UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,084
Published in 7 days
635
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,084 vulnerabilities
  1. High 8.8

    CVE-2024-45148 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to gain unauthorized access without proper credentials. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  2. Low 2.7

    CVE-2024-45135 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An admin attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  3. Low 2.7

    CVE-2024-45134 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An admin attacker could leverage this vulnerability to have a low impact on confidentiality which may aid in further attacks. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  4. Low 2.7

    CVE-2024-45133 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An admin attacker could leverage this vulnerability to have a low impact on confidentiality which may aid in further attacks. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  5. Medium 6.5

    CVE-2024-45132 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and affect confidentiality. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  6. Medium 5.4

    CVE-2024-45131 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality and integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  7. Medium 4.3

    CVE-2024-45130 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  8. Medium 4.3

    CVE-2024-45129 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  9. Medium 5.4

    CVE-2024-45128 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity and availability. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  10. Medium 4.8

    CVE-2024-45127 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Oct 2024 · NVD
  11. Medium 4.3

    CVE-2024-45125 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to have a low impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  12. Medium 5.3

    CVE-2024-45124 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  13. Medium 6.1

    CVE-2024-45123 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 10 Oct 2024 · NVD
  14. Medium 4.3

    CVE-2024-45122 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  15. Medium 4.3

    CVE-2024-45121 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  16. Low 3.1

    CVE-2024-45120 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to a security feature bypass. An attacker could exploit this vulnerability to alter a condition between the check and the use of a resource, having a low impact on integrity. Exploitation of this issue requires user…

    Published 10 Oct 2024 · NVD
  17. Medium 4.9

    CVE-2024-45119 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  18. Medium 6.5

    CVE-2024-45118 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have high impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  19. High 7.6

    CVE-2024-45117 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to read files from the system outside of the intended directories via PHP filter chain and also can have a low-availability impact on the service. Exploitation of…

    Published 10 Oct 2024 · NVD
  20. High 8.1

    CVE-2024-45116 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code. If an admin attacker can trick a user into clicking a specially crafted link or submitting a form, malicious scripts may be executed within the context of the victim's browser and have high impact on…

    Published 10 Oct 2024 · NVD
  21. Critical 9.8

    CVE-2024-45115 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction.

    Published 10 Oct 2024 · NVD
  22. Medium 5.4

    CVE-2024-7048 · Open WebUI

    In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this vulnerability, an attacker can view metadata of files uploaded by an admin and overwrite these files,…

    Published 10 Oct 2024 · NVD
  23. Medium 6.5

    CVE-2024-9538 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Exposure of Sensitive Information to an Unauthorized Actor

    Published 10 Oct 2024 · Fixed in 2.9.9 · WPVulnerability
  24. Medium 6.5

    CVE-2024-7041 · Open WebUI

    An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.

    Published 9 Oct 2024 · NVD
  25. Medium 5.1

    CVE-2024-9471 · Palo Alto Networks PAN-OS

    A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator. For example, an administrator with "Virtual system administrator (read-only)" access could use an XML API key of a "Virtual system…

    Published 9 Oct 2024 · Fixed in 10.1.11, 10.2.8, 11.0.3 · NVD
  26. High 8.2

    CVE-2024-9468 · Palo Alto Networks PAN-OS

    A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode.

    Published 9 Oct 2024 · Fixed in 11.0.4, 11.0.6, 11.1.3 · NVD
  27. High 7.5

    CVE-2024-46292 · ModSecurity

    A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NOTE: this is disputed by the Supplier because it cannot be reproduced. Also, the product's documentation indicates that it is not guaranteed to be usable with very large values of SecRequestBodyNoFilesLimit (which are required by the claimed issue).

    Published 9 Oct 2024 · NVD
  28. High 8.2

    CVE-2024-47773 · Discourse

    Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without any preloaded data. This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable anonymous cache by setting the…

    Published 8 Oct 2024 · Fixed in 3.3.2 · NVD
  29. High 7.5

    CVE-2024-43485 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 8 Oct 2024 · Fixed in 6.0.35, 8.0.10 · NVD
  30. High 7.5

    CVE-2024-43484 · .NET

    .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

    Published 8 Oct 2024 · Fixed in 6.0.35, 8.0.10 · NVD
  31. High 7.5

    CVE-2024-43483 · .NET

    .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

    Published 8 Oct 2024 · Fixed in 6.0.35, 8.0.10 · NVD
  32. High 8.1

    CVE-2024-38229 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 8 Oct 2024 · Fixed in 8.0.10 · NVD
  33. Medium 5.4

    CVE-2024-47951 · TeamCity

    In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings

    Published 8 Oct 2024 · Fixed in 2024.07.3 · NVD
  34. Medium 5.4

    CVE-2024-47950 · TeamCity

    In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings

    Published 8 Oct 2024 · Fixed in 2024.07.03 · NVD
  35. High 7.5

    CVE-2024-47949 · TeamCity

    In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location

    Published 8 Oct 2024 · Fixed in 2024.07.3 · NVD
  36. High 7.5

    CVE-2024-47948 · TeamCity

    In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups

    Published 8 Oct 2024 · Fixed in 2024.07.3 · NVD
  37. Medium 6.5

    CVE-2024-47161 · TeamCity

    In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API

    Published 8 Oct 2024 · Fixed in 2024.07.3 · NVD
  38. High

    CVE-2024-47823 · Livewire

    Livewire Remote Code Execution on File Uploads

    Published 8 Oct 2024 · Fixed in 2.12.7, 3.5.2 · Project advisories (GitHub)
  39. Medium 4.2

    CVE-2024-47822 · Directus

    Access token from query string is inserted into logs

    Published 8 Oct 2024 · Fixed in 10.13.2 · NVD, Project advisories (GitHub)
  40. Medium 4.3

    CVE-2024-47780 · TYPO3

    Information Disclosure in TYPO3 Page Tree

    Published 8 Oct 2024 · Fixed in 11.5.40, 12.4.21, 13.3.1 · NVD, Project advisories (GitHub)
  41. Medium 4.9

    CVE-2024-34537 · TYPO3

    Denial of Service in TYPO3 Bookmark Toolbar

    Published 8 Oct 2024 · Fixed in 11.5.40, 12.4.21, 13.3.1 · NVD, Project advisories (GitHub)
  42. Low 3.3

    CVE-2024-9026 · PHP

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to…

    Published 8 Oct 2024 · Fixed in 8.1.30, 8.2.24, 8.3.12 · NVD
  43. High 7.5

    CVE-2024-8927 · PHP

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain…

    Published 8 Oct 2024 · Fixed in 8.1.30, 8.2.24, 8.3.12 · NVD
  44. High 8.8

    CVE-2024-8926 · PHP

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to…

    Published 8 Oct 2024 · Fixed in 8.1.30, 8.2.24, 8.3.12 · NVD
  45. Medium 5.3

    CVE-2024-8925 · PHP

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

    Published 8 Oct 2024 · Fixed in 8.1.30, 8.2.24, 8.3.12 · NVD
  46. Medium 6.1

    CVE-2024-47772 · Discourse

    Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by sending a maliciously crafted chat message and replying to it. This issue only affects sites with CSP disabled. This problem is patched in the latest version of Discourse. All users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the…

    Published 7 Oct 2024 · Fixed in 3.3.2, 3.4.0 · NVD
  47. Medium 4.3

    CVE-2024-45297 · Discourse

    Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 7 Oct 2024 · Fixed in 3.3.2, 3.4.0 · NVD
  48. High 8.2

    CVE-2024-45051 · Discourse

    Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known workarounds for this…

    Published 7 Oct 2024 · Fixed in 3.3.2, 3.4.0 · NVD
  49. Medium 4.3

    CVE-2024-43789 · Discourse

    Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them all at once. This can potentially reduce the availability of a Discourse instance. This problem has been patched in the latest version of Discourse. All users area are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 7 Oct 2024 · Fixed in 3.3.1 · NVD
  50. High 8.8

    CVE-2024-31449 · Redis, Valkey

    Lua library commands may lead to stack overflow and potential RCE

    Published 7 Oct 2024 · Fixed in 6.2.16, 7.2.6 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.