UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,083
Published in 7 days
634
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,083 vulnerabilities
  1. Medium 4.8

    CVE-2024-36250 · Mattermost

    Mattermost versions 9.11.x <= 9.11.2, and 9.5.x <= 9.5.10 fail to protect the mfa code against replay attacks, which allows an attacker to reuse the MFA code within ~30 seconds

    Published 9 Nov 2024 · Fixed in 9.5.11, 9.11.3 · NVD
  2. Medium 4.9

    CVE-2024-50378 · Apache Airflow

    Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is…

    Published 8 Nov 2024 · Fixed in 2.10.3 · NVD
  3. Medium 5.4

    CVE-2024-49524 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of…

    Published 7 Nov 2024 · Fixed in 6.5.21.0, 2024.5.0 · NVD
  4. Medium 5.4

    CVE-2024-49523 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 7 Nov 2024 · Fixed in 6.5.21.0, 2024.5.0 · NVD
  5. Medium 6.1

    CVE-2024-50599 · Zimbra Collaboration

    A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endpoints. This arises from improper handling of user-supplied input, allowing an attacker to inject malicious code that is reflected back in the HTML response.

    Published 7 Nov 2024 · NVD
  6. High 7.7

    CVE-2024-40715 · Veeam Backup & Replication

    A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass. Attackers must be able to perform Man-in-the-Middle (MITM) attack to exploit this vulnerability.

    Published 7 Nov 2024 · Fixed in 12.2.0.334 · NVD
  7. High 7.5

    CVE-2024-43440 · Moodle

    A flaw was found in moodle. A local file may include risks when restoring block backups.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  8. High 7.5

    CVE-2024-43438 · Moodle

    A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned by the report.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  9. High 7.2

    CVE-2024-43436 · Moodle

    A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  10. High 8.1

    CVE-2024-43434 · Moodle

    The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  11. High 7.5

    CVE-2024-43431 · Moodle

    A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  12. High 7.1

    CVE-2024-43428 · Moodle

    To address a cache poisoning risk in Moodle, additional validation for local storage was required.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  13. High 7.5

    CVE-2024-43426 · Moodle

    A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  14. High 8.1

    CVE-2024-43425 · Moodle

    A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.

    Published 7 Nov 2024 · Fixed in 4.2.9, 4.3.6, 4.4.2 · NVD
  15. High 7.5

    CVE-2024-38286 · Apache Tomcat

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be…

    Published 7 Nov 2024 · Fixed in 9.0.90, 10.1.25 · NVD
  16. Medium 6.5

    CVE-2024-51988 · RabbitMQ

    HTTP API's queue deletion endpoint does not verify that the user has a required permission

    Published 6 Nov 2024 · Fixed in 3.12.11 · Project advisories (GitHub)
  17. Low 3.1

    CVE-2024-50342 · Symfony

    Internal address and port enumeration allowed by NoPrivateNetworkHttpClient

    Published 6 Nov 2024 · Fixed in 5.4.47, 6.4.15, 7.1.8 · Project advisories (GitHub)
  18. Low 3.1

    CVE-2024-50343 · Symfony

    Incorrect response from Validator when input ends with `\n`

    Published 6 Nov 2024 · Fixed in 5.4.43, 6.4.11, 7.1.4 · Project advisories (GitHub)
  19. High 7.3

    CVE-2024-50340 · Symfony

    Ability to change environment from query

    Published 6 Nov 2024 · Fixed in 5.4.46, 6.4.14, 7.1.7 · Project advisories (GitHub)
  20. Low 3.1

    CVE-2024-50345 · Symfony

    Open redirect via browser-sanitized URLs

    Published 6 Nov 2024 · Fixed in 5.4.46, 6.4.14, 7.1.7 · Project advisories (GitHub)
  21. Low 3.1

    CVE-2024-50341 · Symfony

    Security::login does not take into account custom user_checker

    Published 6 Nov 2024 · Fixed in 6.4.10, 7.0.10, 7.1.3 · Project advisories (GitHub)
  22. Low

    CVE-2024-51736 · Symfony

    Command execution hijack on Windows with Process class

    Published 6 Nov 2024 · Fixed in 5.4.46, 6.4.14, 7.1.7 · Project advisories (GitHub)
  23. Medium 6.5

    CVE-2024-9681 · curl

    When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second…

    Published 6 Nov 2024 · Fixed in 8.11.0 · NVD
  24. Critical 9.8

    CVE-2024-48061 · Langflow

    langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.

    Published 4 Nov 2024 · NVD
  25. Medium 5.5

    CVE-2024-45086 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.

    Published 4 Nov 2024 · Fixed in 8.5.5.27, 9.0.5.22 · NVD
  26. High 7.5

    CVE-2024-30619 · Chamilo LMS

    Chamilo LMS Version 1.11.26 is vulnerable to Incorrect Access Control. A non-authenticated attacker can request the number of messages and the number of online users via "/main/inc/ajax/message.ajax.php?a=get_count_message" AND "/main/inc/ajax/online.ajax.php?a=get_users_online."

    Published 4 Nov 2024 · NVD
  27. Medium 6.1

    CVE-2024-30618 · Chamilo LMS

    A Stored Cross-Site Scripting (XSS) Vulnerability in Chamilo LMS 1.11.26 allows a remote attacker to execute arbitrary JavaScript in a web browser by including a malicious payload in the 'content' parameter of 'group_topics.php'.

    Published 4 Nov 2024 · NVD
  28. Medium 5.4

    CVE-2024-30617 · Chamilo LMS

    A Cross-Site Request Forgery (CSRF) vulnerability in Chamilo LMS 1.11.26 "/main/social/home.php," allows attackers to initiate a request that posts a fake post onto the user's social wall without their consent or knowledge.

    Published 4 Nov 2024 · NVD
  29. High 8.8

    CVE-2024-30616 · Chamilo LMS

    Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a significant risk to data integrity.

    Published 4 Nov 2024 · NVD
  30. Medium 6.9

    CVE-2024-10761 · Umbraco CMS

    XSS/HTML Injection Vulnerability in Umbraco Preview Badge

    Published 4 Nov 2024 · Fixed in 10.8.8 · NVD, Project advisories (GitHub)
  31. Low 3.5

    CVE-2024-7056 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 4 Nov 2024 · Fixed in 1.9.1.6 · NVD, WPVulnerability
  32. Medium 4.6

    CVE-2024-27525 · Chamilo LMS

    Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the home.php component.

    Published 1 Nov 2024 · NVD
  33. High 7.1

    CVE-2024-27524 · Chamilo LMS

    Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the new_ticket.php component.

    Published 1 Nov 2024 · NVD
  34. High 7.5

    CVE-2024-39722 · Ollama

    An issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on which it is deployed via path traversal in the api/push route.

    Published 31 Oct 2024 · Fixed in 0.1.46 · NVD
  35. High 7.5

    CVE-2024-39721 · Ollama

    An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until completion. The req.Path parameter is user-controlled and can be set to /dev/random, which is blocking, causing the goroutine to run infinitely (even after the HTTP request is aborted by the client).

    Published 31 Oct 2024 · Fixed in 0.1.34 · NVD
  36. High 8.2

    CVE-2024-39720 · Ollama

    An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytes starting with the GGUF custom magic header. By leveraging a custom Modelfile that includes a FROM statement pointing to the attacker-controlled blob file, the attacker can crash the application through the CreateModel route, leading to a segmentation…

    Published 31 Oct 2024 · Fixed in 0.1.46 · NVD
  37. High 7.5

    CVE-2024-39719 · Ollama

    An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter that does not exist, it reflects the "File does not exist" error message to the attacker, providing a primitive for file existence on the server.

    Published 31 Oct 2024 · NVD
  38. High 7.5

    CVE-2024-8185 · HashiCorp Vault, OpenBao

    Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vault to consume excessive system memory resources, potentially leading to a crash of the underlying…

    Published 31 Oct 2024 · Fixed in 1.17.8, 1.18.1, 2.0.3 · NVD
  39. Critical 9.1

    CVE-2024-51478 · YesWiki

    Use of a Broken or Risky Cryptographic Algorithm in YesWiki

    Published 31 Oct 2024 · Fixed in 4.4.5 · NVD, Project advisories (GitHub)
  40. Critical 9.8

    CVE-2024-42835 · Langflow

    langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.

    Published 31 Oct 2024 · NVD
  41. Critical 9.8

    CVE-2024-51568 · CyberPanel

    CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthenticated remote code execution via shell metacharacters.

    Published 29 Oct 2024 · Fixed in 2.3.5 · NVD
  42. Critical 9.8Actively exploited

    CVE-2024-51567 · CyberPanel

    upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6…

    Published 29 Oct 2024 · Fixed in 2.3.8 · NVD
  43. Critical 9.8Actively exploited

    CVE-2024-51378 · CyberPanel

    getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX.…

    Published 29 Oct 2024 · Fixed in 2.3.8 · NVD
  44. Low 2.7

    CVE-2024-10452 · Grafana

    Organization admins can delete pending invites created in an organization they are not part of.

    Published 29 Oct 2024 · NVD
  45. High 7.5

    CVE-2024-47401 · Mattermost

    Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by sending a specially crafted request to Playbooks.

    Published 29 Oct 2024 · Fixed in 9.5.10, 9.10.3, 9.11.2 · NVD
  46. Medium 4.6

    CVE-2024-46872 · Mattermost

    Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks

    Published 29 Oct 2024 · NVD
  47. Medium 4.3

    CVE-2024-50052 · Mattermost

    Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post.

    Published 29 Oct 2024 · Fixed in 9.5.10, 9.10.3, 9.11.2 · NVD
  48. Medium 4.3

    CVE-2024-10241 · Mattermost

    Mattermost versions 9.5.x <= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by using cmd+K/ctrl+K.

    Published 29 Oct 2024 · Fixed in 9.5.10 · NVD
  49. Critical 9.8

    CVE-2024-50550 · LiteSpeed Cache

    LiteSpeed Cache: Incorrect Privilege Assignment

    Published 29 Oct 2024 · Fixed in 6.5.2 · NVD, WPVulnerability
  50. Low 3.5

    CVE-2024-10214 · Mattermost

    Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings.

    Published 28 Oct 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.