UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,093
Published in 7 days
640
Critical in 30 days
389
Actively exploited
420

Latest vulnerabilities

38,093 vulnerabilities
  1. High 8.8

    CVE-2024-39063 · LimeSurvey

    Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). The YII_CSRF_TOKEN is only checked when passed in the body of POST requests, but the same check isn't performed in the equivalent GET requests.

    Published 9 Jul 2024 · NVD
  2. High 7.5

    CVE-2024-38095 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 9 Jul 2024 · Fixed in 8.0.7 · NVD
  3. High 8.8

    CVE-2024-38088 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  4. High 8.8

    CVE-2024-38087 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  5. High 7.3

    CVE-2024-38081 · .NET

    .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

    Published 9 Jul 2024 · Fixed in 6.0.32 · NVD
  6. High 8.8

    CVE-2024-37336 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  7. High 8.8

    CVE-2024-37334 · Microsoft SQL Server

    Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  8. High 8.8

    CVE-2024-37333 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  9. High 8.8

    CVE-2024-37332 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  10. High 8.8

    CVE-2024-37331 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  11. High 8.8

    CVE-2024-37330 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  12. High 8.8

    CVE-2024-37329 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  13. High 8.8

    CVE-2024-37328 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  14. High 8.8

    CVE-2024-37327 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  15. High 8.8

    CVE-2024-37326 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  16. High 8.8

    CVE-2024-37324 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  17. High 8.8

    CVE-2024-37323 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  18. High 8.8

    CVE-2024-37322 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  19. High 8.8

    CVE-2024-37321 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  20. High 8.8

    CVE-2024-37320 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  21. High 8.8

    CVE-2024-37319 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  22. High 8.8

    CVE-2024-37318 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  23. High 8.8

    CVE-2024-35272 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  24. High 8.8

    CVE-2024-35271 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  25. High 8.1

    CVE-2024-35264 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 8.0.7 · NVD
  26. High 8.8

    CVE-2024-35256 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  27. High 7.5

    CVE-2024-30105 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 9 Jul 2024 · NVD
  28. High 8.8

    CVE-2024-28928 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  29. Medium 6.1

    CVE-2024-26279 · Joomla!

    The wrapper extensions do not correctly validate inputs, leading to XSS vectors.

    Published 9 Jul 2024 · Fixed in 3.10.16, 4.4.6, 5.1.2 · NVD
  30. Medium 6.1

    CVE-2024-26278 · Joomla!

    The Custom Fields component not correctly filter inputs, leading to a XSS vector.

    Published 9 Jul 2024 · Fixed in 3.10.16, 4.4.6, 5.1.2 · NVD
  31. Medium 6.1

    CVE-2024-21731 · Joomla!

    Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.

    Published 9 Jul 2024 · NVD
  32. Medium 5.4

    CVE-2024-21730 · Joomla!

    The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector.

    Published 9 Jul 2024 · Fixed in 4.4.6, 5.1.2 · NVD
  33. Medium 6.1

    CVE-2024-21729 · Joomla!

    Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.

    Published 9 Jul 2024 · Fixed in 4.4.6, 5.1.2 · NVD
  34. High 8.8

    CVE-2024-21449 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  35. High 8.8

    CVE-2024-21428 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  36. High 8.8

    CVE-2024-21425 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  37. High 8.8

    CVE-2024-21415 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  38. High 8.8

    CVE-2024-21414 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  39. High 8.8

    CVE-2024-21398 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  40. High 8.8

    CVE-2024-21373 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  41. High 8.8

    CVE-2024-21335 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  42. High 8.8

    CVE-2024-21333 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  43. High 8.8

    CVE-2024-21332 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  44. High 8.8

    CVE-2024-21331 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  45. High 8.8

    CVE-2024-21317 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  46. High 8.8

    CVE-2024-21308 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  47. High 8.8

    CVE-2024-21303 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  48. High 8.8

    CVE-2024-20701 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · NVD
  49. Medium 4.8

    CVE-2024-33509 · Fortinet FortiWeb

    An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and unauthenticated attacker in a Man-in-the-Middle position to decipher and/or tamper with the communication channel between the device and different endpoints used to fetch data for Web Application Firewall (WAF).

    Published 9 Jul 2024 · Fixed in 7.2.2 · NVD
  50. Medium 4.7

    CVE-2024-26015 · Fortinet FortiProxy, Fortinet FortiOS

    An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.15 and below IP address validation feature may permit an unauthenticated attacker to bypass the IP blocklist via crafted requests.

    Published 9 Jul 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.