UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,098
Published in 7 days
644
Critical in 30 days
388
Actively exploited
420

Latest vulnerabilities

38,098 vulnerabilities
  1. High 8.8

    CVE-2024-21308 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  2. High 8.8

    CVE-2024-21303 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · Fixed in 15.0.4382.1, 16.0.1121.4, 16.0.4131.2 · NVD
  3. High 8.8

    CVE-2024-20701 · Microsoft SQL Server

    SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

    Published 9 Jul 2024 · NVD
  4. Medium 4.8

    CVE-2024-33509 · Fortinet FortiWeb

    An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and unauthenticated attacker in a Man-in-the-Middle position to decipher and/or tamper with the communication channel between the device and different endpoints used to fetch data for Web Application Firewall (WAF).

    Published 9 Jul 2024 · Fixed in 7.2.2 · NVD
  5. Medium 4.7

    CVE-2024-26015 · Fortinet FortiProxy, Fortinet FortiOS

    An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.15 and below IP address validation feature may permit an unauthenticated attacker to bypass the IP blocklist via crafted requests.

    Published 9 Jul 2024 · NVD
  6. Medium 6.8

    CVE-2024-2177 · GitLab

    A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload.

    Published 9 Jul 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  7. High 8.6

    CVE-2024-5974 · WatchGuard Fireware OS

    A buffer overflow in WatchGuard Fireware OS could may allow an authenticated remote attacker with privileged management access to execute arbitrary code with system privileges on the firewall. This issue affects Fireware OS: from 11.9.6 through 12.10.3.

    Published 9 Jul 2024 · Fixed in 12.5.12, 12.10.4 · NVD
  8. Medium 4.3

    CVE-2024-28882 · OpenVPN

    OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session

    Published 8 Jul 2024 · Fixed in 2.6.11 · NVD
  9. Medium 5.3

    CVE-2024-39896 · Directus

    SSO User Enumeration

    Published 8 Jul 2024 · Fixed in 10.13.0 · NVD, Project advisories (GitHub)
  10. Medium 6.5

    CVE-2024-39895 · Directus

    GraphQL Field Duplication Denial of Service (DoS)

    Published 8 Jul 2024 · Fixed in 10.12.0 · NVD, Project advisories (GitHub)
  11. High 7.7

    CVE-2024-39701 · Directus

    Incorrect handling of `_in` filter

    Published 8 Jul 2024 · Fixed in 10.6.0 · NVD, Project advisories (GitHub)
  12. Medium 5.0

    CVE-2024-39699 · Directus

    Blind SSRF On File Import

    Published 8 Jul 2024 · Fixed in 10.9.3 · NVD, Project advisories (GitHub)
  13. Critical 9.8

    CVE-2024-27903 · OpenVPN

    OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.

    Published 8 Jul 2024 · Fixed in 2.5.10, 2.6.10 · NVD
  14. High 7.8

    CVE-2024-27459 · OpenVPN

    The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges.

    Published 8 Jul 2024 · Fixed in 2.5.10, 2.6.10 · NVD
  15. High 7.5

    CVE-2024-24974 · OpenVPN

    The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service.

    Published 8 Jul 2024 · Fixed in 2.5.10, 2.6.10 · NVD
  16. Low

    CVE-2024-37372 · Node.js

    Permission model improperly processes UNC paths

    Published 8 Jul 2024 · Fixed in 20.15.1, 22.4.1 · nodejs
  17. High

    CVE-2024-36138 · Node.js

    Bypass incomplete fix of CVE-2024-27980

    Published 8 Jul 2024 · Fixed in 18.20.4, 20.15.1, 22.4.1 · nodejs
  18. Low

    CVE-2024-36137 · Node.js

    fs.fchown/fchmod bypasses permission model

    Published 8 Jul 2024 · Fixed in 20.15.1, 22.4.1 · nodejs
  19. Medium

    CVE-2024-22020 · Node.js

    Bypass network import restriction via data URL

    Published 8 Jul 2024 · Fixed in 18.20.4, 20.15.1, 22.4.1 · nodejs
  20. Low

    CVE-2024-22018 · Node.js

    fs.lstat bypasses permission model

    Published 8 Jul 2024 · Fixed in 20.15.1, 22.4.1 · nodejs
  21. Medium 4.8

    CVE-2024-40605 · MediaWiki

    An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.

    Published 7 Jul 2024 · NVD
  22. Medium 4.8

    CVE-2024-40604 · MediaWiki

    An issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sidebar menu and submenu entries.

    Published 7 Jul 2024 · NVD
  23. Medium 4.3

    CVE-2024-40603 · MediaWiki

    An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request.

    Published 7 Jul 2024 · NVD
  24. Medium 4.8

    CVE-2024-40602 · MediaWiki

    An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.

    Published 7 Jul 2024 · NVD
  25. Medium 6.5

    CVE-2024-40601 · MediaWiki

    An issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1. CSRF can occur in API modules.

    Published 7 Jul 2024 · NVD
  26. Medium 4.8

    CVE-2024-40600 · MediaWiki

    An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.

    Published 7 Jul 2024 · NVD
  27. Medium 4.8

    CVE-2024-40599 · MediaWiki

    An issue was discovered in the GuMaxDD skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.

    Published 7 Jul 2024 · NVD
  28. Medium 4.3

    CVE-2024-40598 · MediaWiki

    An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can expose suppressed information for log events. (The log_deleted attribute is not applied to entries.)

    Published 7 Jul 2024 · NVD
  29. High 7.5

    CVE-2024-40597 · MediaWiki

    An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. It can expose suppressed information for log events. (The log_deleted attribute is not respected.)

    Published 7 Jul 2024 · NVD
  30. Medium 4.3

    CVE-2024-40596 · MediaWiki

    An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed information for log events. (TimelineService does not support properly suppressing.)

    Published 7 Jul 2024 · NVD
  31. High 7.7

    CVE-2024-39933 · Gogs

    Argument Injection when tagging new releases

    Published 4 Jul 2024 · Fixed in 0.13.1 · NVD, Project advisories (GitHub)
  32. Critical 9.9

    CVE-2024-39932 · Gogs

    Argument Injection during changes preview

    Published 4 Jul 2024 · Fixed in 0.13.1 · NVD, Project advisories (GitHub)
  33. Critical 9.9

    CVE-2024-39931 · Gogs

    Deletion of internal files

    Published 4 Jul 2024 · Fixed in 0.13.1 · NVD, Project advisories (GitHub)
  34. Critical 9.9

    CVE-2024-39930 · Gogs

    Argument Injection in the built-in SSH server

    Published 4 Jul 2024 · Fixed in 0.13.1 · NVD, Project advisories (GitHub)
  35. High 8.2

    CVE-2024-37903 · Mastodon

    Improper authorship check on audience extension for existing posts

    Published 4 Jul 2024 · Fixed in 4.1.18, 4.2.10 · NVD, Project advisories (GitHub)
  36. Medium 5.4

    CVE-2024-39929 · Exim

    Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.

    Published 4 Jul 2024 · NVD
  37. High 7.5

    CVE-2024-39321 · Traefik

    Bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes

    Published 4 Jul 2024 · Fixed in 2.11.6, 3.0.4, 3.1.0-rc3 · NVD, Project advisories (GitHub)
  38. Medium 6.2

    CVE-2024-39884 · Apache HTTP Server

    A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers.   "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61,…

    Published 4 Jul 2024 · NVD
  39. Medium 5.3

    CVE-2024-37157 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, a malicious actor could get the FastImage library to redirect requests to an internal Discourse IP. This issue is patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches. No…

    Published 3 Jul 2024 · Fixed in 3.2.3, 3.3.0 · NVD
  40. Medium 4.3

    CVE-2024-36122 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, moderators using the review queue to review users may see a users email address even when the Allow moderators to view email addresses setting is disabled. This issue is patched in version 3.2.3 on the `stable` branch and version…

    Published 3 Jul 2024 · Fixed in 3.2.3, 3.3.0 · NVD
  41. High 7.5

    CVE-2024-34750 · Apache Tomcat

    Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been…

    Published 3 Jul 2024 · Fixed in 9.0.90, 10.1.25 · NVD
  42. Medium 6.5

    CVE-2024-36113 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch, and version 3.3.0.beta4-dev on the `tests-passed` branch, a rogue staff user could suspend other staff users preventing them from logging in to the site. The issue is patched in version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch,…

    Published 3 Jul 2024 · Fixed in 3.2.3, 3.3.0 · NVD
  43. Medium 6.1

    CVE-2024-35234 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version…

    Published 3 Jul 2024 · Fixed in 3.2.3, 3.3.0 · NVD
  44. High 8.8

    CVE-2024-33871 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded.

    Published 3 Jul 2024 · Fixed in 10.03.1 · NVD
  45. Medium 6.3

    CVE-2024-33870 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript document) to arbitrary files if the current directory is in the permitted paths. For example, there can be a transformation of ../../foo to ./../../foo and this will grant access if ./ is permitted.

    Published 3 Jul 2024 · Fixed in 10.03.1 · NVD
  46. Medium 5.3

    CVE-2024-33869 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename.

    Published 3 Jul 2024 · Fixed in 10.03.1 · NVD
  47. High 7.5

    CVE-2024-29511 · Ghostscript

    Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary files) via OCRLanguage. For example, exploitation can use debug_file /tmp/out and user_patterns_file /etc/passwd.

    Published 3 Jul 2024 · Fixed in 10.03.1 · NVD
  48. Medium 6.3

    CVE-2024-29510 · Ghostscript

    Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.

    Published 3 Jul 2024 · Fixed in 10.03.1 · NVD
  49. Medium 5.4

    CVE-2024-29507 · Ghostscript

    Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.

    Published 3 Jul 2024 · Fixed in 10.03.0 · NVD
  50. High 7.5

    CVE-2024-35227 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, Oneboxing against a carefully crafted malicious URL can reduce the availability of a Discourse instance. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. There are no known…

    Published 3 Jul 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.