UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,107
Published in 7 days
651
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,107 vulnerabilities
  1. Medium 6.5

    CVE-2024-4539 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 where abusing the API to filter branch and tags could lead to Denial of Service.

    Published 14 May 2024 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  2. Medium 4.3

    CVE-2024-4317 · PostgreSQL

    Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes…

    Published 14 May 2024 · Fixed in 14.12, 15.7, 16.3 · NVD
  3. Medium 6.1

    CVE-2024-34716 · PrestaShop

    XSS via customer contact form in FO, through file upload

    Published 14 May 2024 · Fixed in 8.1.6 · NVD, Project advisories (GitHub)
  4. Medium 5.3

    CVE-2024-34717 · PrestaShop

    Anonymous customer can download other customers's invoices

    Published 14 May 2024 · NVD, Project advisories (GitHub)
  5. Medium 5.4

    CVE-2024-34899 · AVideo

    WWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS).

    Published 14 May 2024 · NVD
  6. High 7.5

    CVE-2024-34459 · libxml2

    An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.

    Published 14 May 2024 · Fixed in 2.11.8, 2.12.7 · NVD
  7. Medium 6.5

    CVE-2024-2651 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. It was possible for an attacker to cause a denial of service using maliciously crafted markdown content.

    Published 14 May 2024 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  8. Medium 6.5

    CVE-2024-2454 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. The pins endpoint is susceptible to DoS through a crafted request.

    Published 14 May 2024 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  9. Medium 6.1

    CVE-2024-22910 · CrushFTP

    Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code via a crafted payload.

    Published 14 May 2024 · Fixed in 10.6.1 · NVD
  10. Medium 6.5

    CVE-2023-6688 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.11 prior to 16.11.2. A problem with the processing logic for Google Chat Messages integration may lead to a regular expression DoS attack on the server.

    Published 14 May 2024 · Fixed in 16.11.2 · NVD
  11. Medium 6.5

    CVE-2023-6682 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. A problem with the processing logic for Discord Integrations Chat Messages can lead to a regular expression DoS attack on the server.

    Published 14 May 2024 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  12. Medium 5.3

    CVE-2024-34358 · TYPO3

    Uncontrolled Resource Consumption in ShowImageController

    Published 14 May 2024 · Fixed in 11.5.37, 12.4.15, 13.1.1 · NVD, Project advisories (GitHub)
  13. Medium 5.4

    CVE-2024-34357 · TYPO3

    Cross-Site Scripting in ShowImageController

    Published 14 May 2024 · Fixed in 11.5.37, 12.4.15, 13.1.1 · NVD, Project advisories (GitHub)
  14. Medium 5.4

    CVE-2024-34356 · TYPO3

    Cross-Site Scripting in Form Manager Module

    Published 14 May 2024 · Fixed in 11.5.37, 12.4.15, 13.1.1 · NVD, Project advisories (GitHub)
  15. Medium 5.4

    CVE-2024-34355 · TYPO3

    HTML Injection in History Module

    Published 14 May 2024 · Fixed in 13.1.1 · NVD, Project advisories (GitHub)
  16. Medium 6.4

    CVE-2024-4984 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 14 May 2024 · Fixed in 22.7 · WPVulnerability
  17. Medium 5.4

    CVE-2024-34709 · Directus

    Session Tokens Invalidation

    Published 13 May 2024 · Fixed in 10.11.0 · NVD, Project advisories (GitHub)
  18. Medium 4.9

    CVE-2024-34708 · Directus

    Redacted data extraction on the API through "alias"

    Published 13 May 2024 · Fixed in 10.11.0 · NVD, Project advisories (GitHub)
  19. Medium 5.4

    CVE-2024-4392 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting

    Published 13 May 2024 · Fixed in 13.4 · NVD, WPVulnerability
  20. Low

    CVE-2024-34349 · Sylius

    Potential Cross Site Scripting (XSS) via the "Name" field (Taxons, Products, Options, Variants) in the Admin Panel

    Published 10 May 2024 · Fixed in 1.9.12 · Project advisories (GitHub)
  21. Critical 9.6

    CVE-2024-34070 · Froxlor

    Blind XSS Leading to Froxlor Application Compromise

    Published 10 May 2024 · Fixed in 2.1.9 · Project advisories (GitHub)
  22. High 7.5

    CVE-2024-34351 · Next.js

    Next.js Server-Side Request Forgery in Server Actions

    Published 9 May 2024 · Fixed in 14.1.1 · OSV.dev and GitHub
  23. High 7.5

    CVE-2024-34350 · Next.js

    Next.js Vulnerable to HTTP Request Smuggling

    Published 9 May 2024 · Fixed in 13.5.1 · OSV.dev and GitHub
  24. Medium 6.1

    CVE-2024-34074 · Frappe Framework

    Open redirect on login page

    Published 9 May 2024 · Fixed in 14.74.0, 15.26.0 · NVD, Project advisories (GitHub)
  25. Medium 4.3

    CVE-2024-34827 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Cross-Site Request Forgery (CSRF)

    Published 9 May 2024 · Fixed in 2.7.6 · WPVulnerability
  26. High 7.5

    CVE-2024-33608 · F5 BIG-IP

    When IPsec is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 8 May 2024 · NVD
  27. Medium 6.1

    CVE-2024-33604 · F5 BIG-IP

    A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    Published 8 May 2024 · Fixed in 15.1.10.4, 16.1.4.3, 17.1.1.3 · NVD
  28. Medium 6.5

    CVE-2024-32761 · F5 BIG-IP

    Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. This leak occurs randomly and cannot be deliberately triggered. If it occurs, it may leak up to 64 bytes of non-contiguous randomized bytes. Under rare conditions, this may lead to a TMM restart, affecting availability.  Note: Software versions…

    Published 8 May 2024 · Fixed in 15.1.10 · NVD
  29. Critical 9.8Actively exploited

    CVE-2024-32113 · Apache OFBiz

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.

    Published 8 May 2024 · Fixed in 18.12.13 · NVD
  30. High 8.0

    CVE-2024-31156 · F5 BIG-IP

    A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 8 May 2024 · Fixed in 15.1.10.4, 16.1.4.3, 17.1.1.3 · NVD
  31. Medium 5.9

    CVE-2024-28889 · F5 BIG-IP

    When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 8 May 2024 · Fixed in 15.1.10.4, 16.1.4.3, 17.1.1.3 · NVD
  32. High 7.4

    CVE-2024-28883 · F5 BIG-IP

    An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may allow an attacker to bypass F5 endpoint inspection. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 8 May 2024 · Fixed in 15.1.10.3, 16.1.4.2 · NVD
  33. Medium 4.7

    CVE-2024-27202 · F5 BIG-IP

    A DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 8 May 2024 · Fixed in 15.1.10.4, 16.1.4.3, 17.1.1.3 · NVD
  34. High 7.5

    CVE-2024-25560 · F5 BIG-IP

    When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 8 May 2024 · Fixed in 15.1.10.8, 16.1.4 · NVD
  35. Critical 9.0

    CVE-2024-34346 · Deno

    Permission escalation via open of privileged files with missing `--deny` flag

    Published 7 May 2024 · Fixed in 1.43.0, 1.43.1 · NVD, Project advisories (GitHub)
  36. Medium 6.5

    CVE-2024-31456 · GLPI

    GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. This vulnerability is fixed in 10.0.15.

    Published 7 May 2024 · Fixed in 10.0.15 · NVD
  37. High 8.1

    CVE-2024-29889 · GLPI

    GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15.

    Published 7 May 2024 · Fixed in 10.0.15 · NVD
  38. Medium 4.3

    CVE-2024-28148 · Apache Superset

    An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue.

    Published 7 May 2024 · Fixed in 4.0.0 · NVD
  39. High 7.4

    CVE-2024-33602 · GNU C Library

    nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

    Published 6 May 2024 · Fixed in 2.40 · NVD
  40. High 7.3

    CVE-2024-33601 · GNU C Library

    nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd…

    Published 6 May 2024 · Fixed in 2.40 · NVD
  41. Medium 5.9

    CVE-2024-33600 · GNU C Library

    nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

    Published 6 May 2024 · Fixed in 2.40 · NVD
  42. High 8.1

    CVE-2024-33599 · GNU C Library

    nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

    Published 6 May 2024 · Fixed in 2.40 · NVD
  43. High 7.6

    CVE-2024-3661 · F5 BIG-IP

    DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

    Published 6 May 2024 · NVD
  44. Medium 6.1

    CVE-2024-4041 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 6 May 2024 · Fixed in 22.6 · WPVulnerability
  45. High 7.4

    CVE-2024-34507 · MediaWiki

    An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occur because of mishandling of the 0x1b character, as demonstrated by Special:RecentChanges#%1b0000000.

    Published 5 May 2024 · Fixed in 1.39.7, 1.40.3, 1.41.1 · NVD
  46. High 7.5

    CVE-2024-34506 · MediaWiki

    An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. If a user with the necessary rights to move the page opens Special:MovePage for a page with tens of thousands of subpages, then the page will exceed the maximum request time, leading to a denial of service.

    Published 5 May 2024 · Fixed in 1.39.7, 1.40.3, 1.41.1 · NVD
  47. Critical 9.8

    CVE-2024-34502 · MediaWiki

    An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.

    Published 5 May 2024 · Fixed in 1.39.6, 1.40.2, 1.41.1 · NVD
  48. Medium 6.1

    CVE-2024-34500 · MediaWiki

    An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.

    Published 5 May 2024 · Fixed in 1.39.6, 1.40.2, 1.41.1 · NVD
  49. Medium 4.9

    CVE-2024-28072 · SolarWinds Serv-U

    A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly.

    Published 3 May 2024 · Fixed in 15.4.2 · NVD
  50. Medium 6.1

    CVE-2024-4439 · WordPress

    WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In…

    Published 3 May 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.