UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,084
Published in 7 days
635
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,084 vulnerabilities
  1. Medium 6.5

    CVE-2024-31228 · Redis, Valkey

    Denial-of-service due to unbounded pattern matching

    Published 7 Oct 2024 · Fixed in 6.2.16, 7.2.6 · NVD, Project advisories (GitHub)
  2. Medium 4.4

    CVE-2024-31227 · Redis, Valkey

    Denial-of-service due to malformed ACL selectors

    Published 7 Oct 2024 · Fixed in 7.2.6 · NVD, Project advisories (GitHub)
  3. Medium 6.1

    CVE-2024-28710 · LimeSurvey

    Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the Alert Widget's message component.

    Published 7 Oct 2024 · Fixed in 6.5.0\+240319 · NVD
  4. Medium 6.1

    CVE-2024-28709 · LimeSurvey

    Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and comment fields.

    Published 7 Oct 2024 · Fixed in 6.5.12\+240611 · NVD
  5. Medium 5.4

    CVE-2024-45153 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 7 Oct 2024 · Fixed in 6.5.21.0, 2024.5.0 · NVD
  6. Medium 6.6

    CVE-2024-9529 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Code Injection

    Published 7 Oct 2024 · Fixed in 6.3.8, 6.3.9 · NVD, WPVulnerability
  7. Medium 5.3

    CVE-2024-47913 · MediaWiki

    An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not authorized to view the log details for the filter.

    Published 4 Oct 2024 · Fixed in 1.39.9, 1.41.3, 1.42.2 · NVD
  8. High 7.2

    CVE-2024-47911 · SonarQube Server

    In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint that allows SonarQube users with the administrator role to inject blind SQL commands.

    Published 4 Oct 2024 · Fixed in 10.6 · NVD
  9. High 8.1

    CVE-2024-47183 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.

    Published 4 Oct 2024 · Fixed in 6.5.9, 7.3.0 · NVD
  10. High 7.2

    CVE-2024-9314 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Deserialization of Untrusted Data

    Published 4 Oct 2024 · Fixed in 1.0.229 · WPVulnerability
  11. Medium 6.5

    CVE-2024-9161 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization

    Published 4 Oct 2024 · Fixed in 1.0.229 · WPVulnerability
  12. Medium 5.9

    CVE-2024-34535 · Mastodon

    In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.

    Published 3 Oct 2024 · NVD
  13. Medium 5.3

    CVE-2024-8508 · Unbound

    NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression to downstream replies. This can lead to degraded performance and eventually denial of service in well…

    Published 3 Oct 2024 · Fixed in 1.21.1 · NVD
  14. Critical 9.8Actively exploited

    CVE-2024-45519 · Zimbra Collaboration

    The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

    Published 2 Oct 2024 · Fixed in 8.8.15, 10.0.9 · NVD
  15. Medium 5.4

    CVE-2024-45965 · Contao

    Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6.

    Published 2 Oct 2024 · Fixed in 4.13.54, 5.3.30, 5.5.6 · NVD
  16. Medium 4.7

    CVE-2024-45962 · October CMS

    October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted JavaScript to the target.

    Published 2 Oct 2024 · NVD
  17. Medium 4.3

    CVE-2024-47804 · Jenkins

    If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroup)` through the Jenkins CLI or the REST API and either of these checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk, allowing attackers with Item/Configure permission to save the item to…

    Published 2 Oct 2024 · Fixed in 2.462.3, 2.479 · NVD
  18. Medium 4.3

    CVE-2024-47803 · Jenkins

    Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the `secretTextarea` form field.

    Published 2 Oct 2024 · Fixed in 2.462.3, 2.479 · NVD
  19. High 7.5

    CVE-2024-33662 · Portainer

    Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.

    Published 2 Oct 2024 · Fixed in 2.20.2 · NVD
  20. Critical 9.1

    CVE-2023-3441 · GitLab

    An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4. The product did not sufficiently warn about security implications of granting merge rights to protected branches.

    Published 1 Oct 2024 · Fixed in 16.4.0 · NVD
  21. Medium 6.1

    CVE-2024-9225 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 1 Oct 2024 · Fixed in 8.2 · WPVulnerability
  22. Medium 4.8

    CVE-2024-45073 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

    Published 30 Sept 2024 · NVD
  23. Medium 6.9

    CVE-2024-9329 · Eclipse GlassFish

    In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

    Published 30 Sept 2024 · Fixed in 7.0.17 · NVD
  24. Medium 5.4

    CVE-2024-8107 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 30 Sept 2024 · Fixed in 6.7.19 · NVD, WPVulnerability
  25. High 8.8

    CVE-2024-47637 · LiteSpeed Cache

    LiteSpeed Cache: Path Traversal

    Published 30 Sept 2024 · Fixed in 6.5.1 · NVD, WPVulnerability
  26. Medium 6.1

    CVE-2024-47374 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 30 Sept 2024 · Fixed in 6.5.1 · NVD, WPVulnerability
  27. Medium 5.4

    CVE-2024-47373 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 30 Sept 2024 · Fixed in 6.5.1 · NVD, WPVulnerability
  28. Critical 9.0

    CVE-2024-47070 · authentik

    Password authentication bypass via X-Forwarded-For HTTP header

    Published 27 Sept 2024 · Fixed in 2024.6.5, 2024.8.3 · NVD, Project advisories (GitHub)
  29. Medium 6.5

    CVE-2024-47077 · authentik

    Insufficient cross-provider token validation during introspection

    Published 27 Sept 2024 · Fixed in 2024.6.5, 2024.8.3 · NVD, Project advisories (GitHub)
  30. Medium 5.1

    CVE-2024-9277 · Langflow

    A vulnerability classified as problematic was found in Langflow up to 1.0.18. Affected by this vulnerability is an unknown functionality of the file \src\backend\base\langflow\interface\utils.py of the component HTTP POST Request Handler. The manipulation of the argument remaining_text leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be…

    Published 27 Sept 2024 · NVD
  31. Medium 4.3

    CVE-2024-8974 · GitLab

    Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project."

    Published 26 Sept 2024 · Fixed in 17.2.8, 17.3.4 · NVD
  32. Medium 5.3

    CVE-2024-4099 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. An AI feature was found to read unsanitized content in a way that could have allowed an attacker to hide prompt injection.

    Published 26 Sept 2024 · Fixed in 17.2.8, 17.3.4 · NVD
  33. High 8.8

    CVE-2024-7594 · HashiCorp Vault, OpenBao

    Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault…

    Published 26 Sept 2024 · Fixed in 1.16.10, 1.17.6, 2.0.2 · NVD
  34. High 8.0

    CVE-2024-22030 · Rancher

    Rancher agents can be hijacked by taking over the Rancher Server URL

    Published 26 Sept 2024 · Fixed in 2.7.15, 2.8.8, 2.9.2 · Project advisories (GitHub)
  35. Medium 4.3

    CVE-2024-9155 · Mattermost

    Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, 9.5.x <= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view them in channels that they are a member of.

    Published 26 Sept 2024 · Fixed in 9.5.9, 9.9.3, 9.10.2 · NVD
  36. Medium 4.3

    CVE-2024-47145 · Mattermost

    Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links.

    Published 26 Sept 2024 · Fixed in 9.5.9 · NVD
  37. Medium 6.5

    CVE-2024-47003 · Mattermost

    Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.

    Published 26 Sept 2024 · Fixed in 9.5.9 · NVD
  38. Medium 5.4

    CVE-2024-45843 · Mattermost

    Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.

    Published 26 Sept 2024 · Fixed in 9.5.9 · NVD
  39. Medium 5.4

    CVE-2024-42406 · Mattermost

    Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files.

    Published 26 Sept 2024 · Fixed in 9.5.9, 9.9.3, 9.10.2 · NVD
  40. Low 2.7

    CVE-2024-4278 · GitLab

    An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting.

    Published 26 Sept 2024 · Fixed in 17.2.8, 17.3.4 · NVD
  41. High 7.3

    CVE-2024-45817 · Xen

    In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, the OS can opt to receive an interrupt when a new error occurs. It is possible to configure the error interrupt with an illegal vector, which generates an error when an error interrupt is raised. This case causes Xen to recurse through vlapic_error(). The…

    Published 25 Sept 2024 · NVD
  42. High 7.5

    CVE-2024-31145 · Xen

    Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions…

    Published 25 Sept 2024 · NVD
  43. Medium 6.1

    CVE-2024-9148 · Flowise

    Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.

    Published 25 Sept 2024 · Fixed in 2.1.1 · NVD
  44. Medium 5.1

    CVE-2024-8291 · Concrete CMS

    Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color.  A rogue admin could add malicious code to the Thumbnails/Add-Type. The Concrete CMS Security Team gave this a CVSS v4 score of 5.1 with vector https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N…

    Published 25 Sept 2024 · Fixed in 9.3.3 · NVD
  45. Medium 4.6

    CVE-2024-7398 · Concrete CMS

    Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with permission to modify event calendars can execute scripts. The Concrete CMS Security Team gave this…

    Published 25 Sept 2024 · Fixed in 8.5.19, 9.3.3 · NVD
  46. Medium 5.4

    CVE-2024-47048 · Rocket.Chat

    Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier allows stored XSS in the description and release notes of the marketplace and private apps.

    Published 25 Sept 2024 · Fixed in 6.9.7, 6.10.6, 6.11.3 · NVD
  47. High 7.5

    CVE-2024-46935 · Rocket.Chat

    Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service (DoS). Attackers who craft messages with specific characters may crash the workspace due to an issue in the message parser.

    Published 25 Sept 2024 · Fixed in 6.9.7, 6.10.6, 6.11.3 · NVD
  48. Medium 6.1

    CVE-2024-46934 · Rocket.Chat

    Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS). Attackers may be able to abuse the UpdateOTRAck method to forge a message that contains an XSS payload.

    Published 25 Sept 2024 · Fixed in 6.9.7, 6.10.6, 6.11.3 · NVD
  49. Medium 5.4

    CVE-2024-8725 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Unrestricted Upload of File with Dangerous Type

    Published 25 Sept 2024 · Fixed in 5.2.9 · WPVulnerability
  50. High 7.2

    CVE-2024-8704 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Path Traversal

    Published 25 Sept 2024 · Fixed in 5.2.9 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.