UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,083
Published in 7 days
640
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,083 vulnerabilities
  1. Medium 4.6

    CVE-2024-54128 · Directus

    HTML Injection in Comment

    Published 5 Dec 2024 · Fixed in 10.13.4, 11.2.2 · NVD, Project advisories (GitHub)
  2. Medium 5.9

    CVE-2024-11942 · Drupal

    A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.

    Published 5 Dec 2024 · Fixed in 10.2.10 · NVD
  3. High 7.5

    CVE-2024-11941 · Drupal

    A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.

    Published 5 Dec 2024 · Fixed in 10.1.8, 10.2.2 · NVD
  4. Medium 6.5

    CVE-2024-54679 · CyberPanel

    CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions.

    Published 5 Dec 2024 · NVD
  5. Medium 4.7

    CVE-2024-11223 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 5 Dec 2024 · Fixed in 1.9.2.3 · NVD, WPVulnerability
  6. Medium 4.3

    CVE-2024-45204 · Veeam Backup & Replication

    A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials. The exploitation involves using retrieved credentials to expose sensitive NTLM hashes, impacting systems beyond the initial target and potentially leading to broader security vulnerabilities.

    Published 4 Dec 2024 · Fixed in 12.3.0.310 · NVD
  7. Medium 6.5

    CVE-2024-42457 · Veeam Backup & Replication

    A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading to the leak of plaintext credentials to a malicious host. The attack is facilitated by improper usage…

    Published 4 Dec 2024 · Fixed in 12.3.0.310 · NVD
  8. High 8.8

    CVE-2024-42456 · Veeam Backup & Replication

    A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configuration settings, such as modifying the trusted client certificate used for authentication on a specific port. This can result in unauthorized access, enabling the user to call privileged methods and initiate critical services. The issue arises…

    Published 4 Dec 2024 · Fixed in 12.3.0.310 · NVD
  9. High 8.1

    CVE-2024-42455 · Veeam Backup & Replication

    A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection. This exploit allows the attacker to delete any file on the system with service account privileges. The vulnerability is caused by an insufficient blacklist during the deserialization process.

    Published 4 Dec 2024 · Fixed in 12.3.0.310 · NVD
  10. High 8.1

    CVE-2024-42453 · Veeam Backup & Replication

    A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This includes the ability to power off virtual machines, delete files in storage, and make configuration changes, potentially leading to Denial of Service (DoS) and data integrity issues. The vulnerability is caused by improper permission checks…

    Published 4 Dec 2024 · Fixed in 12.3.0.310 · NVD
  11. High 8.8

    CVE-2024-42452 · Veeam Backup & Replication

    A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escalating privileges to system-level access. This allows the attacker to upload files to the server with elevated privileges. The vulnerability exists because remote calls bypass permission checks, leading to full system compromise.

    Published 4 Dec 2024 · Fixed in 12.3.0.310 · NVD
  12. Medium 6.5

    CVE-2024-42451 · Veeam Backup & Replication

    A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. This is achieved by calling a series of methods over an external protocol, ultimately retrieving the credentials using a malicious setup on the attacker's side. This exposes sensitive data, which could be used for further attacks, including unauthorized access to systems managed…

    Published 4 Dec 2024 · Fixed in 12.3.0.310 · NVD
  13. High 8.8

    CVE-2024-40717 · Veeam Backup & Replication

    A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs. These jobs can be configured to run pre- and post-scripts, which can be located on a network share and are executed with elevated privileges by default. The user can update a job and schedule it to run almost immediately, allowing…

    Published 4 Dec 2024 · Fixed in 12.3.0.310 · NVD
  14. Unrated

    WPV-c5798f3828bb · WooCommerce

    Vulnerability in WooCommerce

    Published 4 Dec 2024 · Fixed in 9.4.3 · WPVulnerability
  15. Medium 6.1

    CVE-2024-10858 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting

    Published 4 Dec 2024 · Fixed in 14.1, 16.1.3 · NVD, WPVulnerability
  16. Low 3.8

    CVE-2024-6156 · LXD

    CA certificate sign check bypass

    Published 2 Dec 2024 · Fixed in 4.0.10, 5.0.4, 5.21.2 · NVD, Project advisories (GitHub)
  17. Low 3.8

    CVE-2024-6219 · LXD

    Restricted TLS certificate privilege escalation when in PKI mode

    Published 2 Dec 2024 · Fixed in 5.21.1 · NVD, Project advisories (GitHub)
  18. High 7.5

    CVE-2024-11391 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Unrestricted Upload of File with Dangerous Type

    Published 2 Dec 2024 · Fixed in 5.2.11 · WPVulnerability
  19. Critical 9.8

    CVE-2024-35368 · FFmpeg

    FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.

    Published 29 Nov 2024 · NVD
  20. Critical 9.1

    CVE-2024-35367 · FFmpeg

    FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer

    Published 29 Nov 2024 · NVD
  21. Critical 9.1

    CVE-2024-35366 · FFmpeg

    FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.

    Published 29 Nov 2024 · NVD
  22. Medium 6.5

    CVE-2024-36616 · FFmpeg

    An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file.

    Published 29 Nov 2024 · NVD
  23. Medium 5.9

    CVE-2024-36615 · FFmpeg

    FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.

    Published 29 Nov 2024 · NVD
  24. High 8.1

    CVE-2024-36623 · Docker Engine

    moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.

    Published 29 Nov 2024 · NVD
  25. Medium 6.5

    CVE-2024-36621 · Docker Engine

    moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.

    Published 29 Nov 2024 · NVD
  26. Medium 6.5

    CVE-2024-36620 · Docker Engine

    moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.

    Published 29 Nov 2024 · NVD
  27. Medium 6.2

    CVE-2024-36618 · FFmpeg

    FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.

    Published 29 Nov 2024 · NVD
  28. Medium 6.2

    CVE-2024-36617 · FFmpeg

    FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.

    Published 29 Nov 2024 · Fixed in 4.3.7, 4.4.5, 6.1.2 · NVD
  29. Medium 5.3

    CVE-2024-36626 · PrestaShop

    In prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within Tools.php.

    Published 29 Nov 2024 · NVD
  30. Medium 5.3

    CVE-2024-36619 · FFmpeg

    FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition.

    Published 29 Nov 2024 · NVD
  31. Medium 5.5

    CVE-2024-35369 · FFmpeg

    In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.

    Published 29 Nov 2024 · NVD
  32. Medium 6.3

    CVE-2024-52003 · Traefik

    X-Forwarded-Prefix Header allows for Open Redirect

    Published 29 Nov 2024 · Fixed in 2.11.14, 3.2.1 · NVD, Project advisories (GitHub)
  33. Medium 6.1

    CVE-2024-54123 · Backdrop CMS

    Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.

    Published 29 Nov 2024 · Fixed in 1.28.4, 1.29.2 · NVD
  34. Medium 5.3

    CVE-2024-11599 · Mattermost

    Mattermost versions 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 fail to properly validate email addresses which allows an unauthenticated user to bypass email domain restrictions via carefully crafted input on email registration.

    Published 28 Nov 2024 · Fixed in 9.11.4, 10.0.2, 10.1.2 · NVD
  35. High 8.8

    CVE-2024-36466 · Zabbix

    A bug in the code allows an attacker to sign a forged zbx_session cookie, which then allows them to sign in with admin permissions.

    Published 28 Nov 2024 · Fixed in 6.0.32, 6.4.17 · NVD
  36. Medium 6.4

    CVE-2024-21703 · Confluence

    This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations. This Security Misconfiguration vulnerability, with a CVSS Score of 6.4 allows an authenticated attacker of the Windows host to read sensitive information about the Confluence Data Center configuration which has high impact to…

    Published 27 Nov 2024 · Fixed in 7.19.18, 8.5.5, 8.7.2 · NVD
  37. Low 2.7

    CVE-2024-36464 · Zabbix

    When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords.

    Published 27 Nov 2024 · Fixed in 6.0.30, 6.4.15 · NVD
  38. Low 2.7

    CVE-2024-42333 · Zabbix

    The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c

    Published 27 Nov 2024 · Fixed in 6.0.34, 6.4.19, 7.0.4 · NVD
  39. Low 3.7

    CVE-2024-42332 · Zabbix

    The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attack requires an SNMP item to be configured as text on the target host.

    Published 27 Nov 2024 · Fixed in 6.0.35, 6.4.20, 7.0.3 · NVD
  40. Low 3.3

    CVE-2024-42331 · Zabbix

    In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error method in the src/libs/zbxembed/browser_error.c file. A use-after-free bug can occur at this stage if the wd->browser heap pointer is freed by garbage collection.

    Published 27 Nov 2024 · Fixed in 7.0.4 · NVD
  41. Critical 9.1

    CVE-2024-42330 · Zabbix

    The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access hidden properties of objects.

    Published 27 Nov 2024 · Fixed in 6.0.34, 6.4.19, 7.0.4 · NVD
  42. Low 3.3

    CVE-2024-42329 · Zabbix

    The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for various reasons without an error description and then the wd->error will be NULL and trying to read from it will result in a crash.

    Published 27 Nov 2024 · Fixed in 7.0.4 · NVD
  43. Medium 5.5

    CVE-2024-42328 · Zabbix

    When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is an empty document, then wd->data in the code below will remain NULL and an attempt to read from it will result in a crash.

    Published 27 Nov 2024 · Fixed in 7.0.4 · NVD
  44. Critical 9.9

    CVE-2024-42327 · Zabbix

    A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who has API access.

    Published 27 Nov 2024 · Fixed in 6.0.32, 6.4.17, 7.0.1 · NVD
  45. Medium 4.4

    CVE-2024-42326 · Zabbix

    There was discovered a use after free bug in browser.c in the es_browser_get_variant function

    Published 27 Nov 2024 · Fixed in 7.0.3 · NVD
  46. High 8.2

    CVE-2024-36468 · Zabbix

    The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. This issue occurs when copying data from session->securityEngineID to local_record.engineid without proper bounds checking.

    Published 27 Nov 2024 · Fixed in 7.0.3 · NVD
  47. High 8.8

    CVE-2024-36467 · Zabbix

    An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (e.g.: Zabbix Administrators), except to groups that are disabled or having restricted GUI access.

    Published 27 Nov 2024 · Fixed in 6.0.33, 6.4.18, 7.0.2 · NVD
  48. High 7.2

    CVE-2024-9669 · Filester (WordPress plugin)

    File Manager Pro – Filester: Path Traversal

    Published 27 Nov 2024 · Fixed in 1.8.6 · WPVulnerability
  49. High 8.8

    CVE-2024-8066 · Filester (WordPress plugin)

    File Manager Pro – Filester: Unrestricted Upload of File with Dangerous Type

    Published 27 Nov 2024 · Fixed in 1.8.7 · WPVulnerability
  50. Medium 5.3

    CVE-2024-10240 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2 in which an unauthenticated user may be able to read some information about an MR in a private project, under certain circumstances.

    Published 26 Nov 2024 · Fixed in 17.3.7, 17.4.4, 17.5.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.