Dec 2024 · Fixed in 2024.12 · NVD
  34. Medium 6.8

    CVE-2024-56331 · Uptime Kuma

    Local File Inclusion (LFI) via Improper URL Handling in `Real-Browser` monitor

    Published 20 Dec 2024 · Fixed in 1.23.16 · Project advisories (GitHub)
  35. Medium 6.5

    CVE-2024-51915 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 20 Dec 2024 · Fixed in 6.5.3 · WPVulnerability
  36. Medium 5.4

    CVE-2024-10453 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 20 Dec 2024 · Fixed in 3.25.10 · NVD, WPVulnerability
  37. High 7.5

    CVE-2024-54663 · Zimbra Collaboration

    An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requires a valid auth token and involves crafting a malicious request targeting specific file paths.

    Published 19 Dec 2024 · Fixed in 10.0.11, 10.1.3 · NVD
  38. Medium 5.9

    CVE-2024-53991 · Discourse

    Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore::LocalStore` which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick nginx into sending the Discourse backup file with a well crafted request. This issue is patched in…

    Published 19 Dec 2024 · Fixed in 3.3.2, 3.4.0 · NVD
  39. Medium 6.1

    CVE-2024-52794 · Discourse

    Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 19 Dec 2024 · Fixed in 3.3.2, 3.4.0 · NVD
  40. Low 2.7

    CVE-2024-52589 · Discourse

    Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from untrusted users.

    Published 19 Dec 2024 · Fixed in 3.3.3, 3.4.0 · NVD
  41. Critical 9.1

    CVE-2024-49765 · Discourse

    Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled could allow attackers to bypass discourse connect to create accounts and login. This problem is patched in the latest version of Discourse. Users unable to upgrade who are using discourse connect may disable all other login methods as a workaround.

    Published 19 Dec 2024 · Fixed in 3.3.3, 3.4.0 · NVD
  42. Medium 5.5

    CVE-2024-45819 · Xen

    PVH guests have their ACPI tables constructed by the toolstack. The construction involves building the tables in local memory, which are then copied into guest memory. While actually used parts of the local memory are filled in correctly, excess space that is being allocated is left with its prior contents.

    Published 19 Dec 2024 · NVD
  43. Medium 6.5

    CVE-2024-45818 · Xen

    The hypervisor contains code to accelerate VGA memory accesses for HVM guests, when the (virtual) VGA is in "standard" mode. Locking involved there has an unusual discipline, leaving a lock acquired past the return from the function that acquired it. This behavior results in a problem when emulating an instruction with two memory accesses, both of which touch VGA memory (plus some further…

    Published 19 Dec 2024 · Fixed in 4.20.0 · NVD
  44. High 7.8

    CVE-2024-56159 · Astro

    Server source code is exposed to the public if sourcemaps are enabled

    Published 19 Dec 2024 · Fixed in 4.16.18, 5.0.8 · Project advisories (GitHub)
  45. High 8.8

    CVE-2020-12820 · Fortinet FortiOS

    Under non-default configuration, a stack-based buffer overflow in FortiOS version 6.0.10 and below, version 5.6.12 and below may allow a remote attacker authenticated to the SSL VPN to crash the FortiClient NAC daemon (fcnacd) and potentially execute arbitrary code via requesting a large FortiClient file name. We are not aware of proof of concept code successfully achieving the latter.

    Published 19 Dec 2024 · Fixed in 5.6.13, 6.0.11 · NVD
  46. High 7.5

    CVE-2020-12819 · Fortinet FortiOS

    A heap-based buffer overflow vulnerability in the processing of Link Control Protocol messages in FortiGate versions 5.6.12, 6.0.10, 6.2.4 and 6.4.1 and earlier may allow a remote attacker with valid SSL VPN credentials to crash the SSL VPN daemon by sending a large LCP packet, when tunnel mode is enabled. Arbitrary code execution may be theoretically possible, albeit practically very difficult…

    Published 19 Dec 2024 · Fixed in 6.0.11, 6.2.5, 6.4.2 · NVD
  47. Critical 9.3Actively exploited

    CVE-2024-56145 · Craft CMS

    Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should…

    Published 18 Dec 2024 · Fixed in 3.9.14, 4.13.2, 5.5.2 · NVD
  48. High 7.2

    CVE-2024-36694 · OpenCart

    OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.

    Published 18 Dec 2024 · NVD
  49. High 7.5

    CVE-2024-53270 · Envoy

    HTTP/1: sending overload crashes when the request is reset beforehand

    Published 18 Dec 2024 · Fixed in 1.30.9, 1.31.5, 1.32.3 · NVD, Project advisories (GitHub)
  50. High 7.1

    CVE-2024-53271 · Envoy

    HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset

    Published 18 Dec 2024 · Fixed in 1.31.5 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.