UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,098
Published in 7 days
644
Critical in 30 days
388
Actively exploited
420

Latest vulnerabilities

38,098 vulnerabilities
  1. High 8.8

    CVE-2024-29509 · Ghostscript

    Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a \000 byte in the middle.

    Published 3 Jul 2024 · Fixed in 10.03.0 · NVD
  2. Low 3.3

    CVE-2024-29508 · Ghostscript

    Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc.

    Published 3 Jul 2024 · Fixed in 10.03.0 · NVD
  3. High 8.8

    CVE-2024-29506 · Ghostscript

    Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfi_apply_filter() function via a long PDF filter name.

    Published 3 Jul 2024 · Fixed in 10.03.0 · NVD
  4. Medium 6.5

    CVE-2024-39683 · ZITADEL

    Session Information Leakage

    Published 3 Jul 2024 · Fixed in 2.53.8, 2.54.5 · NVD, Project advisories (GitHub)
  5. Medium 6.5

    CVE-2024-6428 · Mattermost

    Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2, 9.5.x <= 9.5.5 fail to prevent specifying a RemoteId when creating a new user which allows an attacker to specify both a remoteId and the user ID, resulting in creating a user with a user-defined user ID. This can cause some broken functionality in User Management such administrative actions against the user not working.

    Published 3 Jul 2024 · Fixed in 9.6.3, 9.7.5, 9.8.1 · NVD
  6. Medium 5.9

    CVE-2024-39830 · Mattermost

    Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled, fail to use constant time comparison for remote cluster tokens which allows an attacker to retrieve the remote cluster token via a timing attack during remote cluster token comparison.

    Published 3 Jul 2024 · Fixed in 9.6.3, 9.7.5, 9.8.1 · NVD
  7. Medium 5.3

    CVE-2024-39807 · Mattermost

    Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring webhook events to retrieve the channel IDs of archived or restored channels.

    Published 3 Jul 2024 · Fixed in 9.5.6, 9.8.1 · NVD
  8. Medium 5.4

    CVE-2024-39361 · Mattermost

    Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5 fail to prevent users from specifying a RemoteId for their posts which allows an attacker to specify both a remoteId and the post ID, resulting in creating a post with a user-defined post ID. This can cause some broken functionality in the channel or thread with user-defined posts

    Published 3 Jul 2024 · Fixed in 9.6.3, 9.7.4, 9.8.1 · NVD
  9. Low 2.7

    CVE-2024-39353 · Mattermost

    Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to sanitize the RemoteClusterFrame payloads before audit logging them which allows a high privileged attacker with access to the audit logs to read message contents.

    Published 3 Jul 2024 · Fixed in 9.5.6 · NVD
  10. Medium 5.3

    CVE-2024-36257 · Mattermost

    Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A requesting the server B to update the profile picture of a user is the remote that actually has the user as a local one . This allows a malicious remote A to change the profile images of users that belong to another remote server C that is…

    Published 3 Jul 2024 · Fixed in 9.5.6 · NVD
  11. Unrated

    WPV-f1f8e8d7ebc0 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Vulnerability in Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing

    Published 3 Jul 2024 · Fixed in 1.43.4 · WPVulnerability
  12. High 7.8

    CVE-2024-32230 · FFmpeg

    FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0

    Published 1 Jul 2024 · NVD
  13. High 8.4

    CVE-2024-32229 · FFmpeg

    FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column.

    Published 1 Jul 2024 · NVD
  14. Medium 6.6

    CVE-2024-32228 · FFmpeg

    FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end.

    Published 1 Jul 2024 · NVD
  15. High 7.5

    CVE-2024-39573 · Apache HTTP Server

    Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

    Published 1 Jul 2024 · Fixed in 2.4.60 · NVD
  16. High 7.5

    CVE-2024-38477 · Apache HTTP Server

    null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

    Published 1 Jul 2024 · Fixed in 2.4.60 · NVD
  17. Critical 9.8

    CVE-2024-38476 · Apache HTTP Server

    Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

    Published 1 Jul 2024 · Fixed in 2.4.60 · NVD
  18. Critical 9.1Actively exploited

    CVE-2024-38475 · Apache HTTP Server

    Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the…

    Published 1 Jul 2024 · Fixed in 2.4.60 · NVD
  19. Critical 9.8

    CVE-2024-38474 · Apache HTTP Server

    Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute…

    Published 1 Jul 2024 · Fixed in 2.4.60 · NVD
  20. High 8.1

    CVE-2024-38473 · Apache HTTP Server

    Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

    Published 1 Jul 2024 · Fixed in 2.4.60 · NVD
  21. High 7.5

    CVE-2024-38472 · Apache HTTP Server

    SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.

    Published 1 Jul 2024 · Fixed in 2.4.60 · NVD
  22. Medium 6.1

    CVE-2024-37146 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/credentials/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the attacker…

    Published 1 Jul 2024 · NVD
  23. Medium 6.1

    CVE-2024-37145 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/chatflows-streaming/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the…

    Published 1 Jul 2024 · NVD
  24. Medium 6.1

    CVE-2024-36423 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/public-chatflows/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the…

    Published 1 Jul 2024 · NVD
  25. Medium 5.4

    CVE-2024-36387 · Apache HTTP Server

    Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

    Published 1 Jul 2024 · NVD
  26. Medium 5.3

    CVE-2024-39879 · TeamCity

    In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings

    Published 1 Jul 2024 · Fixed in 2024.03.3 · NVD
  27. Medium 5.3

    CVE-2024-39878 · TeamCity

    In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection

    Published 1 Jul 2024 · Fixed in 2024.03.3 · NVD
  28. High 8.1

    CVE-2024-36997 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in the browser context of another Splunk user through the conf-web/settings REST endpoint. This could potentially cause a persistent cross-site scripting (XSS) exploit.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  29. Medium 5.3

    CVE-2024-36996 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive from the instance when they attempt to log in. This disclosure could then lead to additional brute-force password-guessing attacks. This…

    Published 1 Jul 2024 · Fixed in 9.1.5, 9.2.2 · NVD
  30. Low 3.5

    CVE-2024-36995 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could create experimental items.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  31. Medium 5.4

    CVE-2024-36994 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View and Splunk Web Bulletin Messages that could result in execution of unauthorized JavaScript code in the browser of a user.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  32. Medium 5.4

    CVE-2024-36993 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a Splunk Web Bulletin Messages that could result in execution of unauthorized JavaScript code in the browser of a user.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  33. Medium 5.4

    CVE-2024-36992 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that could result in execution of unauthorized JavaScript code in the browser of a user. The “url” parameter of the Dashboard element does not…

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  34. High 7.5

    CVE-2024-36991 · Splunk Enterprise

    In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  35. Medium 6.5

    CVE-2024-36990 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an authenticated, low-privileged user that does not hold the admin or power Splunk roles could send a specially crafted HTTP POST request to the datamodel/web REST endpoint in Splunk Enterprise, potentially causing a denial of service.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  36. Medium 4.3

    CVE-2024-36989 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold the admin or power Splunk roles could create notifications in Splunk Web Bulletin Messages that all users on the instance receive.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  37. Medium 6.5

    CVE-2024-36987 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who does not hold the admin or power Splunk roles could upload a file with an arbitrary extension using the indexing/preview REST endpoint.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  38. Medium 5.7

    CVE-2024-36986 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safeguards for risky commands in the Analytics Workspace. The vulnerability requires the authenticated user to phish the victim by tricking them into…

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  39. High 8.8

    CVE-2024-36985 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  40. High 8.8

    CVE-2024-36984 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  41. High 8.8

    CVE-2024-36983 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user could create an external lookup that calls a legacy internal function. The authenticated user could use this internal function to insert code into the Splunk platform installation directory. From there, the user could execute arbitrary code on…

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  42. High 7.5

    CVE-2024-36982 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash of the Splunk daemon.

    Published 1 Jul 2024 · Fixed in 9.0.10, 9.1.5, 9.2.2 · NVD
  43. Medium 6.1

    CVE-2024-36422 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `api/v1/chatflows/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the attacker to…

    Published 1 Jul 2024 · NVD
  44. High 7.5

    CVE-2024-36421 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration (unauthenticated), arbitrary origins may be able to make requests to Flowise, stealing information from the user. This…

    Published 1 Jul 2024 · NVD
  45. High 7.5

    CVE-2024-36420 · Flowise

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endpoint in `index.ts` is vulnerable to arbitrary file read due to lack of sanitization of the `fileName` body parameter. No known patches for this issue are available.

    Published 1 Jul 2024 · NVD
  46. Medium 6.5

    CVE-2024-6375 · MongoDB

    A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server v5.0 versions, prior to 5.0.22, MongoDB Server v6.0 versions, prior to 6.0.11 and MongoDB Server v7.0 versions prior to…

    Published 1 Jul 2024 · Fixed in 5.0.22, 6.0.11, 7.0.3 · NVD
  47. High 8.1

    CVE-2024-6387 · OpenSSH

    A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

    Published 1 Jul 2024 · Fixed in 4.4 · NVD
  48. Critical 9.1

    CVE-2024-39305 · Envoy

    Use after free when route hash policy is configured with cookie attributes

    Published 28 Jun 2024 · NVD, Project advisories (GitHub)
  49. High 7.5

    CVE-2024-5598 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Insecure Storage of Sensitive Information

    Published 28 Jun 2024 · Fixed in 5.2.5 · WPVulnerability
  50. Medium 4.8

    CVE-2024-37449 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 28 Jun 2024 · Fixed in 6.7.14 · NVD, WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.