UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,085
Published in 7 days
632
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,085 vulnerabilities
  1. Medium 6.1

    CVE-2024-6706 · Open WebUI

    Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.

    Published 7 Aug 2024 · NVD
  2. Medium 6.3

    CVE-2024-43045 · Jenkins

    Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views".

    Published 7 Aug 2024 · Fixed in 2.452.4, 2.471 · NVD
  3. High 8.8

    CVE-2024-43044 · Jenkins

    Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.

    Published 7 Aug 2024 · Fixed in 2.452.4, 2.471 · NVD
  4. High 7.8

    CVE-2024-7553 · MongoDB

    Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0…

    Published 7 Aug 2024 · Fixed in 6.0.16, 7.0.12, 7.3.3 · NVD
  5. Medium 5.3

    CVE-2024-42400 · HPE ArubaOS

    Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.

    Published 6 Aug 2024 · Fixed in 10.4.1.2 · NVD
  6. Medium 5.3

    CVE-2024-42399 · HPE ArubaOS

    Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.

    Published 6 Aug 2024 · Fixed in 10.4.1.2 · NVD
  7. Medium 5.3

    CVE-2024-42398 · HPE ArubaOS

    Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.

    Published 6 Aug 2024 · Fixed in 10.4.1.2 · NVD
  8. Critical 9.8

    CVE-2024-42395 · HPE ArubaOS

    There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

    Published 6 Aug 2024 · Fixed in 10.4.1.4, 10.6.0.1 · NVD
  9. Critical 9.8

    CVE-2024-42394 · HPE ArubaOS

    There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

    Published 6 Aug 2024 · Fixed in 10.4.1.4, 10.6.0.1 · NVD
  10. Critical 9.8

    CVE-2024-42393 · HPE ArubaOS

    There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

    Published 6 Aug 2024 · Fixed in 10.4.1.4, 10.6.0.1 · NVD
  11. High 7.8

    CVE-2024-43114 · TeamCity

    In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions

    Published 6 Aug 2024 · Fixed in 2024.07.1 · NVD
  12. Medium 6.9

    CVE-2024-7055 · FFmpeg

    A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is…

    Published 6 Aug 2024 · Fixed in 5.1.6, 6.1.2, 7.0.2 · NVD
  13. Critical 9.3Actively exploited

    CVE-2024-42009 · Roundcube

    A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

    Published 5 Aug 2024 · Fixed in 1.5.8, 1.6.8 · NVD
  14. Critical 9.3

    CVE-2024-42008 · Roundcube

    A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.

    Published 5 Aug 2024 · Fixed in 1.5.8, 1.6.8 · NVD
  15. High 8.8

    CVE-2024-23657 · Nuxt

    Path Traversal: '../filedir' in Nuxt Devtools

    Published 5 Aug 2024 · Fixed in 1.3.9 · Project advisories (GitHub)
  16. Medium 6.3

    CVE-2024-34343 · Nuxt

    XSS in navigateTo if used after SSR

    Published 5 Aug 2024 · Fixed in 3.12.4 · Project advisories (GitHub)
  17. Critical 9.8Actively exploited

    CVE-2024-38856 · Apache OFBiz

    Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on…

    Published 5 Aug 2024 · Fixed in 18.12.15 · NVD
  18. High 8.6

    CVE-2024-39713 · Rocket.Chat

    A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.

    Published 5 Aug 2024 · Fixed in 6.10.1 · NVD
  19. High 7.7

    CVE-2024-3056 · Podman

    A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least one other container, can create a large number of IPC resources in /dev/shm. The malicious container will continue to exhaust resources until it is out-of-memory (OOM) killed. While the malicious container's cgroup will be removed, the IPC…

    Published 2 Aug 2024 · NVD
  20. High 8.8

    CVE-2024-7031 · Filester (WordPress plugin)

    File Manager Pro – Filester: Missing Authorization

    Published 2 Aug 2024 · Fixed in 1.8.3 · WPVulnerability
  21. Medium 4.6

    CVE-2024-4353 · Concrete CMS

    Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. The Name input field does not check the input sufficiently letting a rogue administrator have the capability to inject malicious JavaScript code. The Concrete CMS security team gave this vulnerability a CVSS v4 score of 4.6 with a vector of…

    Published 1 Aug 2024 · Fixed in 9.3.3 · NVD
  22. High

    CVE-2024-6873 · ClickHouse

    Specially crafted request could caused undefined behavior which may lead to Remote Code Execution.

    Published 1 Aug 2024 · Fixed in 24.4.2.141-stable, 24.5.1.1763, 24.6.1.4423-stable · Project advisories (GitHub)
  23. Medium 4.3

    CVE-2024-41926 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.

    Published 1 Aug 2024 · Fixed in 9.5.7 · NVD
  24. Medium 4.3

    CVE-2024-41162 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow the modification of local channels by a remote, when shared channels are enabled, which allows a malicious remote to make an arbitrary local channel read-only.

    Published 1 Aug 2024 · Fixed in 9.5.7, 9.7.6, 9.8.2 · NVD
  25. High 7.1

    CVE-2024-41144 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly validate synced posts, when shared channels are enabled,  which allows a malicious remote to create/update/delete arbitrary posts in arbitrary channels

    Published 1 Aug 2024 · Fixed in 9.5.7, 9.7.6, 9.8.2 · NVD
  26. Medium 4.3

    CVE-2024-39839 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow users to set their own remote username, when shared channels were enabled, which allows a user on a remote to set their remote username prop to an arbitrary string, which would be then synced to the local server as long as the user hadn't been synced before.

    Published 1 Aug 2024 · Fixed in 9.5.7, 9.7.6, 9.8.2 · NVD
  27. Medium 5.4

    CVE-2024-39837 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly restrict channel creation which allows a malicious remote to create arbitrary channels, when shared channels were enabled.

    Published 1 Aug 2024 · Fixed in 9.5.7 · NVD
  28. High 8.7

    CVE-2024-39832 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to properly safeguard an error handling which allows a malicious remote to permanently delete local data by abusing dangerous error handling, when share channels were enabled.

    Published 1 Aug 2024 · Fixed in 9.5.7, 9.7.6, 9.8.2 · NVD
  29. Critical 9.6

    CVE-2024-39777 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local channel will then become shared without the consent of the local admin.

    Published 1 Aug 2024 · Fixed in 9.5.7, 9.7.6, 9.8.2 · NVD
  30. Medium 6.5

    CVE-2024-39274 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to properly validate that the channel that comes from the sync message is a shared channel, when shared channels are enabled, which allows a malicious remote to add users to arbitrary teams and channels

    Published 1 Aug 2024 · Fixed in 9.5.7, 9.7.6, 9.8.2 · NVD
  31. Medium 6.4

    CVE-2024-36492 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5, 9.8.x <= 9.8.1 fail to disallow the modification of local users when syncing users in shared channels. which allows a malicious remote to overwrite an existing local user.

    Published 1 Aug 2024 · Fixed in 9.5.7, 9.7.6, 9.8.2 · NVD
  32. Medium 4.3

    CVE-2024-29977 · Mattermost

    Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6 fail to properly validate synced reactions, when shared channels are enabled, which allows a malicious remote to create arbitrary reactions on arbitrary posts

    Published 1 Aug 2024 · Fixed in 9.5.7 · NVD
  33. High 7.5

    CVE-2024-23444 · Elasticsearch

    It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.

    Published 31 Jul 2024 · Fixed in 7.17.23, 8.13.0 · NVD
  34. Medium 6.1

    CVE-2024-41953 · ZITADEL

    Improper HTML sanitization in emails and Console UI

    Published 31 Jul 2024 · Fixed in 2.54.8, 2.55.5, 2.56.2 · NVD, Project advisories (GitHub)
  35. Medium 5.3

    CVE-2024-41952 · ZITADEL

    "Ignoring unknown usernames" vulnerability

    Published 31 Jul 2024 · Fixed in 2.54.8, 2.55.5, 2.56.2 · NVD, Project advisories (GitHub)
  36. Medium 6.5

    CVE-2024-7264 · curl

    libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also…

    Published 31 Jul 2024 · Fixed in 8.9.1 · NVD
  37. Medium 4.3

    CVE-2024-22278 · Harbor

    Harbor fails to validate the user permissions when updating project configurations

    Published 31 Jul 2024 · Fixed in 2.9.5, 2.10.3 · NVD, Project advisories (GitHub)
  38. Medium 6.5

    CVE-2024-37281 · Kibana

    An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint.

    Published 30 Jul 2024 · Fixed in 7.17.23, 8.14.0 · NVD
  39. High 8.8

    CVE-2024-7297 · Langflow

    Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint.

    Published 30 Jul 2024 · Fixed in 1.0.13 · NVD
  40. Medium 6.1

    CVE-2024-39320 · Discourse

    Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed_iframes setting. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.

    Published 30 Jul 2024 · Fixed in 3.2.5 · NVD
  41. High 7.5

    CVE-2024-37299 · Discourse

    Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, crafting requests to submit very long tag group names can reduce the availability of a Discourse instance. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.

    Published 30 Jul 2024 · Fixed in 3.2.5 · NVD
  42. Medium 6.1

    CVE-2024-37165 · Discourse

    Discourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. This vulnerability is fixed in 3.2.3 and 3.3.0.beta3.

    Published 30 Jul 2024 · Fixed in 3.2.3 · NVD
  43. High 7.8

    CVE-2024-41817 · ImageMagick

    ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick` might use an empty path when setting `MAGICK_CONFIGURE_PATH` and `LD_LIBRARY_PATH` environment variables while executing, which might lead to arbitrary code execution by loading malicious configuration files or shared libraries in the current working…

    Published 29 Jul 2024 · Fixed in 7.1.1-36 · NVD
  44. Critical 9.8

    CVE-2024-6576 · MOVEit Transfer

    Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.12, from 2023.1.0 before 2023.1.7, from 2024.0.0 before 2024.0.3.

    Published 29 Jul 2024 · Fixed in 2023.0.12, 2023.1.7, 2024.0.3 · NVD
  45. High 8.2

    CVE-2024-35296 · Apache Traffic Server

    Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.

    Published 26 Jul 2024 · Fixed in 8.1.11, 9.2.5 · NVD
  46. High 7.5

    CVE-2024-35161 · Apache Traffic Server

    Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users can set a new setting (proxy.config.http.drop_chunked_trailers) not to forward chunked…

    Published 26 Jul 2024 · Fixed in 8.1.11, 9.2.5 · NVD
  47. High 7.5

    CVE-2023-38522 · Apache Traffic Server

    Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or…

    Published 26 Jul 2024 · Fixed in 8.1.11, 9.2.5 · NVD
  48. Medium 6.5

    CVE-2023-49921 · Elasticsearch

    An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the…

    Published 26 Jul 2024 · Fixed in 7.17.16, 8.11.2 · NVD
  49. High 7.5

    CVE-2024-41800 · Craft CMS

    Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.

    Published 25 Jul 2024 · Fixed in 5.2.3 · NVD
  50. Medium 6.1

    CVE-2024-41801 · OpenProject

    Open Redirect Vulnerability in Sign-In in default configuration of OpenProject packaged installation

    Published 25 Jul 2024 · Fixed in 14.3.0 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.