UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,085
Published in 7 days
632
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,085 vulnerabilities
  1. High 7.2

    CVE-2024-8631 · GitLab

    A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. A user assigned the Admin Group Member custom role could have escalated their privileges to include other custom roles.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  2. High 7.5

    CVE-2024-8124 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which could cause Denial of Service via sending a specific POST request.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  3. Low 3.5

    CVE-2024-6446 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could be used to trick a victim to trust an attacker controlled application.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  4. Medium 4.3

    CVE-2024-6389 · GitLab

    An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a guest user was able to access commit information via the release Atom endpoint, contrary to permissions.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  5. Medium 6.5

    CVE-2024-5435 · GitLab

    An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2 will disclose user password from repository mirror configuration.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  6. High 7.5

    CVE-2024-4660 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2. It was possible for a guest to read the source code of a private project by using group templates.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  7. Medium 6.1

    CVE-2024-4612 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.9 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  8. Critical 9.1

    CVE-2024-2743 · GitLab

    An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  9. Medium 5.3

    CVE-2024-8691 · Palo Alto Networks PAN-OS

    A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another GlobalProtect user. Active GlobalProtect users impersonated by an attacker who is exploiting this vulnerability are disconnected from GlobalProtect. Upon exploitation, PAN-OS logs indicate that the impersonated user authenticated to…

    Published 11 Sept 2024 · Fixed in 9.1.17, 10.1.11 · NVD
  10. Medium 6.7

    CVE-2024-8688 · Palo Alto Networks PAN-OS

    An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables authenticated administrators (including read-only administrators) with access to the CLI to to read arbitrary files on the firewall.

    Published 11 Sept 2024 · Fixed in 9.1.15, 10.0.10 · NVD
  11. Medium 6.9

    CVE-2024-8687 · Palo Alto Networks PAN-OS

    An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not…

    Published 11 Sept 2024 · Fixed in 10.0.12, 10.1.9, 10.2.4 · NVD
  12. High 8.6

    CVE-2024-8686 · Palo Alto Networks PAN-OS

    A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as root on the firewall.

    Published 11 Sept 2024 · NVD
  13. Medium 6.1

    CVE-2024-8646 · Eclipse GlassFish

    In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish. This vulnerability only affects applications that are explicitly deployed to the root context ('/').

    Published 11 Sept 2024 · Fixed in 7.0.10 · NVD
  14. Medium 6.5

    CVE-2024-8096 · curl

    When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

    Published 11 Sept 2024 · Fixed in 8.10.0 · NVD
  15. Critical 9.8

    CVE-2024-45409 · GitLab

    The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within…

    Published 10 Sept 2024 · Fixed in 17.1.8, 17.2.7, 17.3.3 · NVD
  16. Medium 6.5

    CVE-2024-45596 · Directus

    Session is cached for OpenID and OAuth2 if `redirect` is not used

    Published 10 Sept 2024 · Fixed in 10.13.3, 11.1.0 · NVD, Project advisories (GitHub)
  17. High 7.5

    CVE-2024-43474 · Microsoft SQL Server

    Microsoft SQL Server Information Disclosure Vulnerability

    Published 10 Sept 2024 · Fixed in 14.0.2060.1, 14.0.3475.1, 15.0.2120.1 · NVD
  18. Critical 9.8

    CVE-2024-37980 · Microsoft SQL Server

    Microsoft SQL Server Elevation of Privilege Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  19. High 7.1

    CVE-2024-37966 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Information Disclosure Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  20. High 8.8

    CVE-2024-37965 · Microsoft SQL Server

    Microsoft SQL Server Elevation of Privilege Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  21. Medium 4.3

    CVE-2024-37342 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Information Disclosure Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  22. Critical 9.8

    CVE-2024-37341 · Microsoft SQL Server

    Microsoft SQL Server Elevation of Privilege Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  23. High 8.8

    CVE-2024-37340 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  24. High 8.8

    CVE-2024-37339 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  25. High 8.8

    CVE-2024-37338 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  26. Medium 4.3

    CVE-2024-37337 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Information Disclosure Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  27. High 8.8

    CVE-2024-37335 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  28. High 8.8

    CVE-2024-26191 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  29. High 8.8

    CVE-2024-26186 · Microsoft SQL Server

    Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

    Published 10 Sept 2024 · Fixed in 15.0.4390.2, 16.0.1125.1, 16.0.4140.3 · NVD
  30. Medium 6.5

    CVE-2024-31490 · Fortinet FortiSandbox

    An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2.2 through 3.2.4, FortiSandbox 3.1.5 allows attacker to information disclosure via HTTP get requests.

    Published 10 Sept 2024 · Fixed in 4.2.7, 4.4.5 · NVD
  31. Critical 9.8

    CVE-2024-8654 · MongoDB

    MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3.

    Published 10 Sept 2024 · NVD
  32. Medium 5.0

    CVE-2024-43796 · Express

    express vulnerable to XSS via response.redirect()

    Published 10 Sept 2024 · Fixed in 4.20.0, 5.0.0 · Project advisories (GitHub)
  33. Medium 5.4

    CVE-2024-5416 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 10 Sept 2024 · Fixed in 3.24.0 · NVD, WPVulnerability
  34. Medium 4.8

    CVE-2024-45406 · Craft CMS

    Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.

    Published 9 Sept 2024 · Fixed in 5.1.2 · NVD
  35. High 8.8

    CVE-2024-37288 · Kibana

    A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html  and have configured an Amazon Bedrock connector…

    Published 9 Sept 2024 · NVD
  36. High 8.3

    CVE-2024-40714 · Veeam Backup & Replication

    An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations.

    Published 7 Sept 2024 · Fixed in 12.2.0.334 · NVD
  37. High 7.8

    CVE-2024-40713 · Veeam Backup & Replication

    A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA.

    Published 7 Sept 2024 · Fixed in 12.2.0.334 · NVD
  38. High 7.8

    CVE-2024-40712 · Veeam Backup & Replication

    A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE).

    Published 7 Sept 2024 · Fixed in 12.2.0.334 · NVD
  39. Critical 9.8Actively exploited

    CVE-2024-40711 · Veeam Backup & Replication

    A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

    Published 7 Sept 2024 · Fixed in 12.2.0.334 · NVD
  40. High 8.8

    CVE-2024-40710 · Veeam Backup & Replication

    A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcredentials and passwords). Exploiting these vulnerabilities requires a user who has been assigned a low-privileged role within Veeam Backup & Replication.

    Published 7 Sept 2024 · Fixed in 12.2.0.334 · NVD
  41. High 8.1

    CVE-2024-39718 · Veeam Backup & Replication

    An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account.

    Published 7 Sept 2024 · Fixed in 12.2.0.334 · NVD
  42. High 8.8

    CVE-2024-45498 · Apache Airflow

    Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see https://github.com/apache/airflow/pull/41873  for more information. We…

    Published 7 Sept 2024 · NVD
  43. High 8.8

    CVE-2024-45034 · Apache Airflow

    Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.

    Published 7 Sept 2024 · Fixed in 2.10.1 · NVD
  44. Critical 9.8

    CVE-2024-8517 · SPIP

    SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.

    Published 6 Sept 2024 · Fixed in 4.1.18 · NVD
  45. Critical 9.8

    CVE-2024-44000 · LiteSpeed Cache

    LiteSpeed Cache: Insufficiently Protected Credentials

    Published 5 Sept 2024 · Fixed in 6.5.0.1 · NVD, WPVulnerability
  46. High 7.5

    CVE-2024-45692 · Webmin

    Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.

    Published 4 Sept 2024 · Fixed in 2.202 · NVD
  47. Medium 6.1

    CVE-2024-20506 · ClamAV

    A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files. The vulnerability is due to allowing the ClamD process to write to its log file…

    Published 4 Sept 2024 · Fixed in 0.103.12, 1.0.7, 1.3.2 · NVD
  48. High 7.5

    CVE-2024-20505 · ClamAV

    A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an out of bounds…

    Published 4 Sept 2024 · Fixed in 0.103.12, 1.0.7, 1.3.2 · NVD
  49. High 7.5

    CVE-2024-45506 · HAProxy

    HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

    Published 4 Sept 2024 · Fixed in 2.9.10, 3.0.4 · NVD
  50. High 8.8

    CVE-2024-43402 · Rust

    `std::process::Command` batch files argument escaping could be bypassed with trailing whitespace or periods

    Published 4 Sept 2024 · Fixed in 1.81.0 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.