UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,121
Published in 7 days
626
Critical in 30 days
389
Actively exploited
420

Latest vulnerabilities

38,121 vulnerabilities
  1. High 7.5

    CVE-2024-2757 · PHP

    In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.

    Published 29 Apr 2024 · Fixed in 8.3.5 · NVD
  2. Critical 9.4

    CVE-2024-1874 · PHP

    In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

    Published 29 Apr 2024 · Fixed in 8.1.28, 8.2.18, 8.3.5 · NVD
  3. Medium 5.4

    CVE-2024-3554 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting

    Published 29 Apr 2024 · Fixed in 4.6.1.1 · WPVulnerability
  4. Medium 6.1

    CVE-2024-3368 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting

    Published 29 Apr 2024 · Fixed in 4.6.1.1 · WPVulnerability
  5. Medium 5.5

    CVE-2023-52722 · Ghostscript

    An issue was discovered in Artifex Ghostscript before 10.03.1. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standard.

    Published 28 Apr 2024 · Fixed in 10.03.1 · NVD
  6. High 7.8

    CVE-2023-51794 · FFmpeg

    Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/af_stereowiden.c:120:69.

    Published 26 Apr 2024 · NVD
  7. Medium 6.5

    CVE-2024-32476 · Argo CD

    Denial of Service via malicious jqPathExpressions in ignoreDifferences

    Published 26 Apr 2024 · Fixed in 2.8.17, 2.9.13, 2.10.8 · NVD, Project advisories (GitHub)
  8. Low 2.7

    CVE-2024-4198 · Mattermost

    Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.

    Published 26 Apr 2024 · Fixed in 8.1.12, 9.5.3 · NVD
  9. Low 2.7

    CVE-2024-4195 · Mattermost

    Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote guests to team admins via crafted HTTP requests.

    Published 26 Apr 2024 · Fixed in 8.1.12, 9.5.3 · NVD
  10. Medium 6.5

    CVE-2024-4183 · Mattermost

    Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.

    Published 26 Apr 2024 · Fixed in 9.4.5, 9.5.3, 9.6.1 · NVD
  11. Medium 4.3

    CVE-2024-4182 · Mattermost

    Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.

    Published 26 Apr 2024 · Fixed in 9.4.5, 9.5.3, 9.6.1 · NVD
  12. Medium 4.3

    CVE-2024-32046 · Mattermost

    Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored

    Published 26 Apr 2024 · Fixed in 9.4.5, 9.5.3, 9.6.1 · NVD
  13. Medium 6.5

    CVE-2024-22091 · Mattermost

    Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause excessive resource consumption, possibly leading to a DoS via sending large request paths

    Published 26 Apr 2024 · Fixed in 8.1.12, 9.5.3, 9.6.1 · NVD
  14. Critical 9.1

    CVE-2024-33661 · Portainer

    Portainer before 2.20.0 allows redirects when the target is not index.yaml.

    Published 26 Apr 2024 · Fixed in 2.20.0 · NVD
  15. High 8.8

    CVE-2024-4024 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user's Bitbucket account, if Bitbucket is used as an OAuth…

    Published 25 Apr 2024 · Fixed in 16.9.6, 16.10.4 · NVD
  16. Medium 4.3

    CVE-2024-4006 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1 where personal access scopes were not honored by GraphQL subscriptions

    Published 25 Apr 2024 · Fixed in 16.9.6, 16.10.4 · NVD
  17. High 7.5

    CVE-2024-25026 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 281516.

    Published 25 Apr 2024 · NVD
  18. High 7.5

    CVE-2024-2829 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. A crafted wildcard filter in FileFinder may lead to a denial of service.

    Published 25 Apr 2024 · Fixed in 16.9.6, 16.10.4 · NVD
  19. High 8.1

    CVE-2024-2434 · GitLab

    An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where path traversal could lead to DoS and restricted file read.

    Published 25 Apr 2024 · Fixed in 16.9.6, 16.10.4 · NVD
  20. Medium 5.3

    CVE-2024-1347 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group.

    Published 25 Apr 2024 · Fixed in 16.9.6, 16.10.4 · NVD
  21. High 8.1

    CVE-2024-32868 · ZITADEL

    Improper Lockout Mechanism Leads to MFA Bypass

    Published 25 Apr 2024 · Fixed in 2.50.0 · NVD, Project advisories (GitHub)
  22. Medium 6.7

    CVE-2024-20358 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Cisco Adaptive Security Appliance (ASA) restore functionality that is available in Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This…

    Published 24 Apr 2024 · NVD
  23. Medium 6.0Actively exploited

    CVE-2024-20359 · Cisco ASA and Firepower Threat Defense

    A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this…

    Published 24 Apr 2024 · NVD
  24. High 8.6Actively exploited

    CVE-2024-20353 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker…

    Published 24 Apr 2024 · NVD
  25. Medium

    GHSA-vjwg-28gv-pm8h · Pimcore

    Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881

    Published 24 Apr 2024 · Project advisories (GitHub)
  26. Low

    CVE-2024-32875 · Hugo

    Markdown title not escaped in internal render hooks

    Published 23 Apr 2024 · Fixed in 0.125.3 · Project advisories (GitHub)
  27. Critical 10.0Actively exploited

    CVE-2024-4040 · CrushFTP

    A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

    Published 22 Apr 2024 · Fixed in 10.7.1, 11.1.0 · NVD
  28. Medium 6.4

    CVE-2024-29376 · Sylius

    Potential Cross Site Scripting (XSS) via the "Province" field in the Checkout and Address Book

    Published 22 Apr 2024 · Fixed in 1.9.12 · NVD, Project advisories (GitHub)
  29. Medium 5.4

    CVE-2024-3665 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 22 Apr 2024 · Fixed in 1.0.217 · WPVulnerability
  30. Medium 4.3

    CVE-2024-32828 · Flexible Shipping (WordPress plugin)

    Weight Based Shipping Table Rate for WooCommerce – Flexible Shipping: Missing Authorization

    Published 22 Apr 2024 · Fixed in 4.24.16 · WPVulnerability
  31. High 7.8

    CVE-2023-51798 · FFmpeg

    Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via a floating point exception (FPE) error at libavfilter/vf_minterpolate.c:1078:60 in interpolate.

    Published 19 Apr 2024 · NVD
  32. Medium 6.7

    CVE-2023-51797 · FFmpeg

    Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showwaves.c:722:24 in showwaves_filter_frame

    Published 19 Apr 2024 · NVD
  33. Low 3.6

    CVE-2023-51796 · FFmpeg

    Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/f_reverse.c:269:26 in areverse_request_frame.

    Published 19 Apr 2024 · NVD
  34. High 8.0

    CVE-2023-51795 · FFmpeg

    Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showspectrum.c:1789:52 component in showspectrumpic_request_frame

    Published 19 Apr 2024 · NVD
  35. High 7.8

    CVE-2023-51793 · FFmpeg

    Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavutil/imgutils.c:353:9 in image_copy_plane.

    Published 19 Apr 2024 · NVD
  36. High 7.8

    CVE-2023-51791 · FFmpeg

    Buffer Overflow vulenrability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavcodec/jpegxl_parser.c in gen_alias_map.

    Published 19 Apr 2024 · NVD
  37. High 7.8

    CVE-2023-50010 · FFmpeg

    FFmpeg v.n6.1-3-g466799d4f5 allows a buffer over-read at ff_gradfun_blur_line_movdqa_sse2, as demonstrated by a call to the set_encoder_id function in /fftools/ffmpeg_enc.c component.

    Published 19 Apr 2024 · Fixed in 7.0 · NVD
  38. High 8.0

    CVE-2023-50009 · FFmpeg

    FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow via the ff_gaussian_blur_8 function in libavfilter/edge_template.c:116:5 component.

    Published 19 Apr 2024 · Fixed in 7.0 · NVD
  39. High 7.8

    CVE-2023-50008 · FFmpeg

    FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component.

    Published 19 Apr 2024 · Fixed in 7.0 · NVD
  40. Medium 4.0

    CVE-2023-50007 · FFmpeg

    FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component.

    Published 19 Apr 2024 · Fixed in 7.0 · NVD
  41. High 8.8

    CVE-2023-49502 · FFmpeg

    Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component.

    Published 19 Apr 2024 · Fixed in 7.0 · NVD
  42. High 8.0

    CVE-2023-49501 · FFmpeg

    Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component.

    Published 19 Apr 2024 · NVD
  43. Low

    GHSA-23q2-5gf8-gjpp · Uptime Kuma

    Enabling Authentication does not close all logged in socket connections immediately

    Published 19 Apr 2024 · Fixed in 1.23.12 · Project advisories (GitHub)
  44. Medium 5.4

    CVE-2024-1057 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 19 Apr 2024 · Fixed in 2.8.2 · WPVulnerability
  45. Medium 6.5

    CVE-2024-32473 · Docker Engine

    IPv6 enabled on IPv4-only network interfaces

    Published 18 Apr 2024 · Fixed in 26.0.2 · NVD, Project advisories (GitHub)
  46. High 7.5

    CVE-2024-20380 · ClamAV

    A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an issue in the C to Rust foreign function interface. An attacker could exploit this vulnerability by submitting a crafted file containing HTML content to be scanned by ClamAV on an affected device. An exploit…

    Published 18 Apr 2024 · NVD
  47. High 7.4

    CVE-2024-32477 · Deno

    Race condition when flushing input stream leads to permission prompt bypass

    Published 18 Apr 2024 · Fixed in 1.42.2 · NVD, Project advisories (GitHub)
  48. Medium 6.5

    CVE-2024-32474 · Sentry

    Superuser cleartext password leaked in logs

    Published 18 Apr 2024 · Fixed in 24.4.1 · NVD, Project advisories (GitHub)
  49. High 7.5

    CVE-2024-32475 · Envoy

    Abnormal termination when using auto_sni with :authority header longer than 255 characters

    Published 18 Apr 2024 · Fixed in 1.27.5, 1.28.3, 1.29.4 · NVD, Project advisories (GitHub)
  50. Medium 4.3

    CVE-2024-31869 · Apache Airflow

    Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your…

    Published 18 Apr 2024 · Fixed in 2.9.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.