Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 11,199
- Published in 7 days
- 251
- Critical in 30 days
- 70
- Actively exploited
- 62
Latest vulnerabilities
11,199 vulnerabilities- Medium 6.1
CVE-2024-21729 · Joomla!
Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.
Published 9 Jul 2024 · Fixed in 4.4.6, 5.1.2 · NVD - Medium 6.8
CVE-2024-2177 · GitLab
A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload.
Published 9 Jul 2024 · Fixed in 16.11.5, 17.0.3 · NVD - Low
CVE-2024-37372 · Node.js
Permission model improperly processes UNC paths
Published 8 Jul 2024 · Fixed in 20.15.1, 22.4.1 · nodejs - High
CVE-2024-36138 · Node.js
Bypass incomplete fix of CVE-2024-27980
Published 8 Jul 2024 · Fixed in 18.20.4, 20.15.1, 22.4.1 · nodejs - Low
CVE-2024-36137 · Node.js
fs.fchown/fchmod bypasses permission model
Published 8 Jul 2024 · Fixed in 20.15.1, 22.4.1 · nodejs - Medium
CVE-2024-22020 · Node.js
Bypass network import restriction via data URL
Published 8 Jul 2024 · Fixed in 18.20.4, 20.15.1, 22.4.1 · nodejs - Low
CVE-2024-22018 · Node.js
fs.lstat bypasses permission model
Published 8 Jul 2024 · Fixed in 20.15.1, 22.4.1 · nodejs - Medium 4.8
CVE-2024-40605 · MediaWiki
An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.
Published 7 Jul 2024 · NVD - Medium 4.8
CVE-2024-40604 · MediaWiki
An issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sidebar menu and submenu entries.
Published 7 Jul 2024 · NVD - Medium 4.3
CVE-2024-40603 · MediaWiki
An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request.
Published 7 Jul 2024 · NVD - Medium 4.8
CVE-2024-40602 · MediaWiki
An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.
Published 7 Jul 2024 · NVD - Medium 6.5
CVE-2024-40601 · MediaWiki
An issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1. CSRF can occur in API modules.
Published 7 Jul 2024 · NVD - Medium 4.8
CVE-2024-40600 · MediaWiki
An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.
Published 7 Jul 2024 · NVD - Medium 4.8
CVE-2024-40599 · MediaWiki
An issue was discovered in the GuMaxDD skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries.
Published 7 Jul 2024 · NVD - Medium 4.3
CVE-2024-40598 · MediaWiki
An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can expose suppressed information for log events. (The log_deleted attribute is not applied to entries.)
Published 7 Jul 2024 · NVD - High 7.5
CVE-2024-40597 · MediaWiki
An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. It can expose suppressed information for log events. (The log_deleted attribute is not respected.)
Published 7 Jul 2024 · NVD - Medium 4.3
CVE-2024-40596 · MediaWiki
An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed information for log events. (TimelineService does not support properly suppressing.)
Published 7 Jul 2024 · NVD - Medium 6.2
CVE-2024-39884 · Apache HTTP Server
A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61,…
Published 4 Jul 2024 · NVD - Medium 5.3
CVE-2024-37157 · Discourse
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, a malicious actor could get the FastImage library to redirect requests to an internal Discourse IP. This issue is patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches. No…
Published 3 Jul 2024 · Fixed in 3.2.3, 3.3.0 · NVD - Medium 4.3
CVE-2024-36122 · Discourse
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, moderators using the review queue to review users may see a users email address even when the Allow moderators to view email addresses setting is disabled. This issue is patched in version 3.2.3 on the `stable` branch and version…
Published 3 Jul 2024 · Fixed in 3.2.3, 3.3.0 · NVD - High 7.5
CVE-2024-34750 · Apache Tomcat
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been…
Published 3 Jul 2024 · Fixed in 9.0.90, 10.1.25 · NVD - Medium 6.5
CVE-2024-36113 · Discourse
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch, and version 3.3.0.beta4-dev on the `tests-passed` branch, a rogue staff user could suspend other staff users preventing them from logging in to the site. The issue is patched in version 3.2.3 on the `stable` branch, version 3.3.0.beta3 on the `beta` branch,…
Published 3 Jul 2024 · Fixed in 3.2.3, 3.3.0 · NVD - Medium 6.1
CVE-2024-35234 · Discourse
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version…
Published 3 Jul 2024 · Fixed in 3.2.3, 3.3.0 · NVD - High 7.5
CVE-2024-35227 · Discourse
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, Oneboxing against a carefully crafted malicious URL can reduce the availability of a Discourse instance. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. There are no known…
Published 3 Jul 2024 · NVD - Unrated
WPV-f1f8e8d7ebc0 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)
Vulnerability in Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing
Published 3 Jul 2024 · Fixed in 1.43.4 · WPVulnerability - High 7.5
CVE-2024-39573 · Apache HTTP Server
Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Published 1 Jul 2024 · Fixed in 2.4.60 · NVD - High 7.5
CVE-2024-38477 · Apache HTTP Server
null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Published 1 Jul 2024 · Fixed in 2.4.60 · NVD - Critical 9.8
CVE-2024-38476 · Apache HTTP Server
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Published 1 Jul 2024 · Fixed in 2.4.60 · NVD - Critical 9.1Actively exploited
CVE-2024-38475 · Apache HTTP Server
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the…
Published 1 Jul 2024 · Fixed in 2.4.60 · NVD - Critical 9.8
CVE-2024-38474 · Apache HTTP Server
Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute…
Published 1 Jul 2024 · Fixed in 2.4.60 · NVD - High 8.1
CVE-2024-38473 · Apache HTTP Server
Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Published 1 Jul 2024 · Fixed in 2.4.60 · NVD - High 7.5
CVE-2024-38472 · Apache HTTP Server
SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
Published 1 Jul 2024 · Fixed in 2.4.60 · NVD - Medium 5.4
CVE-2024-36387 · Apache HTTP Server
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.
Published 1 Jul 2024 · NVD - Medium 6.5
CVE-2024-6375 · MongoDB
A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server v5.0 versions, prior to 5.0.22, MongoDB Server v6.0 versions, prior to 6.0.11 and MongoDB Server v7.0 versions prior to…
Published 1 Jul 2024 · Fixed in 5.0.22, 6.0.11, 7.0.3 · NVD - High 8.1
CVE-2024-6387 · OpenSSH
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
Published 1 Jul 2024 · Fixed in 4.4 · NVD - High 7.5
CVE-2024-5598 · File Manager Advanced (WordPress plugin)
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Insecure Storage of Sensitive Information
Published 28 Jun 2024 · Fixed in 5.2.5 · WPVulnerability - Medium 4.8
CVE-2024-37449 · Slider Revolution
Slider Revolution: Cross-site Scripting
Published 28 Jun 2024 · Fixed in 6.7.14 · NVD, WPVulnerability - Medium 5.4
CVE-2024-37437 · Elementor
Elementor Website Builder – more than just a page builder: Path Traversal
Published 28 Jun 2024 · Fixed in 3.22.2 · NVD, WPVulnerability - High 7.5
CVE-2024-6323 · GitLab
Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17.1.1 allows an attacker leak content of a private repository in a public project.
Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD - High 8.8
CVE-2024-5655 · GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to trigger a pipeline as another user under certain circumstances.
Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD - Medium 4.9
CVE-2024-5430 · GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.10 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows a project maintainer can delete the merge request approval policy via graphQL.
Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD - Medium 5.4
CVE-2024-4901 · GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, where a stored XSS vulnerability could be imported from a project with malicious commit notes.
Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD - Medium 6.5
CVE-2024-4557 · GitLab
Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1 which allowed an attacker to cause resource exhaustion via banzai pipeline.
Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD - Medium 4.3
CVE-2024-4011 · GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows non-project member to promote key results to objectives.
Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD - Medium 6.5
CVE-2024-3959 · GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows private job artifacts can be accessed by any user.
Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD - Medium 4.3
CVE-2024-3115 · GitLab
An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to access issues and epics without having an SSO session using Duo Chat.
Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD - Medium 5.3
CVE-2024-2191 · GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only.
Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD - Medium 5.5
CVE-2024-1816 · GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 12.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows for an attacker to cause a denial of service using a crafted OpenAPI file.
Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD - Medium 6.5
CVE-2024-1493 · GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, with the processing logic for generating link in dependency files can lead to a regular expression DoS attack on the server
Published 27 Jun 2024 · Fixed in 16.11.5, 17.0.3 · NVD - Low 3.5
CVE-2024-35777 · WooCommerce
WooCommerce: Injection
Published 27 Jun 2024 · Fixed in 9.0.0 · WPVulnerability
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.