UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,085
Published in 7 days
632
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,085 vulnerabilities
  1. Critical 9.8

    CVE-2024-45507 · Apache OFBiz

    Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

    Published 4 Sept 2024 · Fixed in 18.12.16 · NVD
  2. High 7.5Actively exploited

    CVE-2024-45195 · Apache OFBiz

    Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

    Published 4 Sept 2024 · Fixed in 18.12.16 · NVD
  3. Medium 6.1

    CVE-2024-45429 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Cross-site Scripting

    Published 4 Sept 2024 · Fixed in 6.3.6 · WPVulnerability
  4. High 7.5

    CVE-2024-41436 · ClickHouse

    ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.

    Published 3 Sept 2024 · NVD
  5. Medium 6.5

    CVE-2024-42903 · LimeSurvey

    A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain.

    Published 3 Sept 2024 · NVD
  6. High 8.8

    CVE-2024-42902 · LimeSurvey

    An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js_localize.php function

    Published 3 Sept 2024 · NVD
  7. Medium 4.8

    CVE-2024-42901 · LimeSurvey

    A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file.

    Published 3 Sept 2024 · NVD
  8. High 7.5

    CVE-2024-6119 · OpenSSL

    Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of service. Applications performing certificate name checks (e.g., TLS clients checking server…

    Published 3 Sept 2024 · Fixed in 3.1.7, 3.2.3, 3.3.2 · NVD
  9. High 7.5

    CVE-2024-6232 · Python

    There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

    Published 3 Sept 2024 · Fixed in 3.10.15, 3.11.10, 3.12.6 · NVD
  10. Low 3.6

    CVE-2024-45310 · runc

    runc can be tricked into creating empty files/directories on the host

    Published 3 Sept 2024 · Fixed in 1.1.14 · NVD, Project advisories (GitHub)
  11. High 7.5

    CVE-2024-7870 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Improper Authentication

    Published 3 Sept 2024 · Fixed in 9.7.2 · WPVulnerability
  12. Medium 5.4

    CVE-2024-45621 · Rocket.Chat

    The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a separate browser upon encountering third-party external actions from PDF documents.

    Published 2 Sept 2024 · NVD
  13. Medium 6.5

    CVE-2024-8365 · HashiCorp Vault

    Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and…

    Published 2 Sept 2024 · Fixed in 1.16.9, 1.17.5 · NVD
  14. Medium 5.4

    CVE-2024-45047 · Svelte

    Potential XSS vulnerability due to improper HTML attribute escaping

    Published 30 Aug 2024 · Fixed in 4.2.19 · Project advisories (GitHub)
  15. Critical 9.8

    CVE-2024-45492 · Expat

    An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

    Published 30 Aug 2024 · Fixed in 2.6.3 · NVD
  16. Critical 9.8

    CVE-2024-45491 · Expat

    An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

    Published 30 Aug 2024 · Fixed in 2.6.3 · NVD
  17. High 7.5

    CVE-2024-45490 · Expat

    An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

    Published 30 Aug 2024 · Fixed in 2.6.3 · NVD
  18. Medium 5.3

    CVE-2024-45440 · Drupal

    core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

    Published 29 Aug 2024 · NVD
  19. High 8.1

    CVE-2024-41964 · Kirby

    Insufficient permission checks in the language settings

    Published 29 Aug 2024 · Fixed in 3.9.8.2, 3.10.1.1, 4.3.1 · NVD, Project advisories (GitHub)
  20. High 7.5

    CVE-2024-45436 · Ollama

    extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.

    Published 29 Aug 2024 · Fixed in 0.1.47 · NVD
  21. High 8.1

    CVE-2024-7745 · WS_FTP Server

    In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the second-factor verification and log in with username and password only.

    Published 28 Aug 2024 · Fixed in 8.8.8 · NVD
  22. Medium 6.5

    CVE-2024-7744 · WS_FTP Server

    In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal.   An authenticated file download flaw has been identified where a user can craft an API call that allows them to download a file from an…

    Published 28 Aug 2024 · Fixed in 8.8.8 · NVD
  23. High 7.5

    CVE-2024-8182 · Flowise

    An Unauthenticated Denial of Service (DoS) vulnerability exists in Flowise version 1.8.2 leading to a complete crash of the instance running a vulnerable version due to improper handling of user supplied input to the “/api/v1/get-upload-file” api endpoint.

    Published 27 Aug 2024 · NVD
  24. High 8.1

    CVE-2024-8181 · Flowise

    An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an administrator and allow them to access restricted functionality.

    Published 27 Aug 2024 · NVD
  25. Medium 6.7

    CVE-2024-8207 · MongoDB

    In certain highly specific configurations of the host system and MongoDB server binary installation on Linux Operating Systems, it may be possible for a unintended actor with host-level access to cause the MongoDB Server binary to load unintended actor-controlled shared libraries when the server binary is started, potentially resulting in the unintended actor gaining full control over the…

    Published 27 Aug 2024 · Fixed in 5.0.14, 6.0.3, 6.1.1 · NVD
  26. Medium 5.4

    CVE-2024-41878 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link.

    Published 23 Aug 2024 · Fixed in 6.5.20.0, 2024.03 · NVD
  27. Medium 5.4

    CVE-2024-41877 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 23 Aug 2024 · Fixed in 6.5.20.0, 2024.03 · NVD
  28. Medium 5.4

    CVE-2024-41876 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  29. Medium 5.4

    CVE-2024-41875 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  30. Medium 4.1

    CVE-2024-41849 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. An low-privileged attacker could leverage this vulnerability to slightly affect the integrity of the page. Exploitation of this issue requires user interaction and scope is changed.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  31. Medium 5.4

    CVE-2024-41848 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  32. Medium 5.4

    CVE-2024-41847 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  33. Medium 5.4

    CVE-2024-41846 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  34. Medium 5.4

    CVE-2024-41845 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  35. Medium 5.4

    CVE-2024-41844 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  36. Medium 5.4

    CVE-2024-41843 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  37. Medium 4.8

    CVE-2024-41842 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  38. Medium 5.4

    CVE-2024-41841 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 23 Aug 2024 · Fixed in 6.5.21, 2024.5 · NVD
  39. High 7.3

    GHSA-34qg-65m4-f23m · Froxlor

    /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains <SQL_UNPRIVILEGED_PASSWORD>

    Published 23 Aug 2024 · Fixed in 2.2.0 · Project advisories (GitHub)
  40. Critical 9.8Actively exploited

    CVE-2024-40766 · SonicWall SonicOS

    An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

    Published 23 Aug 2024 · Fixed in 5.9.2.14-13o, 6.5.2.8-2n, 6.5.4.15.116n · NVD
  41. Medium 6.5

    CVE-2024-8041 · GitLab

    A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1. A denial of service could occur upon importing a maliciously crafted repository using the GitHub importer.

    Published 22 Aug 2024 · Fixed in 17.1.6, 17.2.4, 17.3.1 · NVD
  42. Medium 6.4

    CVE-2024-7110 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection.

    Published 22 Aug 2024 · Fixed in 17.1.6, 17.2.4, 17.3.1 · NVD
  43. Medium 6.5

    CVE-2024-6502 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, which allows an attacker to create a branch with the same name as a deleted tag.

    Published 22 Aug 2024 · Fixed in 17.1.6, 17.2.4, 17.3.1 · NVD
  44. Medium 4.3

    CVE-2024-43780 · Mattermost

    Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel.

    Published 22 Aug 2024 · Fixed in 9.5.8, 9.8.3, 9.9.2 · NVD
  45. Medium 4.9

    CVE-2024-42497 · Mattermost

    Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.

    Published 22 Aug 2024 · Fixed in 9.5.8, 9.8.3, 9.9.2 · NVD
  46. Low 2.7

    CVE-2024-40884 · Mattermost

    Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL.

    Published 22 Aug 2024 · Fixed in 9.5.8 · NVD
  47. Medium 4.3

    CVE-2024-3127 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL allowing unauthorised users to perform some actions at the group level.

    Published 22 Aug 2024 · Fixed in 17.1.6, 17.2.4 · NVD
  48. High 7.5

    CVE-2024-42490 · authentik

    Insufficient Authorization for several API endpoints

    Published 22 Aug 2024 · Fixed in 2024.4.4, 2024.6.4 · NVD, Project advisories (GitHub)
  49. High 7.2

    CVE-2024-8071 · Mattermost

    Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role (e.g. member) to include the `manage_system` permission, effectively becoming a System Admin.

    Published 22 Aug 2024 · Fixed in 9.8.3, 9.9.2, 9.10.1 · NVD
  50. Medium 4.3

    CVE-2024-43813 · Mattermost

    Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any channel inside any team as read for any user.

    Published 22 Aug 2024 · Fixed in 9.5.8, 9.10.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.