UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
172
Critical in 30 days
40
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. Critical 9.8

    CVE-2024-52316 · Apache Tomcat

    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no…

    Published 18 Nov 2024 · Fixed in 9.0.96, 10.1.31 · NVD
  2. Low 3.5

    CVE-2024-52514 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the intermediate folder inside Nextcloud allowing them to afterwards potentially access the blocked files depending on the user access control rules. It is recommended that the Nextcloud Server is upgraded to…

    Published 15 Nov 2024 · Fixed in 26.0.13.3, 27.1.9, 28.0.5 · NVD
  3. Medium 4.3

    CVE-2024-52513 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in Text files without providing the password. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded to 25.0.13.13, 26.0.13.9,…

    Published 15 Nov 2024 · Fixed in 28.0.11, 29.0.8, 30.0.1 · NVD
  4. High 7.5

    CVE-2024-52525 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is…

    Published 15 Nov 2024 · Fixed in 28.0.12, 29.0.9, 30.0.2 · NVD
  5. Medium 6.5

    CVE-2024-52523 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2…

    Published 15 Nov 2024 · Fixed in 28.0.12, 29.0.9, 30.0.2 · NVD
  6. Medium 5.3

    CVE-2024-52521 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to…

    Published 15 Nov 2024 · Fixed in 28.0.10, 29.0.7 · NVD
  7. Medium 6.5

    CVE-2024-52520 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.

    Published 15 Nov 2024 · Fixed in 27.1.11.8, 28.0.10, 29.0.7 · NVD
  8. High 8.2

    CVE-2024-52519 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.

    Published 15 Nov 2024 · Fixed in 27.1.11.8, 28.0.10, 29.0.7 · NVD
  9. Medium 5.4

    CVE-2024-52518 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.

    Published 15 Nov 2024 · Fixed in 28.0.12, 29.0.9, 30.0.2 · NVD
  10. Medium 5.9

    CVE-2024-52517 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is…

    Published 15 Nov 2024 · Fixed in 28.0.11, 29.0.8, 30.0.1 · NVD
  11. Medium 4.3

    CVE-2024-52516 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously shared items were not unshared. It is recommended that the Nextcloud Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6 and Nextcloud Enterprise Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6.

    Published 15 Nov 2024 · Fixed in 27.1.11.9, 28.0.9, 29.0.5 · NVD
  12. Medium 6.5

    CVE-2024-52515 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If the file would exist the preview of the SVG would preview the other file instead. It is recommended that the Nextcloud Server is upgraded to 27.1.10, 28.0.6 or 29.0.1 and Nextcloud Enterprise Server…

    Published 15 Nov 2024 · Fixed in 27.1.10, 28.0.6, 29.0.1 · NVD
  13. High 8.1

    CVE-2024-10921 · MongoDB

    An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and…

    Published 14 Nov 2024 · Fixed in 6.0.19, 7.0.15, 8.0.3 · NVD
  14. High 7.5

    CVE-2024-9633 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions starting from 17.6 before 17.6.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain, potentially leading to domain confusion attacks.

    Published 14 Nov 2024 · Fixed in 17.4.2, 17.5.4, 17.6.2 · NVD
  15. Medium 6.1

    CVE-2024-8648 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. The vulnerability could allow an attacker to inject malicious JavaScript code in Analytics Dashboards through a specially crafted URL.

    Published 14 Nov 2024 · Fixed in 17.3.7, 17.4.4, 17.5.2 · NVD
  16. Medium 6.5

    CVE-2024-7404 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow.

    Published 14 Nov 2024 · Fixed in 17.3.7, 17.4.4, 17.5.2 · NVD
  17. High 8.8

    CVE-2024-10979 · PostgreSQL

    Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

    Published 14 Nov 2024 · Fixed in 15.9, 16.5, 17.1 · NVD
  18. Medium 4.2

    CVE-2024-10978 · PostgreSQL

    Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to…

    Published 14 Nov 2024 · Fixed in 14.14, 15.9, 16.5 · NVD
  19. Low 3.7

    CVE-2024-10977 · PostgreSQL

    Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface…

    Published 14 Nov 2024 · Fixed in 14.14, 15.9, 16.5 · NVD
  20. Medium 5.4

    CVE-2024-10976 · PostgreSQL

    Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the…

    Published 14 Nov 2024 · Fixed in 15.9, 16.5, 17.1 · NVD
  21. High 8.8

    CVE-2024-9693 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations.

    Published 14 Nov 2024 · Fixed in 17.3.7, 17.4.4, 17.5.2 · NVD
  22. Medium 5.4

    CVE-2024-8180 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encoding could lead to XSS if CSP is not enabled.

    Published 14 Nov 2024 · Fixed in 17.3.7, 17.4.4, 17.5.2 · NVD
  23. High 7.5

    CVE-2024-43499 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 12 Nov 2024 · NVD
  24. Critical 9.8

    CVE-2024-43498 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 12 Nov 2024 · NVD
  25. High 7.7

    CVE-2024-49521 · Magento / Adobe Commerce

    Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could result in the bypassing of security measures such as firewalls. Exploitation of this issue does not…

    Published 12 Nov 2024 · Fixed in 3.2.6 · NVD
  26. Medium 4.3

    CVE-2024-10593 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-Site Request Forgery (CSRF)

    Published 12 Nov 2024 · Fixed in 1.9.2.1 · NVD, WPVulnerability
  27. High 7.5

    CVE-2024-38286 · Apache Tomcat

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be…

    Published 7 Nov 2024 · Fixed in 9.0.90, 10.1.25 · NVD
  28. Medium 6.5

    CVE-2024-9681 · curl

    When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second…

    Published 6 Nov 2024 · Fixed in 8.11.0 · NVD
  29. Low 3.5

    CVE-2024-7056 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 4 Nov 2024 · Fixed in 1.9.1.6 · NVD, WPVulnerability
  30. Critical 9.8

    CVE-2024-50550 · LiteSpeed Cache

    LiteSpeed Cache: Incorrect Privilege Assignment

    Published 29 Oct 2024 · Fixed in 6.5.2 · NVD, WPVulnerability
  31. Medium 5.4

    CVE-2024-8312 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. An attacker could inject HTML into the Global Search field on a diff view leading to XSS.

    Published 24 Oct 2024 · Fixed in 17.3.6, 17.4.3 · NVD
  32. Medium 6.5

    CVE-2024-6826 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. A denial of service could occur via importing a malicious crafted XML manifest file.

    Published 24 Oct 2024 · Fixed in 17.3.6, 17.4.3 · NVD
  33. Medium 5.4

    CVE-2026-85305 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Server-Side Request Forgery (SSRF)

    Published 24 Oct 2024 · Fixed in 10.2 · WPVulnerability
  34. Medium 5.4

    CVE-2024-50456 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Missing Authorization

    Published 24 Oct 2024 · Fixed in 8.2 · WPVulnerability
  35. Medium 4.3

    CVE-2024-50455 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Missing Authorization

    Published 24 Oct 2024 · Fixed in 8.2 · WPVulnerability
  36. Medium 5.3

    CVE-2024-50454 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Missing Authorization

    Published 24 Oct 2024 · Fixed in 8.2 · WPVulnerability
  37. Medium 5.3

    CVE-2024-9287 · Python

    A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is…

    Published 22 Oct 2024 · Fixed in 3.11.11, 3.12.8, 3.13.1 · NVD
  38. Medium 6.5

    CVE-2024-8305 · MongoDB

    prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB Server v7.0 versions prior to 7.0.13 and MongoDB Server v7.3 versions prior to 7.3.4

    Published 21 Oct 2024 · Fixed in 6.0.17, 7.0.13, 7.3.4 · NVD
  39. Medium 5.7

    CVE-2024-27766 · MariaDB

    An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.

    Published 17 Oct 2024 · NVD
  40. Medium 5.6

    CVE-2023-39593 · MariaDB

    Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.

    Published 17 Oct 2024 · NVD
  41. Critical 9.8

    CVE-2023-26785 · MariaDB

    MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a "create function" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.

    Published 17 Oct 2024 · NVD
  42. Medium 5.9

    CVE-2024-10076 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting

    Published 17 Oct 2024 · Fixed in 13.8 · NVD, WPVulnerability
  43. Medium 5.6

    CVE-2024-10075 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Authorization Bypass Through User-Controlled Key

    Published 17 Oct 2024 · Fixed in 13.8 · NVD, WPVulnerability
  44. Medium 5.4

    CVE-2022-4973 · WordPress

    WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page.

    Published 16 Oct 2024 · NVD
  45. Unrated

    WPV-b3ea7226b782 · Advanced Custom Fields Pro (WordPress plugin)

    Vulnerability in Advanced Custom Field Pro

    Published 16 Oct 2024 · Fixed in 6.3.9 · WPVulnerability
  46. Unrated

    WPV-b05f2a6b3924 · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Published 16 Oct 2024 · Fixed in 6.3.9 · WPVulnerability
  47. High 7.5

    CVE-2024-21272 · MySQL

    Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score…

    Published 15 Oct 2024 · NVD
  48. Low 3.8

    CVE-2024-21247 · MySQL

    Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized update,…

    Published 15 Oct 2024 · NVD
  49. Low 2.2

    CVE-2024-21244 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). Supported versions that are affected are 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset…

    Published 15 Oct 2024 · NVD
  50. Low 2.2

    CVE-2024-21243 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). Supported versions that are affected are 8.4.2 and prior and 9.0.1 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset…

    Published 15 Oct 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.