UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,107
Published in 7 days
652
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,107 vulnerabilities
  1. High 8.8

    CVE-2024-37060 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run.

    Published 4 Jun 2024 · NVD
  2. High 8.8

    CVE-2024-37059 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  3. High 8.8

    CVE-2024-37058 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  4. High 8.8

    CVE-2024-37057 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  5. High 8.8

    CVE-2024-37056 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  6. High 8.8

    CVE-2024-37055 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  7. High 8.8

    CVE-2024-37054 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  8. High 8.8

    CVE-2024-37053 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  9. High 8.8

    CVE-2024-37052 · MLflow

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.

    Published 4 Jun 2024 · NVD
  10. Critical 9.1

    CVE-2024-36104 · Apache OFBiz

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.

    Published 4 Jun 2024 · Fixed in 18.12.14 · NVD
  11. High 7.5

    CVE-2024-36128 · Directus

    Soft-lock Directus by providing a string value to random string util

    Published 3 Jun 2024 · Fixed in 10.11.2 · NVD, Project advisories (GitHub)
  12. High 8.8

    CVE-2024-23665 · Fortinet FortiWeb

    Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and below, version 6.4.3 and below, version 6.3.23 and below may allow an authenticated attacker to perform unauthorized ADOM operations via crafted requests.

    Published 3 Jun 2024 · Fixed in 7.2.8, 7.4.3 · NVD
  13. Medium 5.5

    CVE-2024-23107 · Fortinet FortiWeb

    An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions may allow an authenticated attacker to read password hashes of other administrators via CLI commands.

    Published 3 Jun 2024 · Fixed in 7.0.9, 7.2.5 · NVD
  14. Medium 6.1

    CVE-2024-4900 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Open Redirect

    Published 3 Jun 2024 · Fixed in 7.8 · WPVulnerability
  15. Medium 5.0

    CVE-2024-4899 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 3 Jun 2024 · Fixed in 7.8 · WPVulnerability
  16. Medium 5.4

    CVE-2024-4637 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 3 Jun 2024 · Fixed in 6.7.11 · NVD, WPVulnerability
  17. Medium 5.4

    CVE-2024-4581 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 3 Jun 2024 · Fixed in 6.7.11 · NVD, WPVulnerability
  18. High 7.5

    CVE-2024-34009 · Moodle

    Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.

    Published 31 May 2024 · Fixed in 4.3.4 · NVD
  19. High 8.8

    CVE-2024-34008 · Moodle

    Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  20. High 8.8

    CVE-2024-34007 · Moodle

    The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.

    Published 31 May 2024 · Fixed in 4.3.4 · NVD
  21. Medium 4.3

    CVE-2024-34006 · Moodle

    The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  22. Medium 6.5

    CVE-2024-34005 · Moodle

    In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  23. Medium 6.5

    CVE-2024-34004 · Moodle

    In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  24. Medium 5.9

    CVE-2024-34003 · Moodle

    In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  25. Medium 6.5

    CVE-2024-34002 · Moodle

    In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  26. High 8.4

    CVE-2024-34001 · Moodle

    Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  27. Medium 4.3

    CVE-2024-34000 · Moodle

    ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  28. Critical 9.8

    CVE-2024-33999 · Moodle

    The referrer URL used by MFA required additional sanitizing, rather than being used directly.

    Published 31 May 2024 · Fixed in 4.3.4 · NVD
  29. Medium 5.4

    CVE-2024-33998 · Moodle

    Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  30. Medium 6.1

    CVE-2024-33997 · Moodle

    Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  31. Medium 6.2

    CVE-2024-33996 · Moodle

    Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.

    Published 31 May 2024 · Fixed in 4.1.10, 4.2.7, 4.3.4 · NVD
  32. Low

    CVE-2024-35196 · Sentry

    Slack integration leaks deprecated verification token in logs

    Published 31 May 2024 · Fixed in 24.5.0 · Project advisories (GitHub)
  33. High 8.8

    CVE-2024-37032 · Ollama

    Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.

    Published 31 May 2024 · Fixed in 0.1.34 · NVD
  34. Medium 6.1

    CVE-2024-22244 · Harbor

    Open Redirect URL in Harbor

    Published 31 May 2024 · Fixed in 2.8.5, 2.9.3 · NVD, Project advisories (GitHub)
  35. Medium 5.5

    CVE-2024-22261 · Harbor

    SQL Injection in Harbor scan log API

    Published 31 May 2024 · Fixed in 2.8.6, 2.9.4, 2.10.2 · NVD, Project advisories (GitHub)
  36. High 7.5

    CVE-2023-49952 · Mastodon

    Bypassing rate limiting with X-Forwarded-For header

    Published 30 May 2024 · Fixed in 4.1.17, 4.2.9 · NVD, Project advisories (GitHub)
  37. Medium 5.9

    GHSA-q3rg-xx5v-4mxh · Mastodon

    Missing rate-limit to password change endpoint

    Published 30 May 2024 · Fixed in 4.1.17 · Project advisories (GitHub)
  38. Medium 5.5

    CVE-2024-35228 · Wagtail

    Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`

    Published 30 May 2024 · Fixed in 6.1.2 · Project advisories (GitHub)
  39. Medium 6.5

    CVE-2024-4565 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Improper Access Control

    Published 30 May 2024 · Fixed in 6.3, 6.3.0 · NVD, WPVulnerability
  40. Medium 5.9

    CVE-2024-34385 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Cross-site Scripting

    Published 30 May 2024 · Fixed in 3.33.0 · WPVulnerability
  41. Medium 5.3

    CVE-2024-35200 · nginx

    When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.

    Published 29 May 2024 · Fixed in 1.26.1 · NVD
  42. Medium 5.3

    CVE-2024-34161 · nginx

    When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.

    Published 29 May 2024 · Fixed in 1.26.1 · NVD
  43. Medium 6.5

    CVE-2024-32760 · nginx

    When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.

    Published 29 May 2024 · Fixed in 1.26.1 · NVD
  44. Medium 4.8

    CVE-2024-31079 · nginx

    When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.

    Published 29 May 2024 · Fixed in 1.26.1 · NVD
  45. Critical 9.8

    CVE-2024-36470 · TeamCity

    In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases

    Published 29 May 2024 · Fixed in 2022.10.6, 2023.05.6, 2023.11.5 · NVD
  46. High 7.5

    CVE-2024-36378 · TeamCity

    In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens

    Published 29 May 2024 · Fixed in 2024.03.2 · NVD
  47. High 8.1

    CVE-2024-36377 · TeamCity

    In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions

    Published 29 May 2024 · Fixed in 2024.03.2 · NVD
  48. High 8.1

    CVE-2024-36376 · TeamCity

    In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions

    Published 29 May 2024 · Fixed in 2024.03.2 · NVD
  49. Medium 5.3

    CVE-2024-36375 · TeamCity

    In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed

    Published 29 May 2024 · Fixed in 2024.03.2 · NVD
  50. Medium 5.4

    CVE-2024-36374 · TeamCity

    In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible

    Published 29 May 2024 · Fixed in 2024.03.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.