UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,098
Published in 7 days
644
Critical in 30 days
388
Actively exploited
420

Latest vulnerabilities

38,098 vulnerabilities
  1. Medium 4.8

    CVE-2024-37447 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Cross-site Scripting

    Published 28 Jun 2024 · Fixed in 9.6.2 · WPVulnerability
  2. Medium 5.4

    CVE-2024-37437 · Elementor

    Elementor Website Builder – more than just a page builder: Path Traversal

    Published 28 Jun 2024 · Fixed in 3.22.2 · NVD, WPVulnerability
  3. Medium 6.1

    CVE-2024-35656 · Elementor Pro (WordPress plugin)

    Elementor Pro: Cross-site Scripting

    Published 28 Jun 2024 · Fixed in 3.21.3 · WPVulnerability
  4. Critical 9.8

    CVE-2024-5751 · LiteLLM

    BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the `add_deployment` function, which decodes and decrypts environment variables from base64 and assigns them to `os.environ`. An attacker can exploit this by sending a malicious payload to the `/config/update` endpoint, which is then processed and executed by…

    Published 27 Jun 2024 · NVD
  5. Medium 6.5

    CVE-2024-5710 · LiteLLM

    berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. The vulnerability stems from insufficient access control checks in…

    Published 27 Jun 2024 · NVD
  6. Medium 4.8

    CVE-2024-35153 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 292640.

    Published 27 Jun 2024 · Fixed in 8.5.5.26, 9.0.5.21 · NVD
  7. High 7.5

    CVE-2024-6323 · GitLab

    Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17.1.1 allows an attacker leak content of a private repository in a public project.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  8. High 8.8

    CVE-2024-5655 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to trigger a pipeline as another user under certain circumstances.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  9. Medium 4.9

    CVE-2024-5430 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.10 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows a project maintainer can delete the merge request approval policy via graphQL.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  10. Medium 5.4

    CVE-2024-4901 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, where a stored XSS vulnerability could be imported from a project with malicious commit notes.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  11. Medium 6.5

    CVE-2024-4557 · GitLab

    Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1 which allowed an attacker to cause resource exhaustion via banzai pipeline.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  12. Medium 4.3

    CVE-2024-4011 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows non-project member to promote key results to objectives.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  13. Medium 6.5

    CVE-2024-3959 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows private job artifacts can be accessed by any user.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  14. Medium 4.3

    CVE-2024-3115 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to access issues and epics without having an SSO session using Duo Chat.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  15. Medium 5.3

    CVE-2024-2191 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  16. Medium 5.5

    CVE-2024-1816 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 12.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows for an attacker to cause a denial of service using a crafted OpenAPI file.

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  17. Medium 6.5

    CVE-2024-1493 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the server

    Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD
  18. Low 3.5

    CVE-2024-35777 · WooCommerce

    WooCommerce: Injection

    Published 27 Jun 2024 · Fixed in 9.0.0 · WPVulnerability
  19. Critical 9.8

    CVE-2024-38371 · authentik

    Insufficient access control for OAuth2 Device Code flow

    Published 26 Jun 2024 · Fixed in 2024.2.4, 2024.4.3, 2024.6.0 · NVD, Project advisories (GitHub)
  20. High 8.8

    CVE-2024-37905 · authentik

    Improper Authorization for Token modification

    Published 26 Jun 2024 · Fixed in 2024.4.2, 2024.4.3, 2024.6.0 · NVD, Project advisories (GitHub)
  21. Medium 4.3

    CVE-2024-37251 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Cross-Site Request Forgery (CSRF)

    Published 26 Jun 2024 · Fixed in 6.3.2 · WPVulnerability
  22. Medium 5.4

    CVE-2024-37250 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Missing Authorization

    Published 26 Jun 2024 · Fixed in 6.3.2 · WPVulnerability
  23. Medium 4.3

    CVE-2024-37249 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Missing Authorization

    Published 26 Jun 2024 · Fixed in 6.3.2 · WPVulnerability
  24. Medium 5.4

    CVE-2024-25637 · October CMS

    Reflected XSS via X-October-Request-Handler Header

    Published 25 Jun 2024 · Fixed in 3.5.15 · NVD, Project advisories (GitHub)
  25. Medium 4.8

    CVE-2024-24764 · October CMS

    Open Redirect for Administrator Accounts

    Published 25 Jun 2024 · Fixed in 3.5.15 · NVD, Project advisories (GitHub)
  26. Critical 9.8

    CVE-2024-37843 · Craft CMS

    Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

    Published 25 Jun 2024 · Fixed in 3.7.31 · NVD
  27. Medium 5.3

    CVE-2024-6238 · pgAdmin

    pgAdmin <= 8.8 has an installation Directory permission issue. Because of this issue, attackers can gain unauthorised access to the installation directory on the Debian or RHEL 8 platforms.

    Published 25 Jun 2024 · Fixed in 8.9 · NVD
  28. Critical 9.8

    CVE-2024-5806 · MOVEit Transfer

    Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.

    Published 25 Jun 2024 · Fixed in 2023.0.11, 2023.1.6 · NVD
  29. Medium 5.3

    CVE-2024-37087 · VMware vCenter Server

    The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition.

    Published 25 Jun 2024 · NVD
  30. Medium 6.8

    CVE-2024-37086 · VMware ESXi

    VMware ESXi contains an out-of-bounds read vulnerability. A malicious actor with local administrative privileges on a virtual machine with an existing snapshot may trigger an out-of-bounds read leading to a denial-of-service condition of the host.

    Published 25 Jun 2024 · NVD
  31. High 7.2Actively exploited

    CVE-2024-37085 · VMware ESXi

    VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was…

    Published 25 Jun 2024 · NVD
  32. Medium 5.4

    CVE-2024-34142 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 25 Jun 2024 · Fixed in 6.5.21.0, 2024.5.0 · NVD
  33. Medium 5.4

    CVE-2024-34141 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 25 Jun 2024 · Fixed in 6.5.21.0, 2024.5.0 · NVD
  34. Medium 6.3

    CVE-2024-37894 · Squid

    SQUID-2024:3 Denial of Service in ESI processing

    Published 25 Jun 2024 · Fixed in 6.10 · NVD, Project advisories (GitHub)
  35. Unrated

    WPV-11f7e3fe76dc · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Vulnerability in Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing

    Published 25 Jun 2024 · Fixed in 1.43.4 · WPVulnerability
  36. High 7.2

    CVE-2024-21519 · OpenCart

    This affects versions of the package opencart/opencart from 4.0.0.0. An Arbitrary File Creation issue was identified via the database restoration functionality. By injecting PHP code into the database, an attacker with admin privileges can create a backup file with an arbitrary filename (including the extension), within /system/storage/backup. **Note:** It is less likely for the created file to…

    Published 22 Jun 2024 · NVD
  37. High 7.2

    CVE-2024-21518 · OpenCart

    This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An attacker can create arbitrary files in the web root of the application and overwrite other existing files…

    Published 22 Jun 2024 · NVD
  38. Low 1.2

    CVE-2024-21517 · OpenCart

    This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the redirect parameter of customer account/login route. An attacker can inject arbitrary HTML and Javascript into the page response. As this vulnerability is present in the account functionality it could be used to target and attack customers of the OpenCart shop. **Notes:** 1) The fix…

    Published 22 Jun 2024 · NVD
  39. Low 1.2

    CVE-2024-21516 · OpenCart

    This affects versions of the package opencart/opencart from 4.0.0.0 and before 4.1.0.0. A reflected XSS issue was identified in the directory parameter of admin common/filemanager.list route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login and redirected again upon authentication with the payload automatically…

    Published 22 Jun 2024 · NVD
  40. Low 1.2

    CVE-2024-21515 · OpenCart

    This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login and redirected again upon authentication with the payload automatically executing. If the attacked…

    Published 22 Jun 2024 · NVD
  41. High 8.1

    CVE-2024-21514 · OpenCart

    This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9. As an anonymous unauthenticated user, if the Divido payment module is installed (it does not have to be enabled), it is possible to exploit SQL injection to gain unauthorised access to the backend…

    Published 22 Jun 2024 · NVD
  42. Low 2.7

    CVE-2024-5967 · Keycloak

    Leak of configured LDAP bind credentials through the Keycloak admin console

    Published 21 Jun 2024 · Fixed in 22.0.12 · Project advisories (GitHub)
  43. Medium 4.3

    CVE-2024-37236 · Loco Translate (WordPress plugin)

    Loco Translate: Cross-Site Request Forgery (CSRF)

    Published 21 Jun 2024 · Fixed in 2.6.10 · WPVulnerability
  44. High 8.6

    CVE-2024-37818 · Strapi

    Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request. NOTE: The Strapi Development Community argues that this issue is not valid. They contend that "the strapi/admin was wrongly attributed a flaw that only pertains…

    Published 20 Jun 2024 · NVD
  45. Medium 5.5

    CVE-2024-37674 · Moodle

    Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.

    Published 20 Jun 2024 · NVD
  46. High 8.8

    CVE-2024-37532 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. IBM X-Force ID: 294721.

    Published 20 Jun 2024 · NVD
  47. Medium

    CVE-2024-35255 · Traefik

    ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability

    Published 20 Jun 2024 · Fixed in 2.11.5, 3.0.3 · Project advisories (GitHub)
  48. Medium 5.3

    CVE-2024-34693 · Apache Superset

    Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the…

    Published 20 Jun 2024 · Fixed in 3.1.3, 4.0.1 · NVD
  49. Medium 6.5

    CVE-2024-29013 · SonicWall SonicOS

    Heap-based buffer overflow vulnerability in the SonicOS SSL-VPN allows an authenticated remote attacker to cause Denial of Service (DoS) via memcpy function.

    Published 20 Jun 2024 · Fixed in 7.0.1-5161, 7.1.1-7058, 7.1.2-7019 · NVD
  50. High 7.5

    CVE-2024-29012 · SonicWall SonicOS

    Stack-based buffer overflow vulnerability in the SonicOS HTTP server allows an authenticated remote attacker to cause Denial of Service (DoS) via sscanf function.

    Published 20 Jun 2024 · Fixed in 7.0.1-5161, 7.1.1-7058, 7.1.2-7019 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.