UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,083
Published in 7 days
642
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,083 vulnerabilities
  1. High 7.5

    CVE-2024-53269 · Envoy

    Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting.

    Published 18 Dec 2024 · Fixed in 1.30.8, 1.31.4, 1.32.2 · NVD, Project advisories (GitHub)
  2. Medium 5.3

    CVE-2024-56128 · Apache Kafka

    Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism (SCRAM) did not fully adhere to the requirements of RFC 5802 [1]. Specifically, as per RFC 5802, the server must verify that the nonce sent by the client in the second message matches the nonce sent by…

    Published 18 Dec 2024 · Fixed in 3.7.2 · NVD
  3. Medium 5.9

    CVE-2024-56140 · Astro

    Bypass CSRF Middleware (security.checkOrigin)

    Published 18 Dec 2024 · Fixed in 4.16.17 · Project advisories (GitHub)
  4. Medium 4.3

    CVE-2024-12331 · Filester (WordPress plugin)

    File Manager Pro – Filester: Missing Authorization

    Published 18 Dec 2024 · Fixed in 1.8.7 · WPVulnerability
  5. Medium 4.8

    CVE-2023-37940 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Service Class` text field.

    Published 17 Dec 2024 · Fixed in 7.3, 7.4.3.88 · NVD
  6. Medium 6.0

    CVE-2024-12539 · Elasticsearch

    An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.

    Published 17 Dec 2024 · Fixed in 8.16.2 · NVD
  7. Medium 4.6

    CVE-2024-11993 · Liferay Portal / DXP

    Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field

    Published 17 Dec 2024 · Fixed in 7.4, 7.4.3.39 · NVD
  8. High 7.5

    CVE-2024-51479 · Next.js

    Next.js authorization bypass vulnerability

    Published 17 Dec 2024 · Fixed in 14.2.15 · OSV.dev and GitHub
  9. Medium

    CVE-2024-53259 · Traefik

    Fix CVE-2024-53259

    Published 17 Dec 2024 · Fixed in 2.11.15, 3.2.2 · Project advisories (GitHub)
  10. Medium 5.3

    CVE-2024-54677 · Apache Tomcat

    Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL…

    Published 17 Dec 2024 · Fixed in 9.0.98, 10.1.34, 11.0.2 · NVD
  11. Critical 9.8

    CVE-2024-50379 · Apache Tomcat

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time…

    Published 17 Dec 2024 · Fixed in 9.0.98, 10.1.34, 11.0.2 · NVD
  12. High

    GHSA-gjqf-v2f6-962h · Frappe Framework

    Privilege escalation via document action

    Published 17 Dec 2024 · Fixed in 14.81.4, 15.41.0 · Project advisories (GitHub)
  13. Medium 4.8

    CVE-2024-55951 · Metabase

    Sandboxed users could see filter values from other sandboxed users

    Published 16 Dec 2024 · Project advisories (GitHub)
  14. Medium 4.9

    CVE-2024-54682 · Mattermost

    Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin.

    Published 16 Dec 2024 · Fixed in 9.11.5, 10.0.3, 10.1.3 · NVD
  15. Medium 6.5

    CVE-2024-54083 · Mattermost

    Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to properly validate the type of callProps which allows a user to cause a client side (webapp and mobile) DoS to users of particular channels, by sending a specially crafted post.

    Published 16 Dec 2024 · Fixed in 9.11.5, 10.0.3, 10.1.3 · NVD
  16. Medium 4.8

    CVE-2024-48872 · Mattermost

    Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent concurrently checking and updating the failed login attempts. which allows an attacker to bypass of "Max failed attempts" restriction and send a big number of login attempts before being blocked via simultaneously sending multiple login requests

    Published 16 Dec 2024 · Fixed in 9.11.5, 10.0.3, 10.1.3 · NVD
  17. Medium 6.1

    CVE-2024-56112 · CyberPanel

    CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php.

    Published 16 Dec 2024 · Fixed in 2024-11-11 · NVD
  18. Medium 5.3

    CVE-2024-8650 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions from 15.0 prior to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2 that allowed non-member users to view unresolved threads marked as internal notes in public projects merge requests.

    Published 16 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  19. Medium 5.3

    CVE-2024-8116 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific GraphQL query, under specific conditions an unauthorized user can retrieve branch names.

    Published 16 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  20. High 8.8

    CVE-2024-53376 · CyberPanel

    CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation URI.

    Published 16 Dec 2024 · Fixed in 2.3.8 · NVD
  21. High 7.1

    CVE-2024-55633 · Apache Superset

    Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable.  This…

    Published 12 Dec 2024 · Fixed in 4.1.0 · NVD
  22. Medium 6.4

    CVE-2024-9387 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions from 11.8 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could potentially perform an open redirect against a given releases API endpoint.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  23. Medium 4.3

    CVE-2024-9367 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while parsing templates to generate changelogs.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  24. Medium 5.4

    CVE-2024-8647 · GitLab

    An issue was discovered in GitLab affecting all versions starting 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self hosted installs, it was possible to leak the anti-CSRF-token to an external site while the Harbor integration was enabled.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  25. High 7.5

    CVE-2024-8233 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 9.4 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could cause a denial of service with requests for diff files on a commit or merge request.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  26. Medium 5.4

    CVE-2024-8179 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. Improper output encoding could lead to XSS if CSP is not enabled.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  27. Medium 6.7

    CVE-2024-12570 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.4.6, from 17.5 prior to 17.5.4, and from 17.6 prior to 17.6.2. It may have been possible for an attacker with a victim's `CI_JOB_TOKEN` to obtain a GitLab session token belonging to the victim.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  28. Medium 4.0

    CVE-2024-12292 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  29. High 8.7

    CVE-2024-11274 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  30. Low 3.1

    CVE-2024-10043 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature, potentially leading to information disclosure.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  31. High 7.5

    CVE-2024-37401 · Ivanti Connect Secure

    An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial of service.

    Published 12 Dec 2024 · Fixed in 22.7 · NVD
  32. High 7.5

    CVE-2024-37377 · Ivanti Connect Secure

    A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service.

    Published 12 Dec 2024 · Fixed in 22.7 · NVD
  33. Critical 9.5

    CVE-2024-53677 · Apache Struts

    File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload…

    Published 11 Dec 2024 · Fixed in 6.4.0 · NVD
  34. Low 3.4

    CVE-2024-11053 · curl

    When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

    Published 11 Dec 2024 · Fixed in 8.11.1 · NVD
  35. Critical 9.3

    CVE-2024-50339 · GLPI

    Unauthenticated session hijacking (Leakymetry)

    Published 11 Dec 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  36. High 7.2

    CVE-2024-48912 · GLPI

    Insecure account deletion by authenticated user

    Published 11 Dec 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  37. High 7.5

    CVE-2024-47760 · GLPI

    Account takeover via API

    Published 11 Dec 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  38. High 7.5

    CVE-2024-47761 · GLPI

    Account takeover via the password reset feature

    Published 11 Dec 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  39. High 7.6

    CVE-2024-47758 · GLPI

    Account takeover without privilege escalation through the API

    Published 11 Dec 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  40. Medium 5.4

    CVE-2024-53960 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  41. Medium 5.4

    CVE-2024-52993 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  42. Medium 5.4

    CVE-2024-52992 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  43. Medium 5.4

    CVE-2024-52991 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  44. Medium 5.4

    CVE-2024-52865 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  45. Medium 5.4

    CVE-2024-52864 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  46. Medium 5.4

    CVE-2024-52862 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  47. Medium 5.4

    CVE-2024-52861 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  48. Medium 5.4

    CVE-2024-52860 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. User interaction…

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  49. Medium 5.4

    CVE-2024-52859 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  50. Medium 5.4

    CVE-2024-52858 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.