UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,107
Published in 7 days
652
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,107 vulnerabilities
  1. High 7.5

    CVE-2024-5798 · HashiCorp Vault

    Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0,…

    Published 12 Jun 2024 · Fixed in 1.15.9, 1.16.3 · NVD
  2. High 8.1

    CVE-2024-34065 · Strapi

    Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction (one click). Unauthenticated…

    Published 12 Jun 2024 · Fixed in 4.24.2 · NVD
  3. Medium 6.5

    CVE-2024-31217 · Strapi

    Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause it to log the error and keep it running for other clients. This behavior, in contrast, stops the…

    Published 12 Jun 2024 · Fixed in 4.22.0 · NVD
  4. Low 3.5

    CVE-2024-29181 · Strapi

    Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create. They should see nothing but their own items they created not all items ever created. Users should…

    Published 12 Jun 2024 · Fixed in 4.19.1 · NVD
  5. Medium 6.5

    CVE-2024-23445 · Elasticsearch

    It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#security-api-create-cross-cluster-api-key-request-body  restricts search for a given index using the query or the field_security parameter, and the same cross-cluster API key also grants replication for the same index, the search…

    Published 12 Jun 2024 · Fixed in 8.14.0 · NVD
  6. Low

    CVE-2021-3754 · Keycloak

    Improper input validation on Keycloak allows using email as username

    Published 12 Jun 2024 · Fixed in 24.0.1 · Project advisories (GitHub)
  7. Low

    CVE-2024-1722 · Keycloak

    DoS via account lockout

    Published 12 Jun 2024 · Fixed in 24.0.0 · Project advisories (GitHub)
  8. Medium

    CVE-2024-3656 · Keycloak

    Unguarded admin REST API endpoints allows low privilege users to use administrative functionalities

    Published 11 Jun 2024 · Fixed in 24.0.5 · Project advisories (GitHub)
  9. High 7.5

    CVE-2024-26010 · Fortinet FortiProxy, Fortinet FortiOS

    A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.14, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9, FortiProxy 7.0.0 through…

    Published 11 Jun 2024 · Fixed in 7.2.8, 7.2.10, 7.4.4 · NVD
  10. Medium 4.8

    CVE-2024-23111 · Fortinet FortiProxy, Fortinet FortiOS

    An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions reboot page may allow a remote privileged attacker with super-admin access to execute JavaScript code via crafted HTTP GET requests.

    Published 11 Jun 2024 · Fixed in 7.2.9, 7.4.3, 7.4.4 · NVD
  11. High 7.8

    CVE-2024-23110 · Fortinet FortiOS

    A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0 all versions allows attacker to execute unauthorized code or commands via specially crafted commands

    Published 11 Jun 2024 · Fixed in 7.0.14, 7.2.7, 7.4.3 · NVD
  12. Medium 4.4

    CVE-2024-21754 · Fortinet FortiProxy, Fortinet FortiOS

    A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged attacker with super-admin profile and CLI access to decrypting the backup file.

    Published 11 Jun 2024 · Fixed in 7.2.9, 7.4.3, 7.4.4 · NVD
  13. High 7.8

    CVE-2023-46720 · Fortinet FortiOS

    A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16 and 6.0.13 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted CLI commands.

    Published 11 Jun 2024 · Fixed in 7.2.8, 7.4.3 · NVD
  14. Medium 5.3

    CVE-2023-28775 · Yoast SEO

    Missing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4.

    Published 11 Jun 2024 · Fixed in 20.5 · NVD
  15. Medium

    CVE-2024-24790 · Traefik

    Unexpected behavior with IPv4-mapped IPv6 addresses

    Published 11 Jun 2024 · Fixed in 2.11.4, 3.0.2 · Project advisories (GitHub)
  16. Unrated

    WPV-a4fb4d839020 · WooCommerce

    Vulnerability in WooCommerce

    Published 11 Jun 2024 · Fixed in 8.9.3 · WPVulnerability
  17. Medium 5.4

    CVE-2024-4627 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 11 Jun 2024 · Fixed in 1.0.219 · WPVulnerability
  18. Critical 9.8

    CVE-2024-37014 · Langflow

    Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.

    Published 10 Jun 2024 · NVD
  19. High

    CVE-2024-4540 · Keycloak

    Exposure of sensitive information in Pushed Authorization Requests (PAR)

    Published 10 Jun 2024 · Fixed in 24.0.5 · Project advisories (GitHub)
  20. Medium 5.4

    CVE-2024-5530 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 10 Jun 2024 · Fixed in 2.9.1 · WPVulnerability
  21. Medium 5.4

    CVE-2024-37297 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 10 Jun 2024 · Fixed in 8.8.5, 8.9.3 · NVD, WPVulnerability
  22. Critical 9.8Actively exploited

    CVE-2024-4577 · PHP

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP…

    Published 9 Jun 2024 · Fixed in 8.1.29, 8.2.20, 8.3.8 · NVD
  23. Medium 5.9

    CVE-2024-2408 · PHP

    The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to…

    Published 9 Jun 2024 · Fixed in 8.1.29, 8.2.20, 8.3.8 · NVD
  24. High 8.8

    CVE-2024-5585 · PHP

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary…

    Published 9 Jun 2024 · Fixed in 8.1.29, 8.2.20, 8.3.8 · NVD
  25. Medium 5.3

    CVE-2024-5458 · PHP

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid…

    Published 9 Jun 2024 · Fixed in 8.1.29, 8.2.20, 8.3.8 · NVD
  26. Critical 9.8

    CVE-2024-37385 · Roundcube

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.

    Published 7 Jun 2024 · Fixed in 1.5.7, 1.6.7 · NVD
  27. Medium 6.1

    CVE-2024-37384 · Roundcube

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.

    Published 7 Jun 2024 · Fixed in 1.5.7, 1.6.7 · NVD
  28. Medium 6.1Actively exploited

    CVE-2024-37383 · Roundcube

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

    Published 7 Jun 2024 · Fixed in 1.5.7, 1.6.7 · NVD
  29. High 7.2

    CVE-2024-5225 · LiteLLM

    An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidated `api_key` parameter directly into the query, making it susceptible to SQL Injection if the…

    Published 6 Jun 2024 · NVD
  30. Medium 4.9

    CVE-2024-4890 · LiteLLM

    A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'user_id' parameter, leading to potential…

    Published 6 Jun 2024 · NVD
  31. High 8.1

    CVE-2024-4888 · LiteLLM

    BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes the specified file without proper authorization or validation. This vulnerability is present in the…

    Published 6 Jun 2024 · Fixed in 1.35.19 · NVD
  32. High 7.5

    CVE-2024-2928 · MLflow

    A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local…

    Published 6 Jun 2024 · Fixed in 2.11.3 · NVD
  33. High 8.8

    CVE-2024-0520 · MLflow

    A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.http_dataset_source.py` module. Specifically, when loading a dataset from a source URL with an HTTP scheme, the filename extracted from the `Content-Disposition` header or the URL path is used to…

    Published 6 Jun 2024 · Fixed in 2.9.0 · NVD
  34. High 7.2

    CVE-2024-4889 · LiteLLM

    A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated input in the eval function within the secret management system. This vulnerability requires a valid Google KMS configuration file to be exploitable. Specifically, by setting the `UI_LOGO_PATH` variable to a remote server address in the `get_image` function, an attacker can…

    Published 6 Jun 2024 · Fixed in 1.44.16 · NVD
  35. Medium 6.5

    CVE-2024-37150 · Deno

    Private npm registry support used scope auth token for downloading tarballs

    Published 6 Jun 2024 · NVD, Project advisories (GitHub)
  36. High 7.5

    CVE-2024-37152 · Argo CD

    Unauthenticated Access to sensitive settings in Argo CD

    Published 6 Jun 2024 · Fixed in 2.9.17, 2.10.12, 2.11.3 · NVD, Project advisories (GitHub)
  37. Medium 4.3

    CVE-2024-36106 · Argo CD

    Authenticated users can enumerate clusters by name

    Published 6 Jun 2024 · Fixed in 2.9.17, 2.10.12, 2.11.3 · NVD, Project advisories (GitHub)
  38. High 7.5Actively exploited

    CVE-2024-28995 · SolarWinds Serv-U

    SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.

    Published 6 Jun 2024 · Fixed in 15.4.2 · NVD
  39. Medium 6.1

    CVE-2024-4704 · Contact Form 7

    Contact Form 7: Open Redirect

    Published 5 Jun 2024 · Fixed in 5.9.5 · NVD, WPVulnerability
  40. High 8.2

    CVE-2024-23326 · Envoy

    Envoy incorrectly accepts HTTP 200 response for entering upgrade mode

    Published 4 Jun 2024 · Fixed in 1.28.4, 1.29.5, 1.30.2 · NVD, Project advisories (GitHub)
  41. High 7.5

    CVE-2024-32976 · Envoy

    Endless loop while decompressing Brotli data with extra input

    Published 4 Jun 2024 · Fixed in 1.28.4, 1.29.5, 1.30.2 · NVD, Project advisories (GitHub)
  42. High 7.5

    CVE-2024-32975 · Envoy

    Crash in QuicheDataReader::PeekVarInt62Length()

    Published 4 Jun 2024 · Fixed in 1.28.4, 1.29.5, 1.30.2 · NVD, Project advisories (GitHub)
  43. High 7.5

    CVE-2024-32974 · Envoy

    Crash in EnvoyQuicServerStream::OnInitialHeadersComplete()

    Published 4 Jun 2024 · Fixed in 1.28.4, 1.29.5, 1.30.2 · NVD, Project advisories (GitHub)
  44. Medium 6.5

    CVE-2024-34364 · Envoy

    Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response, and other components

    Published 4 Jun 2024 · Fixed in 1.28.4, 1.29.5, 1.30.2 · NVD, Project advisories (GitHub)
  45. High 7.5

    CVE-2024-34363 · Envoy

    Crash due to uncaught nlohmann JSON exception

    Published 4 Jun 2024 · Fixed in 1.28.4, 1.29.5, 1.30.2 · NVD, Project advisories (GitHub)
  46. Medium 5.9

    CVE-2024-34362 · Envoy

    Crash (use-after-free) in EnvoyQuicServerStream

    Published 4 Jun 2024 · Fixed in 1.28.4, 1.29.5, 1.30.2 · NVD, Project advisories (GitHub)
  47. Low

    CVE-2024-28103 · Ruby on Rails

    Missing security headers in Action Pack on non-HTML responses

    Published 4 Jun 2024 · Fixed in 6.1.7.8 · Project advisories (GitHub)
  48. Medium

    CVE-2024-32464 · Ruby on Rails

    ActionText ContentAttachment can contain unsanitized HTML

    Published 4 Jun 2024 · Fixed in 7.1.3.4 · Project advisories (GitHub)
  49. High 7.5

    CVE-2024-32871 · Pimcore

    Flooding Server with Thumbnail files

    Published 4 Jun 2024 · Fixed in 11.2.4 · NVD, Project advisories (GitHub)
  50. High 8.8

    CVE-2024-37061 · MLflow

    Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run.

    Published 4 Jun 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.