UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
171
Critical in 30 days
40
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. High 7.5

    CVE-2024-46982 · Next.js

    Next.js Cache Poisoning

    Published 17 Sept 2024 · Fixed in 13.5.7, 14.2.10 · OSV.dev and GitHub
  2. Medium 4.3

    CVE-2024-6685 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2, where group runners information was disclosed to unauthorised group members.

    Published 16 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  3. Medium 6.1

    CVE-2024-4283 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 11.1 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow.

    Published 16 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  4. High 8.8

    CVE-2024-8641 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It may have been possible for an attacker with a victim's CI_JOB_TOKEN to obtain a GitLab session token belonging to the victim.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  5. Medium 6.5

    CVE-2024-8311 · GitLab

    An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template.

    Published 12 Sept 2024 · Fixed in 17.2.5, 17.3.2 · NVD
  6. High 8.8

    CVE-2024-6678 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  7. Medium 5.5

    CVE-2024-4472 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, where dependency proxy credentials are retained in graphql Logs.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  8. High 8.1

    CVE-2024-8754 · GitLab

    An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is configured.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  9. High 8.8

    CVE-2024-8640 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. Due to incomplete input filtering, it was possible to inject commands into a connected Cube server.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  10. Medium 6.5

    CVE-2024-8635 · GitLab

    A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy URL

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  11. High 7.2

    CVE-2024-8631 · GitLab

    A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. A user assigned the Admin Group Member custom role could have escalated their privileges to include other custom roles.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  12. High 7.5

    CVE-2024-8124 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which could cause Denial of Service via sending a specific POST request.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  13. Low 3.5

    CVE-2024-6446 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could be used to trick a victim to trust an attacker controlled application.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  14. Medium 4.3

    CVE-2024-6389 · GitLab

    An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a guest user was able to access commit information via the release Atom endpoint, contrary to permissions.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  15. Medium 6.5

    CVE-2024-5435 · GitLab

    An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2 will disclose user password from repository mirror configuration.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  16. High 7.5

    CVE-2024-4660 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2. It was possible for a guest to read the source code of a private project by using group templates.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  17. Medium 6.1

    CVE-2024-4612 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.9 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  18. Critical 9.1

    CVE-2024-2743 · GitLab

    An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables.

    Published 12 Sept 2024 · Fixed in 17.1.7, 17.2.5, 17.3.2 · NVD
  19. Medium 6.5

    CVE-2024-8096 · curl

    When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

    Published 11 Sept 2024 · Fixed in 8.10.0 · NVD
  20. Critical 9.8

    CVE-2024-45409 · GitLab

    The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within…

    Published 10 Sept 2024 · Fixed in 17.1.8, 17.2.7, 17.3.3 · NVD
  21. Critical 9.8

    CVE-2024-8654 · MongoDB

    MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3.

    Published 10 Sept 2024 · NVD
  22. Medium 5.4

    CVE-2024-5416 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 10 Sept 2024 · Fixed in 3.24.0 · NVD, WPVulnerability
  23. Critical 9.8

    CVE-2024-44000 · LiteSpeed Cache

    LiteSpeed Cache: Insufficiently Protected Credentials

    Published 5 Sept 2024 · Fixed in 6.5.0.1 · NVD, WPVulnerability
  24. High 7.5

    CVE-2024-45506 · HAProxy

    HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as exploited in the wild in 2024.

    Published 4 Sept 2024 · Fixed in 2.9.10, 3.0.4 · NVD
  25. High 8.8

    CVE-2024-43402 · Rust

    `std::process::Command` batch files argument escaping could be bypassed with trailing whitespace or periods

    Published 4 Sept 2024 · Fixed in 1.81.0 · NVD, Project advisories (GitHub)
  26. Medium 6.1

    CVE-2024-45429 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Cross-site Scripting

    Published 4 Sept 2024 · Fixed in 6.3.6 · WPVulnerability
  27. High 7.5

    CVE-2024-6119 · OpenSSL

    Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of service. Applications performing certificate name checks (e.g., TLS clients checking server…

    Published 3 Sept 2024 · Fixed in 3.1.7, 3.2.3, 3.3.2 · NVD
  28. High 7.5

    CVE-2024-6232 · Python

    There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

    Published 3 Sept 2024 · Fixed in 3.10.15, 3.11.10, 3.12.6 · NVD
  29. Medium 6.7

    CVE-2024-8207 · MongoDB

    In certain highly specific configurations of the host system and MongoDB server binary installation on Linux Operating Systems, it may be possible for a unintended actor with host-level access to cause the MongoDB Server binary to load unintended actor-controlled shared libraries when the server binary is started, potentially resulting in the unintended actor gaining full control over the…

    Published 27 Aug 2024 · Fixed in 5.0.14, 6.0.3, 6.1.1 · NVD
  30. Medium 6.5

    CVE-2024-8041 · GitLab

    A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1. A denial of service could occur upon importing a maliciously crafted repository using the GitHub importer.

    Published 22 Aug 2024 · Fixed in 17.1.6, 17.2.4, 17.3.1 · NVD
  31. Medium 6.4

    CVE-2024-7110 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection.

    Published 22 Aug 2024 · Fixed in 17.1.6, 17.2.4, 17.3.1 · NVD
  32. Medium 6.5

    CVE-2024-6502 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, which allows an attacker to create a branch with the same name as a deleted tag.

    Published 22 Aug 2024 · Fixed in 17.1.6, 17.2.4, 17.3.1 · NVD
  33. Medium 4.3

    CVE-2024-3127 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL allowing unauthorised users to perform some actions at the group level.

    Published 22 Aug 2024 · Fixed in 17.1.6, 17.2.4 · NVD
  34. High 8.2

    CVE-2024-21690 · Confluence

    This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.1, 8.8.0, and 8.9.0 of Confluence Data Center and Server. This Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability, with a CVSS Score of 7.1, allows an unauthenticated attacker to execute arbitrary HTML…

    Published 21 Aug 2024 · NVD
  35. Medium 6.1

    CVE-2024-40743 · Joomla!

    The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.

    Published 20 Aug 2024 · Fixed in 3.10.17, 4.4.6, 5.1.3 · NVD
  36. High 7.5

    CVE-2024-27187 · Joomla!

    Improper Access Controls allows backend users to overwrite their username when disallowed.

    Published 20 Aug 2024 · Fixed in 4.4.7, 5.1.3 · NVD
  37. Medium 6.1

    CVE-2024-27186 · Joomla!

    The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.

    Published 20 Aug 2024 · Fixed in 4.4.7, 5.1.3 · NVD
  38. Critical 9.1

    CVE-2024-27185 · Joomla!

    The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.

    Published 20 Aug 2024 · Fixed in 3.10.17, 4.4.7, 5.1.3 · NVD
  39. Medium 6.1

    CVE-2024-27184 · Joomla!

    Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not..

    Published 20 Aug 2024 · Fixed in 3.10.17, 4.4.7, 5.1.3 · NVD
  40. High 7.5

    CVE-2024-7592 · Python

    There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.

    Published 19 Aug 2024 · Fixed in 3.10.15, 3.11.10, 3.12.6 · NVD
  41. Critical 9.8

    CVE-2024-28000 · LiteSpeed Cache

    LiteSpeed Cache: Incorrect Privilege Assignment

    Published 19 Aug 2024 · Fixed in 6.4 · NVD, WPVulnerability
  42. Medium 5.9

    CVE-2024-39666 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 16 Aug 2024 · Fixed in 9.1.3 · WPVulnerability
  43. Medium 4.4

    CVE-2022-3399 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 15 Aug 2024 · Fixed in 2.4.18 · WPVulnerability
  44. Medium 5.7

    CVE-2024-7347 · nginx

    NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker…

    Published 14 Aug 2024 · Fixed in 1.26.2 · NVD
  45. Medium 4.3

    CVE-2024-39419 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  46. Medium 5.4

    CVE-2024-39418 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures to view and edit low-sensitivity information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  47. Medium 4.3

    CVE-2024-39417 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  48. Medium 4.3

    CVE-2024-39416 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  49. Medium 4.3

    CVE-2024-39415 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  50. Medium 4.3

    CVE-2024-39414 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.