UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,083
Published in 7 days
640
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,083 vulnerabilities
  1. High 8.6

    CVE-2020-27124 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the SSL/TLS handler of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause the affected device to reload unexpectedly, leading to a denial of service (DoS) condition. The vulnerability is due to improper error handling on established SSL/TLS connections. An attacker could exploit this vulnerability by establishing an…

    Published 18 Nov 2024 · NVD
  2. Medium 6.1

    CVE-2024-52318 · Apache Tomcat

    Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.

    Published 18 Nov 2024 · NVD
  3. Medium 6.5

    CVE-2024-52317 · Apache Tomcat

    Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or…

    Published 18 Nov 2024 · Fixed in 9.0.96, 10.1.31 · NVD
  4. Critical 9.8

    CVE-2024-52316 · Apache Tomcat

    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no…

    Published 18 Nov 2024 · Fixed in 9.0.96, 10.1.31 · NVD
  5. Medium 4.3

    CVE-2024-48901 · Moodle

    A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit that report.

    Published 18 Nov 2024 · NVD
  6. Medium 4.3

    CVE-2024-48898 · Moodle

    A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.

    Published 18 Nov 2024 · NVD
  7. Medium 4.3

    CVE-2024-48897 · Moodle

    A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify.

    Published 18 Nov 2024 · NVD
  8. Medium 4.3

    CVE-2024-48896 · Moodle

    A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.

    Published 18 Nov 2024 · NVD
  9. Medium 5.3

    CVE-2024-43416 · GLPI

    Users email enumeration by unauthenticated user

    Published 18 Nov 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  10. High 8.9

    CVE-2024-48962 · Apache OFBiz

    Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue.

    Published 18 Nov 2024 · Fixed in 18.12.17 · NVD
  11. Critical 9.8

    CVE-2024-47208 · Apache OFBiz

    Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue.

    Published 18 Nov 2024 · Fixed in 18.12.17 · NVD
  12. High 7.5

    CVE-2024-38370 · GLPI

    GLPI is a free asset and IT management software package. Starting in 9.2.0 and prior to 11.0.0, it is possible to download a document from the API without appropriate rights. Upgrade to 10.0.16.

    Published 15 Nov 2024 · Fixed in 10.0.16 · NVD
  13. Medium 5.4

    CVE-2024-51142 · Chamilo LMS

    Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows an attacker to execute arbitrary code via the svkey parameter of the storageapi.php file.

    Published 15 Nov 2024 · NVD
  14. Low 3.5

    CVE-2024-52514 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the intermediate folder inside Nextcloud allowing them to afterwards potentially access the blocked files depending on the user access control rules. It is recommended that the Nextcloud Server is upgraded to…

    Published 15 Nov 2024 · Fixed in 26.0.13.3, 27.1.9, 28.0.5 · NVD
  15. Medium 4.3

    CVE-2024-52513 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in Text files without providing the password. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded to 25.0.13.13, 26.0.13.9,…

    Published 15 Nov 2024 · Fixed in 28.0.11, 29.0.8, 30.0.1 · NVD
  16. High 7.5

    CVE-2024-52525 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is…

    Published 15 Nov 2024 · Fixed in 28.0.12, 29.0.9, 30.0.2 · NVD
  17. Medium 6.5

    CVE-2024-52523 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2…

    Published 15 Nov 2024 · Fixed in 28.0.12, 29.0.9, 30.0.2 · NVD
  18. Medium 5.3

    CVE-2024-52521 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to…

    Published 15 Nov 2024 · Fixed in 28.0.10, 29.0.7 · NVD
  19. Medium 6.5

    CVE-2024-52520 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.

    Published 15 Nov 2024 · Fixed in 27.1.11.8, 28.0.10, 29.0.7 · NVD
  20. High 8.2

    CVE-2024-52519 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.

    Published 15 Nov 2024 · Fixed in 27.1.11.8, 28.0.10, 29.0.7 · NVD
  21. Medium 5.4

    CVE-2024-52518 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.

    Published 15 Nov 2024 · Fixed in 28.0.12, 29.0.9, 30.0.2 · NVD
  22. Medium 5.9

    CVE-2024-52517 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is…

    Published 15 Nov 2024 · Fixed in 28.0.11, 29.0.8, 30.0.1 · NVD
  23. Medium 4.3

    CVE-2024-52516 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously shared items were not unshared. It is recommended that the Nextcloud Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6 and Nextcloud Enterprise Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6.

    Published 15 Nov 2024 · Fixed in 27.1.11.9, 28.0.9, 29.0.5 · NVD
  24. Medium 6.5

    CVE-2024-52515 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If the file would exist the preview of the SVG would preview the other file instead. It is recommended that the Nextcloud Server is upgraded to 27.1.10, 28.0.6 or 29.0.1 and Nextcloud Enterprise Server…

    Published 15 Nov 2024 · Fixed in 27.1.10, 28.0.6, 29.0.1 · NVD
  25. High 8.8

    CVE-2024-44625 · Gogs

    Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

    Published 15 Nov 2024 · NVD
  26. Medium 6.7

    CVE-2024-47759 · GLPI

    Stored XSS via document upload

    Published 15 Nov 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  27. High 8.8

    CVE-2024-45608 · GLPI

    Authenticated SQL Injection

    Published 15 Nov 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  28. Medium 6.1

    CVE-2024-43417 · GLPI

    Reflected XSS in Software form

    Published 15 Nov 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  29. Medium 5.4

    CVE-2024-45611 · GLPI

    Stored XSS in RSS feeds

    Published 15 Nov 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  30. High 8.8

    CVE-2024-41679 · GLPI

    Authenticated SQL injection in ticket form

    Published 15 Nov 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  31. Medium 6.1

    CVE-2024-45610 · GLPI

    Reflected XSS in Cable form

    Published 15 Nov 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  32. Medium 6.1

    CVE-2024-45609 · GLPI

    Reflected XSS in reports

    Published 15 Nov 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  33. Medium 6.1

    CVE-2024-43418 · GLPI

    Multiple reflected XSS (2)

    Published 15 Nov 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  34. High 8.8

    CVE-2024-40638 · GLPI

    Account takeover through SQL injection

    Published 15 Nov 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  35. Medium 6.1

    CVE-2024-41678 · GLPI

    Multiple reflected XSS (1)

    Published 15 Nov 2024 · Fixed in 10.0.17 · NVD, Project advisories (GitHub)
  36. Medium 4.3

    CVE-2021-3991 · Dolibarr ERP CRM

    An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' section is able to access specific reception details via direct URL access, bypassing the intended permission restrictions.

    Published 15 Nov 2024 · Fixed in 20.0.2 · NVD
  37. Medium 5.4

    CVE-2021-3841 · Sylius

    sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser.

    Published 15 Nov 2024 · Fixed in 1.9.10, 1.10.11, 1.11.2 · NVD
  38. High 7.5

    CVE-2024-45784 · Apache Airflow

    Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially exposing critical data that could be exploited to compromise the security of the Airflow deployment.…

    Published 15 Nov 2024 · Fixed in 2.10.3 · NVD
  39. High 7.2

    CVE-2024-37285 · Kibana

    A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv  and Kibana privileges…

    Published 14 Nov 2024 · NVD
  40. High 8.1

    CVE-2024-10921 · MongoDB

    An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and…

    Published 14 Nov 2024 · Fixed in 6.0.19, 7.0.15, 8.0.3 · NVD
  41. High 7.5

    CVE-2024-9633 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions starting from 17.6 before 17.6.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain, potentially leading to domain confusion attacks.

    Published 14 Nov 2024 · Fixed in 17.4.2, 17.5.4, 17.6.2 · NVD
  42. Medium 6.1

    CVE-2024-8648 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. The vulnerability could allow an attacker to inject malicious JavaScript code in Analytics Dashboards through a specially crafted URL.

    Published 14 Nov 2024 · Fixed in 17.3.7, 17.4.4, 17.5.2 · NVD
  43. Medium 6.5

    CVE-2024-7404 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow.

    Published 14 Nov 2024 · Fixed in 17.3.7, 17.4.4, 17.5.2 · NVD
  44. High 8.8

    CVE-2024-10979 · PostgreSQL

    Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

    Published 14 Nov 2024 · Fixed in 15.9, 16.5, 17.1 · NVD
  45. Medium 4.2

    CVE-2024-10978 · PostgreSQL

    Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to…

    Published 14 Nov 2024 · Fixed in 14.14, 15.9, 16.5 · NVD
  46. Low 3.7

    CVE-2024-10977 · PostgreSQL

    Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface…

    Published 14 Nov 2024 · Fixed in 14.14, 15.9, 16.5 · NVD
  47. Medium 5.4

    CVE-2024-10976 · PostgreSQL

    Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the…

    Published 14 Nov 2024 · Fixed in 15.9, 16.5, 17.1 · NVD
  48. High 7.4

    CVE-2022-31671 · Harbor

    Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticated users could read all the job logs stored in the Harbor database.

    Published 14 Nov 2024 · Fixed in 2.4.3, 2.5.2 · NVD
  49. High 7.7

    CVE-2022-31670 · Harbor

    Harbor fails to validate the user permissions when updating tag retention policies.  By sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag retention policies configured in other projects.

    Published 14 Nov 2024 · Fixed in 1.10.13, 2.4.3, 2.5.2 · NVD
  50. High 7.7

    CVE-2022-31669 · Harbor

    Harbor fails to validate the user permissions when updating tag immutability policies.  By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag immutability policies configured in other projects.

    Published 14 Nov 2024 · Fixed in 2.4.3, 2.5.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.