UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,083
Published in 7 days
634
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,083 vulnerabilities
  1. High 7.5

    CVE-2024-45802 · Squid

    SQUID-2024:4 Multiple issues in ESI

    Published 28 Oct 2024 · Fixed in 6.10 · NVD, Project advisories (GitHub)
  2. Medium 5.9

    CVE-2024-50602 · Expat

    An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

    Published 27 Oct 2024 · Fixed in 2.6.4 · NVD
  3. Medium 4.9

    CVE-2024-49757 · ZITADEL

    User Registration Bypass

    Published 25 Oct 2024 · Fixed in 2.61.4, 2.62.7, 2.63.5 · NVD, Project advisories (GitHub)
  4. Critical 9.1

    CVE-2024-49753 · ZITADEL

    Denied Host Validation Bypass in Zitadel Actions

    Published 25 Oct 2024 · Fixed in 2.62.8, 2.63.6, 2.64.1 · NVD, Project advisories (GitHub)
  5. Critical 9.1

    CVE-2022-45157 · Rancher

    Exposure of vSphere's CPI and CSI credentials

    Published 25 Oct 2024 · Fixed in 2.8.9, 2.9.3 · Project advisories (GitHub)
  6. Critical 9.1

    CVE-2024-22036 · Rancher

    Rancher Remote Code Execution via Cluster/Node Drivers

    Published 25 Oct 2024 · Fixed in 2.7.16, 2.8.9, 2.9.3 · Project advisories (GitHub)
  7. Critical 9.1

    CVE-2023-32197 · Rancher

    Privilege escalation in Windows nodes due to Insecure Access Control Lists

    Published 25 Oct 2024 · Fixed in 2.8.9, 2.9.3 · Project advisories (GitHub)
  8. High 8.6

    CVE-2024-48208 · Pure-FTPd

    pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.

    Published 24 Oct 2024 · Fixed in 1.0.52 · NVD
  9. Medium 5.4

    CVE-2024-8312 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. An attacker could inject HTML into the Global Search field on a diff view leading to XSS.

    Published 24 Oct 2024 · Fixed in 17.3.6, 17.4.3 · NVD
  10. Medium 6.5

    CVE-2024-6826 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. A denial of service could occur via importing a malicious crafted XML manifest file.

    Published 24 Oct 2024 · Fixed in 17.3.6, 17.4.3 · NVD
  11. Medium 5.4

    CVE-2026-85305 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Server-Side Request Forgery (SSRF)

    Published 24 Oct 2024 · Fixed in 10.2 · WPVulnerability
  12. Medium 5.4

    CVE-2024-50456 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Missing Authorization

    Published 24 Oct 2024 · Fixed in 8.2 · WPVulnerability
  13. Medium 4.3

    CVE-2024-50455 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Missing Authorization

    Published 24 Oct 2024 · Fixed in 8.2 · WPVulnerability
  14. Medium 5.3

    CVE-2024-50454 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Missing Authorization

    Published 24 Oct 2024 · Fixed in 8.2 · WPVulnerability
  15. Medium 5.3

    CVE-2024-20526 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the SSH server of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition for the SSH server of an affected device. This vulnerability is due to a logic error when an SSH session is established. An attacker could exploit this vulnerability by sending crafted SSH messages to an affected…

    Published 23 Oct 2024 · NVD
  16. High 8.6

    CVE-2024-20495 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Remote Access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validation of client key data after the TLS…

    Published 23 Oct 2024 · NVD
  17. High 8.6

    CVE-2024-20494 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper data validation during the TLS 1.3 handshake. An attacker…

    Published 23 Oct 2024 · NVD
  18. Medium 5.3

    CVE-2024-20493 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to deny further VPN user authentications for several minutes, resulting in a temporary denial of service (DoS) condition. This vulnerability is due to…

    Published 23 Oct 2024 · NVD
  19. Medium 6.7

    CVE-2024-20485 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the VPN web server of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This vulnerability is due to improper validation of a specific file when it is read…

    Published 23 Oct 2024 · NVD
  20. Medium 5.8Actively exploited

    CVE-2024-20481 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN…

    Published 23 Oct 2024 · NVD
  21. High 8.6

    CVE-2024-20426 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Internet Key Exchange version 2 (IKEv2) protocol for VPN termination of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit…

    Published 23 Oct 2024 · NVD
  22. High 7.7

    CVE-2024-20408 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Dynamic Access Policies (DAP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly. To exploit this vulnerability, an attacker would need valid remote access VPN user credentials on the affected device. This vulnerability…

    Published 23 Oct 2024 · NVD
  23. High 8.6

    CVE-2024-20402 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the SSL VPN feature for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to a logic error in memory management when the device is handling SSL VPN…

    Published 23 Oct 2024 · NVD
  24. Medium 5.8

    CVE-2024-20384 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Network Service Group (NSG) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should be denied to flow through an affected device. This vulnerability is due to a logic error that occurs when NSG…

    Published 23 Oct 2024 · NVD
  25. Medium 6.1

    CVE-2024-20382 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a browser that is accessing an affected device. This vulnerability is due to improper validation of user-supplied input to application…

    Published 23 Oct 2024 · NVD
  26. Medium 6.1

    CVE-2024-20341 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a browser that is accessing an affected device. This vulnerability is due to improper validation of user-supplied input to application…

    Published 23 Oct 2024 · NVD
  27. Medium 5.9

    CVE-2024-20331 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the session authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to prevent users from authenticating. This vulnerability is due to insufficient entropy in the authentication process. An attacker could exploit this…

    Published 23 Oct 2024 · NVD
  28. Critical 9.9

    CVE-2024-20329 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the SSH subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to execute operating system commands as root. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by submitting crafted input when executing remote CLI commands over SSH. A successful exploit could…

    Published 23 Oct 2024 · NVD
  29. Medium 5.8

    CVE-2024-20299 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should have been denied to flow through an affected device. This vulnerability is due to a logic error in populating group ACLs when…

    Published 23 Oct 2024 · NVD
  30. Medium 5.8

    CVE-2024-20297 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should have been denied to flow through an affected device. This vulnerability is due to a logic error in populating group ACLs when…

    Published 23 Oct 2024 · NVD
  31. High 7.7

    CVE-2024-20268 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause an unexpected reload of the device. This vulnerability is due to insufficient input validation of SNMP packets. An attacker could exploit this vulnerability by sending…

    Published 23 Oct 2024 · NVD
  32. Medium 5.9

    CVE-2024-5764 · Sonatype Nexus Repository

    Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database (SMTP or HTTP proxy credentials, user tokens, tokens, among others). The affected versions relied on a static hard-coded encryption passphrase. While it was possible for an administrator to define an…

    Published 23 Oct 2024 · Fixed in 3.73.0 · NVD
  33. High 8.7

    CVE-2024-49370 · Pimcore

    Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing

    Published 23 Oct 2024 · Fixed in 3.1.16, 4.1.7 · NVD, Project advisories (GitHub)
  34. Medium 5.3

    CVE-2024-9287 · Python

    A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is…

    Published 22 Oct 2024 · Fixed in 3.11.11, 3.12.8, 3.13.1 · NVD
  35. Medium 4.8

    CVE-2024-46538 · pfSense

    A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.

    Published 22 Oct 2024 · NVD
  36. High 8.8

    CVE-2024-45518 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to…

    Published 22 Oct 2024 · Fixed in 10.0.9 · NVD
  37. Medium 6.1

    CVE-2024-8980 · Liferay Portal / DXP

    The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute…

    Published 22 Oct 2024 · Fixed in 7.1.3, 7.4.3.102, 2023.q3.5 · NVD
  38. High 8.8

    CVE-2024-38002 · Liferay Portal / DXP

    The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.

    Published 22 Oct 2024 · Fixed in 7.4.3.112, 2023.q3.9, 2023.q4.6 · NVD
  39. High 8.8

    CVE-2024-26273 · Liferay Portal / DXP

    Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and…

    Published 22 Oct 2024 · Fixed in 7.4.3.104, 2023.q3.6, 2023.q4.3 · NVD
  40. High 8.8

    CVE-2024-26272 · Liferay Portal / DXP

    Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform…

    Published 22 Oct 2024 · Fixed in 7.4.3.108, 2023.q3.6, 2023.q4.3 · NVD
  41. High 8.8

    CVE-2024-26271 · Liferay Portal / DXP

    Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4)…

    Published 22 Oct 2024 · Fixed in 7.4.3.112, 2023.q3.6, 2023.q4.3 · NVD
  42. Low 3.1

    CVE-2024-48926 · Umbraco CMS

    Logout page displayed before session expiration

    Published 22 Oct 2024 · Fixed in 8.18.15, 10.8.7, 13.5.2 · NVD, Project advisories (GitHub)
  43. Medium 4.2

    CVE-2024-48929 · Umbraco CMS

    Incomplete Server Termination During Explicit Sign-Out

    Published 22 Oct 2024 · Fixed in 10.8.7, 13.5.2 · NVD, Project advisories (GitHub)
  44. Medium 4.6

    CVE-2024-48927 · Umbraco CMS

    Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

    Published 22 Oct 2024 · Fixed in 8.18.15, 10.8.7, 13.5.2 · NVD, Project advisories (GitHub)
  45. Medium 6.5

    CVE-2024-48925 · Umbraco CMS

    Improper Access Control Allows Low-Privilege Users to Access Webhook API

    Published 22 Oct 2024 · Fixed in 14.3.0 · NVD, Project advisories (GitHub)
  46. High 8.7

    CVE-2024-47819 · Umbraco CMS

    Stored XSS in the “dictionary name” on Dictionary section

    Published 22 Oct 2024 · Fixed in 14.3.1 · NVD, Project advisories (GitHub)
  47. High 8.9

    CVE-2024-49368 · Nginx UI

    Unchecked logrotate settings lead to arbitrary command execution

    Published 21 Oct 2024 · Fixed in 2.0.0-beta.36 · NVD, Project advisories (GitHub)
  48. Medium 5.5

    CVE-2024-49367 · Nginx UI

    The log path can be controlled, leading to arbitrary file reading.

    Published 21 Oct 2024 · Fixed in 2.0.0-beta.36 · NVD, Project advisories (GitHub)
  49. High 7.7

    CVE-2024-49366 · Nginx UI

    The json field can construct a directory traversal payload, causing arbitrary files to be written

    Published 21 Oct 2024 · Fixed in 2.0.0-beta.36 · NVD, Project advisories (GitHub)
  50. Medium 6.5

    CVE-2024-8305 · MongoDB

    prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB Server v7.0 versions prior to 7.0.13 and MongoDB Server v7.3 versions prior to 7.3.4

    Published 21 Oct 2024 · Fixed in 6.0.17, 7.0.13, 7.3.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.