UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
172
Critical in 30 days
40
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. Medium 5.4

    CVE-2024-10453 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 20 Dec 2024 · Fixed in 3.25.10 · NVD, WPVulnerability
  2. Medium 5.9

    CVE-2024-53991 · Discourse

    Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore::LocalStore` which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick nginx into sending the Discourse backup file with a well crafted request. This issue is patched in…

    Published 19 Dec 2024 · Fixed in 3.3.2, 3.4.0 · NVD
  3. Medium 6.1

    CVE-2024-52794 · Discourse

    Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 19 Dec 2024 · Fixed in 3.3.2, 3.4.0 · NVD
  4. Low 2.7

    CVE-2024-52589 · Discourse

    Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from untrusted users.

    Published 19 Dec 2024 · Fixed in 3.3.3, 3.4.0 · NVD
  5. Critical 9.1

    CVE-2024-49765 · Discourse

    Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled could allow attackers to bypass discourse connect to create accounts and login. This problem is patched in the latest version of Discourse. Users unable to upgrade who are using discourse connect may disable all other login methods as a workaround.

    Published 19 Dec 2024 · Fixed in 3.3.3, 3.4.0 · NVD
  6. Medium 4.3

    CVE-2024-12331 · Filester (WordPress plugin)

    File Manager Pro – Filester: Missing Authorization

    Published 18 Dec 2024 · Fixed in 1.8.7 · WPVulnerability
  7. Medium 6.0

    CVE-2024-12539 · Elasticsearch

    An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.

    Published 17 Dec 2024 · Fixed in 8.16.2 · NVD
  8. High 7.5

    CVE-2024-51479 · Next.js

    Next.js authorization bypass vulnerability

    Published 17 Dec 2024 · Fixed in 14.2.15 · OSV.dev and GitHub
  9. Medium 5.3

    CVE-2024-54677 · Apache Tomcat

    Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL…

    Published 17 Dec 2024 · Fixed in 9.0.98, 10.1.34, 11.0.2 · NVD
  10. Critical 9.8

    CVE-2024-50379 · Apache Tomcat

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time…

    Published 17 Dec 2024 · Fixed in 9.0.98, 10.1.34, 11.0.2 · NVD
  11. Medium 5.3

    CVE-2024-8650 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions from 15.0 prior to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2 that allowed non-member users to view unresolved threads marked as internal notes in public projects merge requests.

    Published 16 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  12. Medium 5.3

    CVE-2024-8116 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific GraphQL query, under specific conditions an unauthorized user can retrieve branch names.

    Published 16 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  13. Medium 6.4

    CVE-2024-9387 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions from 11.8 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could potentially perform an open redirect against a given releases API endpoint.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  14. Medium 4.3

    CVE-2024-9367 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while parsing templates to generate changelogs.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  15. Medium 5.4

    CVE-2024-8647 · GitLab

    An issue was discovered in GitLab affecting all versions starting 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self hosted installs, it was possible to leak the anti-CSRF-token to an external site while the Harbor integration was enabled.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  16. High 7.5

    CVE-2024-8233 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 9.4 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could cause a denial of service with requests for diff files on a commit or merge request.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  17. Medium 5.4

    CVE-2024-8179 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. Improper output encoding could lead to XSS if CSP is not enabled.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  18. Medium 6.7

    CVE-2024-12570 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.4.6, from 17.5 prior to 17.5.4, and from 17.6 prior to 17.6.2. It may have been possible for an attacker with a victim's `CI_JOB_TOKEN` to obtain a GitLab session token belonging to the victim.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  19. Medium 4.0

    CVE-2024-12292 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  20. High 8.7

    CVE-2024-11274 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  21. Low 3.1

    CVE-2024-10043 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature, potentially leading to information disclosure.

    Published 12 Dec 2024 · Fixed in 17.4.6, 17.5.4, 17.6.2 · NVD
  22. Low 3.4

    CVE-2024-11053 · curl

    When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

    Published 11 Dec 2024 · Fixed in 8.11.1 · NVD
  23. Medium 6.5

    CVE-2024-11205 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Missing Authorization

    Published 9 Dec 2024 · Fixed in 1.9.2.2 · NVD, WPVulnerability
  24. Medium 4.7

    CVE-2024-11223 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 5 Dec 2024 · Fixed in 1.9.2.3 · NVD, WPVulnerability
  25. Unrated

    WPV-c5798f3828bb · WooCommerce

    Vulnerability in WooCommerce

    Published 4 Dec 2024 · Fixed in 9.4.3 · WPVulnerability
  26. Medium 6.1

    CVE-2024-10858 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting

    Published 4 Dec 2024 · Fixed in 14.1, 16.1.3 · NVD, WPVulnerability
  27. High 7.5

    CVE-2024-11391 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Unrestricted Upload of File with Dangerous Type

    Published 2 Dec 2024 · Fixed in 5.2.11 · WPVulnerability
  28. High 8.1

    CVE-2024-36623 · Docker Engine

    moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.

    Published 29 Nov 2024 · NVD
  29. Medium 6.5

    CVE-2024-36621 · Docker Engine

    moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.

    Published 29 Nov 2024 · NVD
  30. Medium 6.5

    CVE-2024-36620 · Docker Engine

    moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.

    Published 29 Nov 2024 · NVD
  31. Medium 6.4

    CVE-2024-21703 · Confluence

    This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations. This Security Misconfiguration vulnerability, with a CVSS Score of 6.4 allows an authenticated attacker of the Windows host to read sensitive information about the Confluence Data Center configuration which has high impact to…

    Published 27 Nov 2024 · Fixed in 7.19.18, 8.5.5, 8.7.2 · NVD
  32. High 7.2

    CVE-2024-9669 · Filester (WordPress plugin)

    File Manager Pro – Filester: Path Traversal

    Published 27 Nov 2024 · Fixed in 1.8.6 · WPVulnerability
  33. High 8.8

    CVE-2024-8066 · Filester (WordPress plugin)

    File Manager Pro – Filester: Unrestricted Upload of File with Dangerous Type

    Published 27 Nov 2024 · Fixed in 1.8.7 · WPVulnerability
  34. Medium 5.3

    CVE-2024-10240 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2 in which an unauthenticated user may be able to read some information about an MR in a private project, under certain circumstances.

    Published 26 Nov 2024 · Fixed in 17.3.7, 17.4.4, 17.5.2 · NVD
  35. High 7.5

    CVE-2024-8237 · GitLab

    A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 12.6 prior to 17.4.5, 17.5 prior to 17.5.3, and 17.6 prior to 17.6.1. An attacker could cause a denial of service with a crafted cargo.toml file.

    Published 26 Nov 2024 · Fixed in 17.4.5, 17.5.3 · NVD
  36. High 7.5

    CVE-2024-8177 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, starting from 17.6 prior to 17.6.1 which could cause Denial of Service via integrating a malicious harbor registry.

    Published 26 Nov 2024 · Fixed in 17.4.5, 17.5.3 · NVD
  37. High 8.8

    CVE-2024-8114 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token (PAT) to escalate privileges.

    Published 26 Nov 2024 · Fixed in 17.4.5, 17.5.3 · NVD
  38. High 7.5

    CVE-2024-11828 · GitLab

    A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls. This was a regression of an earlier patch.

    Published 26 Nov 2024 · Fixed in 17.4.5, 17.5.3 · NVD
  39. High 7.5

    CVE-2024-11669 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token scopes.

    Published 26 Nov 2024 · Fixed in 17.4.5, 17.5.3 · NVD
  40. Medium 5.3

    CVE-2024-11668 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connections could potentially bypass authentication controls, allowing unauthorized access to streaming results.

    Published 26 Nov 2024 · Fixed in 17.4.5, 17.5.3 · NVD
  41. Medium 5.4

    CVE-2024-8236 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 25 Nov 2024 · Fixed in 3.25.8 · NVD, WPVulnerability
  42. High 8.2

    CVE-2024-11233 · PHP

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.

    Published 24 Nov 2024 · Fixed in 8.1.31, 8.2.26, 8.3.14 · NVD
  43. Critical 9.8

    CVE-2024-11236 · PHP

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

    Published 24 Nov 2024 · Fixed in 8.1.31, 8.2.26, 8.3.14 · NVD
  44. High 7.2

    CVE-2024-11234 · PHP

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available…

    Published 24 Nov 2024 · Fixed in 8.1.31, 8.2.26, 8.3.14 · NVD
  45. Medium 5.8

    CVE-2024-8929 · PHP

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.

    Published 22 Nov 2024 · Fixed in 8.1.31, 8.2.26, 8.3.14 · NVD
  46. Critical 9.8

    CVE-2024-8932 · PHP

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

    Published 22 Nov 2024 · Fixed in 8.1.31, 8.2.26, 8.3.14 · NVD
  47. High 7.2

    CVE-2024-11620 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Code Injection

    Published 22 Nov 2024 · Fixed in 1.0.232 · WPVulnerability
  48. Critical 9.8

    CVE-2024-10961 · Oa Social Login (WordPress plugin)

    Social Login: Authentication Bypass Using an Alternate Path or Channel

    Published 22 Nov 2024 · Fixed in 5.10.0 · WPVulnerability
  49. Medium 6.1

    CVE-2024-52318 · Apache Tomcat

    Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.

    Published 18 Nov 2024 · NVD
  50. Medium 6.5

    CVE-2024-52317 · Apache Tomcat

    Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or…

    Published 18 Nov 2024 · Fixed in 9.0.96, 10.1.31 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.