UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,083
Published in 7 days
640
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,083 vulnerabilities
  1. High 7.5

    CVE-2024-8237 · GitLab

    A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 12.6 prior to 17.4.5, 17.5 prior to 17.5.3, and 17.6 prior to 17.6.1. An attacker could cause a denial of service with a crafted cargo.toml file.

    Published 26 Nov 2024 · Fixed in 17.4.5, 17.5.3 · NVD
  2. High 7.5

    CVE-2024-8177 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, starting from 17.6 prior to 17.6.1 which could cause Denial of Service via integrating a malicious harbor registry.

    Published 26 Nov 2024 · Fixed in 17.4.5, 17.5.3 · NVD
  3. High 8.8

    CVE-2024-8114 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token (PAT) to escalate privileges.

    Published 26 Nov 2024 · Fixed in 17.4.5, 17.5.3 · NVD
  4. Medium 4.8

    CVE-2024-53620 · SPIP

    A cross-site scripting (XSS) vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Title parameter.

    Published 26 Nov 2024 · NVD
  5. Medium 6.3

    CVE-2024-53619 · SPIP

    An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted PDF file.

    Published 26 Nov 2024 · NVD
  6. High 7.5

    CVE-2024-11828 · GitLab

    A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls. This was a regression of an earlier patch.

    Published 26 Nov 2024 · Fixed in 17.4.5, 17.5.3 · NVD
  7. High 7.5

    CVE-2024-11669 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token scopes.

    Published 26 Nov 2024 · Fixed in 17.4.5, 17.5.3 · NVD
  8. Medium 5.3

    CVE-2024-11668 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connections could potentially bypass authentication controls, allowing unauthorized access to streaming results.

    Published 26 Nov 2024 · Fixed in 17.4.5, 17.5.3 · NVD
  9. High 8.8

    CVE-2024-36463 · Zabbix

    The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects.

    Published 26 Nov 2024 · Fixed in 6.0.33, 6.4.18, 7.0.3 · NVD
  10. Low 2.2

    CVE-2024-22117 · Zabbix

    When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding sysmapelementurlid + 1. This action prevents others from adding URLs to the map element.

    Published 26 Nov 2024 · Fixed in 6.0.34, 6.4.19, 7.0.4 · NVD
  11. Medium 5.4

    CVE-2024-32468 · Deno

    Improper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generator

    Published 25 Nov 2024 · Fixed in 1.42.0 · Project advisories (GitHub)
  12. Medium 5.9

    CVE-2024-10451 · Keycloak

    Sensitive Data Exposure in Keycloak Build Process

    Published 25 Nov 2024 · Fixed in 24.0.9 · Project advisories (GitHub)
  13. Medium 6.5

    CVE-2024-10270 · Keycloak

    Inefficient Regular Expression Complexity in org.keycloak:keycloak-services

    Published 25 Nov 2024 · Fixed in 24.0.9 · Project advisories (GitHub)
  14. Low 2.7

    CVE-2024-10492 · Keycloak

    Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path

    Published 25 Nov 2024 · Fixed in 24.0.9 · Project advisories (GitHub)
  15. Medium 4.7

    CVE-2024-9666 · Keycloak

    Keycloak proxy header handling Denial-of-Service (DoS) vulnerability

    Published 25 Nov 2024 · Fixed in 24.0.9 · Project advisories (GitHub)
  16. High 7.1

    CVE-2024-10039 · Keycloak

    Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination

    Published 25 Nov 2024 · Fixed in 24.0.9 · Project advisories (GitHub)
  17. High 7.0

    CVE-2024-27134 · MLflow

    Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.

    Published 25 Nov 2024 · Fixed in 2.16.0 · NVD
  18. Low

    CVE-2024-53262 · SvelteKit

    Unescaped error message included on error page

    Published 25 Nov 2024 · Fixed in 2.8.3 · Project advisories (GitHub)
  19. Low

    CVE-2024-53261 · SvelteKit

    XSS on dev mode 404 page

    Published 25 Nov 2024 · Fixed in 2.8.3 · Project advisories (GitHub)
  20. Medium 5.4

    CVE-2024-8236 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 25 Nov 2024 · Fixed in 3.25.8 · NVD, WPVulnerability
  21. High 8.2

    CVE-2024-11233 · PHP

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.

    Published 24 Nov 2024 · Fixed in 8.1.31, 8.2.26, 8.3.14 · NVD
  22. Critical 9.8

    CVE-2024-11236 · PHP

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

    Published 24 Nov 2024 · Fixed in 8.1.31, 8.2.26, 8.3.14 · NVD
  23. High 7.2

    CVE-2024-11234 · PHP

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available…

    Published 24 Nov 2024 · Fixed in 8.1.31, 8.2.26, 8.3.14 · NVD
  24. Medium 5.3

    CVE-2024-53253 · Sentry

    Improper error handling leaks Application Integration Client Secret

    Published 22 Nov 2024 · NVD, Project advisories (GitHub)
  25. Medium 5.8

    CVE-2024-8929 · PHP

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.

    Published 22 Nov 2024 · Fixed in 8.1.31, 8.2.26, 8.3.14 · NVD
  26. Critical 9.8

    CVE-2024-8932 · PHP

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

    Published 22 Nov 2024 · Fixed in 8.1.31, 8.2.26, 8.3.14 · NVD
  27. High 7.2

    CVE-2024-11620 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Code Injection

    Published 22 Nov 2024 · Fixed in 1.0.232 · WPVulnerability
  28. Critical 9.8

    CVE-2024-10961 · Oa Social Login (WordPress plugin)

    Social Login: Authentication Bypass Using an Alternate Path or Channel

    Published 22 Nov 2024 · Fixed in 5.10.0 · WPVulnerability
  29. Medium 5.4

    CVE-2024-45517 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability in the /h/rest endpoint of the Zimbra webmail and admin panel interfaces allows attackers to execute arbitrary JavaScript in the victim's session. This issue is caused by improper sanitization of user input, leading to potential compromise of sensitive information. Exploitation requires…

    Published 21 Nov 2024 · Fixed in 8.8.15, 10.0.9 · NVD
  30. Medium 4.8

    CVE-2024-45513 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A stored Cross-Site Scripting (XSS) vulnerability exists in the /modern/contacts/print endpoint of Zimbra webmail. This allows an attacker to inject and execute arbitrary JavaScript code in the context of the victim's browser when a crafted vCard (VCF) file is processed and printed. This could lead to unauthorized actions within…

    Published 21 Nov 2024 · Fixed in 9.0.0, 10.0.9 · NVD
  31. Medium 4.8

    CVE-2024-45194 · Zimbra Collaboration

    In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) payloads. An attacker with administrative access to the Zimbra Administration Panel can inject malicious JavaScript code while configuring an email account. This injected code is stored on the server and executed in the context of the victim's browser when…

    Published 21 Nov 2024 · Fixed in 10.0.9 · NVD
  32. Medium 5.4

    CVE-2024-45514 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) through v10.1. A Cross-Site Scripting (XSS) vulnerability exists in one of the endpoints of Zimbra Webmail due to insufficient sanitization of the packages parameter. Attackers can bypass the existing checks by using encoded characters, allowing the injection and execution of arbitrary JavaScript within a victim's session.

    Published 21 Nov 2024 · Fixed in 8.8.15, 10.0.9 · NVD
  33. Medium 5.4

    CVE-2024-45512 · Zimbra Collaboration

    An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1. An attacker can exploit this vulnerability by creating a folder in the Briefcase module with a malicious payload and sharing it with a victim. When the victim interacts with the folder share notification, the malicious script executes in their browser. This stored Cross-Site Scripting (XSS) vulnerability can lead to…

    Published 21 Nov 2024 · Fixed in 9.0.0, 10.0.9 · NVD
  34. Medium 6.4

    CVE-2024-52287 · authentik

    Insufficient validation of OAuth scopes for client_credentials and device_code grants

    Published 21 Nov 2024 · Fixed in 2024.8.5, 2024.10.3 · NVD, Project advisories (GitHub)
  35. High 7.9

    CVE-2024-52289 · authentik

    Insecure default configuration for OAuth2 Redirect URIs

    Published 21 Nov 2024 · Fixed in 2024.8.5, 2024.10.3 · NVD, Project advisories (GitHub)
  36. Medium 6.3

    CVE-2024-52307 · authentik

    Timing attack due to a lack of constant time comparison for metrics view

    Published 21 Nov 2024 · Fixed in 2024.8.5, 2024.10.3 · NVD, Project advisories (GitHub)
  37. Medium 5.4

    CVE-2024-52702 · MyBB

    A stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Name parameter. NOTE: this is disputed by the Supplier because Website Name can only be set by an administrator, who may use JavaScript if they wish.

    Published 20 Nov 2024 · NVD
  38. Medium 5.4

    CVE-2024-45510 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) through 10.0. Zimbra Webmail (Modern UI) is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper sanitization of user input. This allows an attacker to inject malicious code into specific fields of an e-mail message. When the victim adds the attacker to their contacts, the malicious code is stored and executed when viewing…

    Published 20 Nov 2024 · Fixed in 9.0.0, 10.0.9 · NVD
  39. Medium 5.4

    CVE-2024-45511 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A reflected Cross-Site Scripting (XSS) issue exists through the Briefcase module due to improper sanitization of file content by the OnlyOffice formatter. This occurs when the victim opens a crafted URL pointing to a shared folder containing a malicious file uploaded by the attacker. The vulnerability allows the attacker to…

    Published 20 Nov 2024 · Fixed in 10.0.9 · NVD
  40. Medium 6.5

    CVE-2018-9481 · Apache Traffic Server

    In bta_hd_set_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure in the Bluetooth service with no additional execution privileges needed. User interaction is not needed for exploitation.

    Published 20 Nov 2024 · Fixed in 7.1.10, 8.0.7 · NVD
  41. Medium 4.3

    CVE-2024-48899 · Moodle

    A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to.

    Published 20 Nov 2024 · Fixed in 4.4.4 · NVD
  42. Medium 5.4

    CVE-2024-45691 · Moodle

    A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to "magic hash" values.

    Published 20 Nov 2024 · Fixed in 4.2.10, 4.3.7, 4.4.3 · NVD
  43. High 7.5

    CVE-2024-45690 · Moodle

    A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts.

    Published 20 Nov 2024 · Fixed in 4.2.10, 4.3.7, 4.4.3 · NVD
  44. Medium 6.5

    CVE-2024-45689 · Moodle

    A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access.

    Published 20 Nov 2024 · Fixed in 4.2.10, 4.3.7, 4.4.3 · NVD
  45. Medium 6.2

    CVE-2024-52282 · Rancher

    Helm Applications may have sensitive values leaked

    Published 19 Nov 2024 · Fixed in 2.8.10, 2.9.4 · Project advisories (GitHub)
  46. Medium 5.3

    CVE-2024-52600 · Statamic

    Path Traversal in Asset Upload

    Published 19 Nov 2024 · Fixed in 5.17.0 · Project advisories (GitHub)
  47. Medium 5.4

    CVE-2024-50803 · REDAXO

    The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privileges

    Published 19 Nov 2024 · NVD
  48. Medium 6.5

    CVE-2024-31141 · Apache Kafka

    Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which…

    Published 19 Nov 2024 · NVD
  49. Medium 6.9Actively exploited

    CVE-2024-9474 · Palo Alto Networks PAN-OS

    A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

    Published 18 Nov 2024 · Fixed in 11.0.6, 11.1.5, 11.2.4 · NVD
  50. Critical 9.3Actively exploited

    CVE-2024-0012 · Palo Alto Networks PAN-OS

    An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 .…

    Published 18 Nov 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.