UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,198
Published in 7 days
251
Critical in 30 days
69
Actively exploited
62

Latest vulnerabilities

11,198 vulnerabilities
  1. Medium 4.3

    CVE-2024-39414 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  2. Medium 4.3

    CVE-2024-39413 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  3. Medium 4.3

    CVE-2024-39412 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and perform a minor integrity change. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  4. Medium 4.3

    CVE-2024-39411 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  5. Medium 4.3

    CVE-2024-39410 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor integrity changes on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation…

    Published 14 Aug 2024 · NVD
  6. Medium 4.3

    CVE-2024-39409 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor integrity changes on behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation…

    Published 14 Aug 2024 · NVD
  7. Medium 4.3

    CVE-2024-39408 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to bypass security features and perform minor integrity changeson behalf of a user. The vulnerability could be exploited by tricking a victim into clicking a link or loading a page that submits a malicious request. Exploitation…

    Published 14 Aug 2024 · NVD
  8. Medium 4.3

    CVE-2024-39407 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  9. Medium 6.8

    CVE-2024-39406 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue…

    Published 14 Aug 2024 · NVD
  10. Medium 4.3

    CVE-2024-39405 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  11. Medium 4.3

    CVE-2024-39404 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.

    Published 14 Aug 2024 · NVD
  12. High 7.6

    CVE-2024-39403 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is…

    Published 14 Aug 2024 · NVD
  13. High 8.4

    CVE-2024-39402 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.

    Published 14 Aug 2024 · NVD
  14. High 8.4

    CVE-2024-39401 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user interaction and scope is changed.

    Published 14 Aug 2024 · NVD
  15. High 8.1

    CVE-2024-39400 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious…

    Published 14 Aug 2024 · NVD
  16. High 7.7

    CVE-2024-39399 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this…

    Published 14 Aug 2024 · NVD
  17. High 7.4

    CVE-2024-39398 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to perform brute force attacks and potentially gain unauthorized access to accounts. Exploitation of this issue does not require user…

    Published 14 Aug 2024 · NVD
  18. Critical 9.0

    CVE-2024-39397 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution by an attacker. An attacker could exploit this vulnerability by uploading a malicious file which can then be executed on the server. Exploitation of this issue does not require user interaction,…

    Published 14 Aug 2024 · NVD
  19. High 7.5

    CVE-2024-38168 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 13 Aug 2024 · Fixed in 8.0.8 · NVD
  20. Medium 6.5

    CVE-2024-38167 · .NET

    .NET and Visual Studio Information Disclosure Vulnerability

    Published 13 Aug 2024 · Fixed in 8.0.8 · NVD
  21. Medium 5.3

    CVE-2024-6384 · MongoDB

    "Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versions prior to 7.3.3

    Published 13 Aug 2024 · Fixed in 6.0.16, 7.0.11, 7.3.3 · NVD
  22. High 7.5

    CVE-2024-7348 · PostgreSQL

    Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open…

    Published 8 Aug 2024 · Fixed in 14.13, 15.8, 16.4 · NVD
  23. Medium 6.5

    CVE-2024-7610 · GitLab

    A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  24. Medium 6.5

    CVE-2024-7554 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.0.6, all versions starting from 17.1 before 17.1.4, all versions starting from 17.2 before 17.2.2. Under certain conditions, access tokens may have been logged when an API request was made in a specific manner.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  25. Medium 6.5

    CVE-2024-5423 · GitLab

    Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2 which allowed an attacker to cause resource exhaustion via banzai pipeline.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  26. Medium 5.4

    CVE-2024-4207 · GitLab

    A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 prior 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  27. Medium 6.5

    CVE-2024-3958 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  28. Medium 6.5

    CVE-2024-3114 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2, with the processing logic for parsing invalid commits can lead to a regular expression DoS attack on the server.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  29. High 8.1

    CVE-2024-3035 · GitLab

    A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned repositories.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  30. High 7.5

    CVE-2024-2800 · GitLab

    ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE/CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allows denial of service via Regex backtracking.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  31. High 7.5

    CVE-2024-6329 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which causes the web interface to fail to render the diff correctly when the path is encoded.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  32. Medium 5.4

    CVE-2024-4784 · GitLab

    An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the password re-entry requirement to approve a policy.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  33. Medium 6.5

    CVE-2024-4210 · GitLab

    A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 12.6 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause a denial of service using crafted adoc files.

    Published 8 Aug 2024 · Fixed in 17.0.6, 17.1.4, 17.2.2 · NVD
  34. High 7.8

    CVE-2024-7553 · MongoDB

    Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0…

    Published 7 Aug 2024 · Fixed in 6.0.16, 7.0.12, 7.3.3 · NVD
  35. High 8.8

    CVE-2024-7031 · Filester (WordPress plugin)

    File Manager Pro – Filester: Missing Authorization

    Published 2 Aug 2024 · Fixed in 1.8.3 · WPVulnerability
  36. High 7.5

    CVE-2024-23444 · Elasticsearch

    It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.

    Published 31 Jul 2024 · Fixed in 7.17.23, 8.13.0 · NVD
  37. Medium 6.5

    CVE-2024-7264 · curl

    libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also…

    Published 31 Jul 2024 · Fixed in 8.9.1 · NVD
  38. Medium 6.1

    CVE-2024-39320 · Discourse

    Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed_iframes setting. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.

    Published 30 Jul 2024 · Fixed in 3.2.5 · NVD
  39. High 7.5

    CVE-2024-37299 · Discourse

    Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, crafting requests to submit very long tag group names can reduce the availability of a Discourse instance. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.

    Published 30 Jul 2024 · Fixed in 3.2.5 · NVD
  40. Medium 6.1

    CVE-2024-37165 · Discourse

    Discourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. This vulnerability is fixed in 3.2.3 and 3.3.0.beta3.

    Published 30 Jul 2024 · Fixed in 3.2.3 · NVD
  41. Medium 6.5

    CVE-2023-49921 · Elasticsearch

    An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the…

    Published 26 Jul 2024 · Fixed in 7.17.16, 8.11.2 · NVD
  42. Medium 4.3

    CVE-2024-7057 · GitLab

    An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where job artifacts can be inappropriately exposed to users lacking the proper authorization level.

    Published 25 Jul 2024 · Fixed in 17.0.5, 17.1.3, 17.2.1 · NVD
  43. Medium 5.4

    CVE-2024-7047 · GitLab

    A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user.

    Published 25 Jul 2024 · Fixed in 17.0.5, 17.1.3 · NVD
  44. Medium 5.0

    CVE-2024-7091 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where it was possible to disclose limited information of an exported group or project to another user.

    Published 24 Jul 2024 · Fixed in 17.0.5, 17.1.3, 17.2.1 · NVD
  45. Medium 6.5

    CVE-2024-7060 · GitLab

    An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows unauthorized users to view the resultant export.

    Published 24 Jul 2024 · Fixed in 17.0.5, 17.1.3, 17.2.1 · NVD
  46. Medium 4.9

    CVE-2024-5067 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where certain project-level analytics settings could be leaked in DOM to group members with Developer or higher roles.

    Published 24 Jul 2024 · Fixed in 17.0.5, 17.1.3, 17.2.1 · NVD
  47. Low 2.7

    CVE-2024-0231 · GitLab

    A resource misdirection vulnerability in GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows an attacker to craft a repository import in such a way as to misdirect commits.

    Published 24 Jul 2024 · Fixed in 17.0.5, 17.1.3 · NVD
  48. Medium 4.3

    CVE-2024-6874 · curl

    libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the *macidn* IDN backend. The conversion function then fills up the provided buffer exactly - but does not null terminate the string.…

    Published 24 Jul 2024 · NVD
  49. High 7.5

    CVE-2024-6197 · curl

    libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This…

    Published 24 Jul 2024 · Fixed in 8.9.0 · NVD
  50. Critical 9.9

    CVE-2024-41110 · Docker Engine

    Authz zero length regression

    Published 23 Jul 2024 · Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.