UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,084
Published in 7 days
635
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,084 vulnerabilities
  1. Medium 6.5

    CVE-2024-8305 · MongoDB

    prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB Server v7.0 versions prior to 7.0.13 and MongoDB Server v7.3 versions prior to 7.3.4

    Published 21 Oct 2024 · Fixed in 6.0.17, 7.0.13, 7.3.4 · NVD
  2. High 8.8

    CVE-2024-37404 · Ivanti Connect Secure

    Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution.

    Published 18 Oct 2024 · Fixed in 9.1, 22.7 · NVD
  3. Critical 9.4

    CVE-2024-9264 · Grafana

    The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in…

    Published 18 Oct 2024 · NVD
  4. Medium 5.7

    CVE-2024-27766 · MariaDB

    An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.

    Published 17 Oct 2024 · NVD
  5. Medium 5.6

    CVE-2023-39593 · MariaDB

    Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.

    Published 17 Oct 2024 · NVD
  6. Critical 9.8

    CVE-2023-26785 · MariaDB

    MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a "create function" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.

    Published 17 Oct 2024 · NVD
  7. Medium 5.9

    CVE-2024-10076 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting

    Published 17 Oct 2024 · Fixed in 13.8 · NVD, WPVulnerability
  8. Medium 5.6

    CVE-2024-10075 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Authorization Bypass Through User-Controlled Key

    Published 17 Oct 2024 · Fixed in 13.8 · NVD, WPVulnerability
  9. High 7.2

    CVE-2024-46213 · REDAXO

    REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability.

    Published 16 Oct 2024 · NVD
  10. Medium 4.9

    CVE-2024-46212 · REDAXO

    An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal.

    Published 16 Oct 2024 · NVD
  11. Medium 5.5

    CVE-2024-45072 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.

    Published 16 Oct 2024 · NVD
  12. Medium 4.8

    CVE-2024-45071 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

    Published 16 Oct 2024 · NVD
  13. High 8.6

    CVE-2024-45844 · F5 BIG-IP

    BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 16 Oct 2024 · Fixed in 15.1.10.5, 16.1.5, 17.1.1.4 · NVD
  14. Medium 4.1

    CVE-2024-45714 · SolarWinds Serv-U

    Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users’ permissions can modify a variable with a payload.

    Published 16 Oct 2024 · NVD
  15. High 8.8

    CVE-2024-45711 · SolarWinds Serv-U

    SolarWinds Serv-U is vulnerable to a directory traversal vulnerability where remote code execution is possible depending on privileges given to the authenticated user. This issue requires a user to be authenticated and this is present when software environment variables are abused. Authentication is required for this vulnerability

    Published 16 Oct 2024 · Fixed in 15.5 · NVD
  16. High 8.1

    CVE-2024-45217 · Apache Solr

    Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to "trusted" ConfigSets that may not have…

    Published 16 Oct 2024 · Fixed in 8.11.4, 9.7.0 · NVD
  17. Critical 9.8

    CVE-2024-45216 · Apache Solr

    Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an…

    Published 16 Oct 2024 · Fixed in 8.11.4, 9.7.0 · NVD
  18. Medium 5.4

    CVE-2022-4973 · WordPress

    WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page.

    Published 16 Oct 2024 · NVD
  19. Unrated

    WPV-b3ea7226b782 · Advanced Custom Fields Pro (WordPress plugin)

    Vulnerability in Advanced Custom Field Pro

    Published 16 Oct 2024 · Fixed in 6.3.9 · WPVulnerability
  20. Unrated

    WPV-b05f2a6b3924 · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Published 16 Oct 2024 · Fixed in 6.3.9 · WPVulnerability
  21. High 7.5

    CVE-2024-45085 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 is vulnerable to a denial of service, under certain configurations, caused by an unexpected specially crafted request. A remote attacker could exploit this vulnerability to cause an error resulting in a denial of service.

    Published 15 Oct 2024 · Fixed in 8.5.5.27 · NVD
  22. Low

    CVE-2024-41128 · Ruby on Rails

    Possible ReDoS vulnerability in query parameter filtering in Action Dispatch

    Published 15 Oct 2024 · Fixed in 7.0.8.5, 7.1.4.1, 7.2.1.1 · Project advisories (GitHub)
  23. Low

    CVE-2024-47887 · Ruby on Rails

    Possible ReDoS vulnerability in HTTP Token authentication in Action Controller

    Published 15 Oct 2024 · Fixed in 7.0.8.5, 7.1.4.1, 7.2.1.1 · Project advisories (GitHub)
  24. Low

    CVE-2024-47888 · Ruby on Rails

    Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text

    Published 15 Oct 2024 · Fixed in 7.0.8.5, 7.1.4.1, 7.2.1.1 · Project advisories (GitHub)
  25. Low

    CVE-2024-47889 · Ruby on Rails

    Possible ReDoS vulnerability in block_format in Action Mailer

    Published 15 Oct 2024 · Fixed in 7.0.8.5, 7.1.4.1, 7.2.1.1 · Project advisories (GitHub)
  26. High 7.5

    CVE-2024-21274 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Oct 2024 · NVD
  27. High 7.5

    CVE-2024-21272 · MySQL

    Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score…

    Published 15 Oct 2024 · NVD
  28. High 7.5

    CVE-2024-21260 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Oct 2024 · NVD
  29. Low 3.8

    CVE-2024-21247 · MySQL

    Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized update,…

    Published 15 Oct 2024 · NVD
  30. Low 2.2

    CVE-2024-21244 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). Supported versions that are affected are 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset…

    Published 15 Oct 2024 · NVD
  31. Low 2.2

    CVE-2024-21243 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). Supported versions that are affected are 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset…

    Published 15 Oct 2024 · NVD
  32. Medium 4.9

    CVE-2024-21241 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…

    Published 15 Oct 2024 · NVD
  33. Medium 4.9

    CVE-2024-21239 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 15 Oct 2024 · NVD
  34. Medium 5.3

    CVE-2024-21238 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.39 and prior, 8.4.1 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized…

    Published 15 Oct 2024 · NVD
  35. Low 2.2

    CVE-2024-21237 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in…

    Published 15 Oct 2024 · NVD
  36. Medium 4.9

    CVE-2024-21236 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 15 Oct 2024 · NVD
  37. Medium 4.8

    CVE-2024-21235 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and 21.3.11. Difficult to exploit vulnerability allows…

    Published 15 Oct 2024 · NVD
  38. High 7.5

    CVE-2024-21234 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or…

    Published 15 Oct 2024 · NVD
  39. Low 2.2

    CVE-2024-21232 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 15 Oct 2024 · NVD
  40. Low 3.1

    CVE-2024-21231 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…

    Published 15 Oct 2024 · NVD
  41. Medium 6.5

    CVE-2024-21230 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability…

    Published 15 Oct 2024 · NVD
  42. Medium 4.9

    CVE-2024-21219 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 15 Oct 2024 · NVD
  43. Medium 4.9

    CVE-2024-21218 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 15 Oct 2024 · NVD
  44. Low 3.7

    CVE-2024-21217 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and 21.3.11. Difficult to exploit vulnerability allows…

    Published 15 Oct 2024 · NVD
  45. Critical 9.8

    CVE-2024-21216 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS…

    Published 15 Oct 2024 · NVD
  46. Medium 4.2

    CVE-2024-21213 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than…

    Published 15 Oct 2024 · NVD
  47. Medium 4.4

    CVE-2024-21212 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Health Monitor). Supported versions that are affected are 8.0.39 and prior and 8.4.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 15 Oct 2024 · NVD
  48. Low 3.7

    CVE-2024-21211 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and 21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via…

    Published 15 Oct 2024 · NVD
  49. Low 3.7

    CVE-2024-21210 · Java

    Vulnerability in Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4 and 23. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete…

    Published 15 Oct 2024 · NVD
  50. Low 2.0

    CVE-2024-21209 · MySQL

    Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks require human interaction from a person other than the attacker.…

    Published 15 Oct 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.