UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,083
Published in 7 days
640
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,083 vulnerabilities
  1. High 7.7

    CVE-2022-31668 · Harbor

    Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.

    Published 14 Nov 2024 · Fixed in 2.4.3, 2.5.2 · NVD
  2. Medium 6.4

    CVE-2022-31667 · Harbor

    Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to.  By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account…

    Published 14 Nov 2024 · Fixed in 2.4.3, 2.5.2 · NVD
  3. Medium 5.4

    CVE-2022-31666 · Harbor

    Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users.  The attacker could modify Webhook policies configured in other projects.

    Published 14 Nov 2024 · Fixed in 2.4.3, 2.5.2 · NVD
  4. High 8.8

    CVE-2024-9693 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations.

    Published 14 Nov 2024 · Fixed in 17.3.7, 17.4.4, 17.5.2 · NVD
  5. Medium 5.4

    CVE-2024-8180 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encoding could lead to XSS if CSP is not enabled.

    Published 14 Nov 2024 · Fixed in 17.3.7, 17.4.4, 17.5.2 · NVD
  6. Medium 4.6

    CVE-2024-5920 · Palo Alto Networks PAN-OS

    A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator who can perform restricted actions on the PAN-OS node after the execution of JavaScript in the legitimate PAN-OS administrator's…

    Published 14 Nov 2024 · Fixed in 10.2.11, 11.0.6, 11.1.4 · NVD
  7. Medium 5.1

    CVE-2024-5919 · Palo Alto Networks PAN-OS

    A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface.

    Published 14 Nov 2024 · Fixed in 10.1.10, 10.2.5, 11.0.2 · NVD
  8. Medium 5.3

    CVE-2024-5918 · Palo Alto Networks PAN-OS

    An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate to connect to an impacted GlobalProtect portal or GlobalProtect gateway as a different legitimate user. This attack is possible only if you "Allow Authentication with User Credentials OR Client Certificate."

    Published 14 Nov 2024 · Fixed in 10.1.11, 11.0.3 · NVD
  9. Low 2.1

    CVE-2024-5917 · Palo Alto Networks PAN-OS

    A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible.

    Published 14 Nov 2024 · Fixed in 10.1.7, 10.2.2 · NVD
  10. Critical 9.1

    CVE-2024-50306 · Apache Traffic Server

    Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, from 10.0.0 through 10.0.1. Users are recommended to upgrade to version 9.2.6 or 10.0.2, which fixes the issue.

    Published 14 Nov 2024 · Fixed in 9.2.6, 10.0.2 · NVD
  11. High 7.5

    CVE-2024-50305 · Apache Traffic Server

    Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.

    Published 14 Nov 2024 · Fixed in 9.2.6 · NVD
  12. High 7.5

    CVE-2024-38479 · Apache Traffic Server

    Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.

    Published 14 Nov 2024 · Fixed in 9.2.6 · NVD
  13. Medium 6.8

    CVE-2024-2552 · Palo Alto Networks PAN-OS

    A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management plane and delete files on the firewall.

    Published 14 Nov 2024 · Fixed in 11.0.6, 11.1.4, 11.2.4 · NVD
  14. High 8.7

    CVE-2024-2551 · Palo Alto Networks PAN-OS

    A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewall by sending a crafted packet through the data plane that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.

    Published 14 Nov 2024 · Fixed in 10.1.14, 10.2.4, 11.0.5 · NVD
  15. High 8.7

    CVE-2024-2550 · Palo Alto Networks PAN-OS

    A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the GlobalProtect service on the firewall by sending a specially crafted packet that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.

    Published 14 Nov 2024 · Fixed in 10.2.7, 11.0.6, 11.1.4 · NVD
  16. Medium 6.5

    CVE-2024-52292 · Craft CMS

    Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function within a system notification template, the attacker can exfiltrate the Base64-encoded file content…

    Published 13 Nov 2024 · Fixed in 4.12.8, 5.4.9 · NVD
  17. High 7.2

    CVE-2024-52291 · Craft CMS

    Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme (e.g., file://file:////). This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads, unauthorized access to sensitive files, and, under certain…

    Published 13 Nov 2024 · Fixed in 4.12.5, 5.4.6 · NVD
  18. High 7.2

    CVE-2024-52293 · Craft CMS

    Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3.

    Published 13 Nov 2024 · Fixed in 4.12.2, 5.4.3 · NVD
  19. Medium 4.3

    CVE-2024-48900 · Moodle

    A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.

    Published 13 Nov 2024 · Fixed in 4.4.4 · NVD
  20. High 7.5

    CVE-2024-51996 · Symfony

    Authentication Bypass via persisted RememberMe cookie

    Published 13 Nov 2024 · Fixed in 5.4.47, 6.4.15, 7.1.8 · Project advisories (GitHub)
  21. Critical 9.1

    CVE-2024-39712 · Ivanti Connect Secure

    Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

    Published 13 Nov 2024 · Fixed in 22.7 · NVD
  22. Critical 9.1

    CVE-2024-39711 · Ivanti Connect Secure

    Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

    Published 13 Nov 2024 · Fixed in 22.7 · NVD
  23. Critical 9.1

    CVE-2024-39710 · Ivanti Connect Secure

    Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

    Published 13 Nov 2024 · Fixed in 22.7 · NVD
  24. High 7.8

    CVE-2024-39709 · Ivanti Connect Secure

    Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applicable to 9.1Rx) allow a local authenticated attacker to escalate their privileges.

    Published 13 Nov 2024 · Fixed in 9.1, 22.6 · NVD
  25. Critical 9.1

    CVE-2024-38656 · Ivanti Connect Secure

    Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

    Published 13 Nov 2024 · Fixed in 22.7 · NVD
  26. High 7.2

    CVE-2024-38655 · Ivanti Connect Secure

    Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

    Published 13 Nov 2024 · Fixed in 22.7 · NVD
  27. High 7.5

    CVE-2024-38649 · Ivanti Connect Secure

    An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated attacker to cause a denial of service.

    Published 13 Nov 2024 · Fixed in 9.1, 22.7 · NVD
  28. High 7.5

    CVE-2024-37400 · Ivanti Connect Secure

    An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial of service.

    Published 13 Nov 2024 · Fixed in 22.7 · NVD
  29. High 8.0

    CVE-2024-51094 · Snipe-IT

    An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal system data from the CSV file to a remote…

    Published 12 Nov 2024 · NVD
  30. High 8.7

    CVE-2024-51093 · Snipe-IT

    Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can lead to privilege escalation when the payload is executed, granting the attacker super admin permissions within the Snipe-IT system.

    Published 12 Nov 2024 · NVD
  31. Medium 5.8

    CVE-2024-8535 · NetScaler ADC and Gateway

    Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with KCDAccount configuration for Kerberos SSO to access backend resources OR the appliance must be configured as an Auth Server (AAA Vserver) with KCDAccount configuration for Kerberos SSO to access backend…

    Published 12 Nov 2024 · Fixed in 13.1-37.207, 13.1-55.34, 14.1-29.72 · NVD
  32. High 8.4

    CVE-2024-8534 · NetScaler ADC and Gateway

    Memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway if the appliance must be configured as a Gateway (VPN Vserver) with RDP Feature enabled OR the appliance must be configured as a Gateway (VPN Vserver) and RDP Proxy Server Profile is created and set to Gateway (VPN Vserver) OR the appliance must be configured as a Auth Server (AAA Vserver)…

    Published 12 Nov 2024 · Fixed in 13.1-37.207, 13.1-55.34, 14.1-29.72 · NVD
  33. Medium 4.4

    CVE-2024-36509 · Fortinet FortiWeb

    An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiWeb version 7.6.0, version 7.4.3 and below, version 7.2.10 and below, version 7.0.10 and below, version 6.3.23 and below may allow an authenticated attacker to access the encrypted passwords of other administrators via the "Log Access Event" logs page.

    Published 12 Nov 2024 · Fixed in 7.4.4 · NVD
  34. Medium 4.3

    CVE-2024-33510 · Fortinet FortiProxy, Fortinet FortiOS

    An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability [CWE-74] in FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.16 and below; FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below; FortiSASE version 24.2.b SSL-VPN web user interface may allow a remote unauthenticated attacker to…

    Published 12 Nov 2024 · Fixed in 7.2.9, 7.2.10, 7.4.4 · NVD
  35. Critical 9.8

    CVE-2024-26011 · Fortinet FortiProxy, Fortinet FortiOS

    A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11, FortiManager 6.4.0 through 6.4.14, FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.14, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.2 all…

    Published 12 Nov 2024 · Fixed in 7.2.8, 7.2.10, 7.4.4 · NVD
  36. High 8.8

    CVE-2023-50176 · Fortinet FortiOS

    A session fixation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link.

    Published 12 Nov 2024 · Fixed in 7.0.14, 7.2.8, 7.4.4 · NVD
  37. High

    CVE-2024-52301 · Laravel

    Environment manipulation via query string

    Published 12 Nov 2024 · Fixed in 11.31.0 · Project advisories (GitHub)
  38. High 7.8

    CVE-2024-49043 · Microsoft SQL Server

    Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 15.0.4410.1, 16.0.1135.2, 16.0.4155.4 · NVD
  39. High 7.5

    CVE-2024-49040 · Microsoft Exchange Server

    Microsoft Exchange Server Spoofing Vulnerability

    Published 12 Nov 2024 · NVD
  40. High 7.8

    CVE-2024-49021 · Microsoft SQL Server

    Microsoft SQL Server Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 15.0.4410.1, 16.0.1135.2, 16.0.4155.4 · NVD
  41. High 8.8

    CVE-2024-49018 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  42. High 8.8

    CVE-2024-49017 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  43. High 8.8

    CVE-2024-49016 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  44. High 8.8

    CVE-2024-49015 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  45. High 8.8

    CVE-2024-49014 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  46. High 8.8

    CVE-2024-49013 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  47. High 8.8

    CVE-2024-49012 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  48. High 8.8

    CVE-2024-49011 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  49. High 8.8

    CVE-2024-49010 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD
  50. High 8.8

    CVE-2024-49009 · Microsoft SQL Server

    SQL Server Native Client Remote Code Execution Vulnerability

    Published 12 Nov 2024 · Fixed in 14.0.3485.1, 15.0.2130.3, 15.0.4410.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.