UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,084
Published in 7 days
632
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,084 vulnerabilities
  1. High 8.8

    CVE-2024-8126 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Unrestricted Upload of File with Dangerous Type

    Published 25 Sept 2024 · Fixed in 5.2.9 · WPVulnerability
  2. Medium 4.8

    CVE-2024-9169 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 24 Sept 2024 · Fixed in 6.5 · NVD, WPVulnerability
  3. Medium 5.4

    CVE-2024-8668 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 24 Sept 2024 · Fixed in 2.9.8 · WPVulnerability
  4. Medium 6.5

    CVE-2024-9014 · pgAdmin

    pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

    Published 23 Sept 2024 · Fixed in 8.12 · NVD
  5. High 7.5

    CVE-2023-5359 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 23 Sept 2024 · Fixed in 2.7.6 · WPVulnerability
  6. High 7.5

    CVE-2024-45810 · Envoy

    Envoy crashes for `LocalReply` in HTTP async client

    Published 19 Sept 2024 · Fixed in 1.29.9, 1.30.6, 1.31.2 · NVD, Project advisories (GitHub)
  7. High 7.5

    CVE-2024-45809 · Envoy

    JWT filter crash in the clear route cache with remote JWKs

    Published 19 Sept 2024 · Fixed in 1.29.9, 1.30.6, 1.31.2 · NVD, Project advisories (GitHub)
  8. Medium 6.5

    CVE-2024-45806 · Envoy

    Potential to manipulate `x-envoy` headers from external sources

    Published 19 Sept 2024 · Fixed in 1.29.9, 1.30.6, 1.31.2 · NVD, Project advisories (GitHub)
  9. Medium 6.5

    CVE-2024-45808 · Envoy

    Malicious log injection via access logs

    Published 19 Sept 2024 · Fixed in 1.29.9, 1.30.6, 1.31.2 · NVD, Project advisories (GitHub)
  10. High 7.5

    CVE-2024-45807 · Envoy

    Oghttp2 crash on `OnBeginHeadersForStream`

    Published 19 Sept 2024 · Fixed in 1.31.2 · NVD, Project advisories (GitHub)
  11. High 7.5

    CVE-2024-45410 · Traefik

    HTTP client can remove the X-Forwarded headers

    Published 19 Sept 2024 · Fixed in 2.11.9, 3.1.3 · NVD, Project advisories (GitHub)
  12. Medium 6.5

    CVE-2024-47060 · ZITADEL

    Unauthorized Access After Organization or Project Deactivation

    Published 19 Sept 2024 · Fixed in 2.58.5, 2.59.3, 2.60.2 · NVD, Project advisories (GitHub)
  13. High 7.5

    CVE-2024-47000 · ZITADEL

    Service Users Deactivation not Working

    Published 19 Sept 2024 · Fixed in 2.58.5, 2.59.3, 2.60.2 · NVD, Project advisories (GitHub)
  14. Medium 6.5

    CVE-2024-46999 · ZITADEL

    User Grant Deactivation not Working

    Published 19 Sept 2024 · Fixed in 2.58.5, 2.59.3, 2.60.2 · NVD, Project advisories (GitHub)
  15. Medium 6.1

    CVE-2024-47050 · Mautic

    XSS in contact/company tracking (no authentication)

    Published 18 Sept 2024 · Fixed in 4.4.13, 5.1.1 · NVD, Project advisories (GitHub)
  16. Medium 4.3

    CVE-2024-47059 · Mautic

    Users enumeration - weak password login

    Published 18 Sept 2024 · Fixed in 5.1.1 · NVD, Project advisories (GitHub)
  17. High 7.5

    CVE-2022-25770 · Mautic

    Insufficient authentication in upgrade flow

    Published 18 Sept 2024 · Fixed in 4.4.13, 5.1.1 · NVD, Project advisories (GitHub)
  18. Medium 5.4

    CVE-2021-27917 · Mautic

    XSS in contact tracking and page hits report

    Published 18 Sept 2024 · Fixed in 4.4.13, 5.1.1 · NVD, Project advisories (GitHub)
  19. Medium 4.8

    CVE-2024-47058 · Mautic

    Cross-site Scripting (XSS) - stored (edit form HTML field)

    Published 18 Sept 2024 · Fixed in 4.4.13, 5.1.1 · NVD, Project advisories (GitHub)
  20. Medium 6.5

    CVE-2022-25768 · Mautic

    Improper Access Control in UI upgrade process

    Published 18 Sept 2024 · Fixed in 4.4.13, 5.1.1 · NVD, Project advisories (GitHub)
  21. Medium 5.0

    CVE-2024-46990 · Directus

    SSRF Loopback IP filter bypass

    Published 18 Sept 2024 · Fixed in 10.13.3, 11.1.0 · NVD, Project advisories (GitHub)
  22. High 7.5

    CVE-2024-46982 · Next.js

    Next.js Cache Poisoning

    Published 17 Sept 2024 · Fixed in 13.5.7, 14.2.10 · OSV.dev and GitHub, Project advisories (GitHub)
  23. Medium

    CVE-2024-4629 · Keycloak

    Potential bypass of brute force protection

    Published 17 Sept 2024 · Fixed in 25.0.4 · Project advisories (GitHub)
  24. Medium 4.6

    CVE-2024-8660 · Concrete CMS

    Concrete CMS versions 9.0.0 through 9.3.3 are affected by a stored XSS vulnerability in the "Top Navigator Bar" block. Since the "Top Navigator Bar" output was not sufficiently sanitized, a rogue administrator could add a malicious payload that could be executed when targeted users visited the home page.The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 4.6 with vector…

    Published 17 Sept 2024 · Fixed in 9.3.4 · NVD
  25. Critical 9.8Actively exploited

    CVE-2024-38813 · VMware vCenter Server

    The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.

    Published 17 Sept 2024 · NVD
  26. Critical 9.8Actively exploited

    CVE-2024-38812 · VMware vCenter Server

    The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

    Published 17 Sept 2024 · NVD
  27. Medium 5.3

    GHSA-3m9q-ww7w-qc5j · Mastodon

    Subdomains allow spoofing of accounts in search results

    Published 17 Sept 2024 · Project advisories (GitHub)
  28. Medium 4.3

    CVE-2024-45605 · Sentry

    Improper authorization on deletion of user issue alert notifications

    Published 17 Sept 2024 · Fixed in 24.9.0 · NVD, Project advisories (GitHub)
  29. Medium 4.3

    CVE-2024-45606 · Sentry

    Improper authorization on muting of alert rules

    Published 17 Sept 2024 · Fixed in 24.9.0 · NVD, Project advisories (GitHub)
  30. High 8.8

    CVE-2024-45398 · Contao

    Remote command execution through file uploads

    Published 17 Sept 2024 · Fixed in 4.13.49, 5.3.15, 5.4.3 · NVD, Project advisories (GitHub)
  31. Medium 4.3

    CVE-2024-45604 · Contao

    Directory traversal in the FileSelector widget

    Published 17 Sept 2024 · Fixed in 4.13.49 · NVD, Project advisories (GitHub)
  32. Medium 5.3

    CVE-2024-45612 · Contao

    Insert tag injection via canonical URLs

    Published 17 Sept 2024 · Fixed in 4.13.49, 5.3.15, 5.4.3 · NVD, Project advisories (GitHub)
  33. Medium 4.3

    CVE-2024-6685 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2, where group runners information was disclosed to unauthorised group members.

    Published 16 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  34. Medium 6.1

    CVE-2024-4283 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 11.1 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow.

    Published 16 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  35. Medium 4.6

    CVE-2024-8661 · Concrete CMS

    Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload by executing it in the browsers of targeted users. The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 4.6 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N…

    Published 16 Sept 2024 · Fixed in 8.5.19, 9.3.4 · NVD
  36. High 7.5

    CVE-2024-46938 · Sitecore Experience Platform

    An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files.

    Published 15 Sept 2024 · NVD
  37. Medium 5.4

    CVE-2024-39926 · Vaultwarden

    An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A stored cross-site scripting (XSS) or, due to the default CSP, HTML injection vulnerability has been discovered in the admin dashboard. This potentially allows an authenticated attacker to inject malicious code into the dashboard, which is then executed or rendered in the context of an administrator's browser when viewing…

    Published 13 Sept 2024 · NVD
  38. Medium 6.5

    CVE-2024-39925 · Vaultwarden

    An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the shared organization key is not rotated when a member departs. Consequently, the departing member, whose access should be revoked, retains a copy of the organization key. Additionally, the application fails to adequately protect some…

    Published 13 Sept 2024 · NVD
  39. High 8.8

    CVE-2024-39924 · Vaultwarden

    An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A vulnerability has been identified in the authentication and authorization process of the endpoint responsible for altering the metadata of an emergency access. It permits an attacker with granted emergency access to escalate their privileges by changing the access level and modifying the wait time. Consequently, the…

    Published 13 Sept 2024 · NVD
  40. High 7.5

    CVE-2024-6587 · LiteLLM

    A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to send the request to the domain specified by `api_base`. This request includes the OpenAI API key. A malicious user can set the `api_base` to their own domain…

    Published 13 Sept 2024 · NVD
  41. High 7.5

    CVE-2024-45113 · Adobe ColdFusion

    ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does not require user interaction.

    Published 13 Sept 2024 · NVD
  42. Critical 9.8

    CVE-2024-41874 · Adobe ColdFusion

    ColdFusion versions 2023.9, 2021.15 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability by providing crafted input to the application, which when deserialized, leads to execution of malicious code. Exploitation of this issue does not require…

    Published 13 Sept 2024 · NVD
  43. High 8.8

    CVE-2024-8641 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It may have been possible for an attacker with a victim's CI_JOB_TOKEN to obtain a GitLab session token belonging to the victim.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  44. Medium 6.5

    CVE-2024-8311 · GitLab

    An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template.

    Published 12 Sept 2024 · Fixed in 17.2.5, 17.3.2 · NVD
  45. High 8.8

    CVE-2024-6678 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  46. Medium 5.5

    CVE-2024-4472 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, where dependency proxy credentials are retained in graphql Logs.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  47. High 8.1

    CVE-2024-8754 · GitLab

    An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is configured.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  48. High 8.8

    CVE-2024-8640 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. Due to incomplete input filtering, it was possible to inject commands into a connected Cube server.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  49. Medium 6.5

    CVE-2024-8635 · GitLab

    A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy URL

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  50. High 7.2

    CVE-2024-8631 · GitLab

    A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. A user assigned the Admin Group Member custom role could have escalated their privileges to include other custom roles.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.