UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
251
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Medium 4.3

    CVE-2024-37251 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Cross-Site Request Forgery (CSRF)

    Published 26 Jun 2024 · Fixed in 6.3.2 · WPVulnerability
  2. Medium 5.4

    CVE-2024-37250 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Missing Authorization

    Published 26 Jun 2024 · Fixed in 6.3.2 · WPVulnerability
  3. Medium 4.3

    CVE-2024-37249 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Missing Authorization

    Published 26 Jun 2024 · Fixed in 6.3.2 · WPVulnerability
  4. Unrated

    WPV-11f7e3fe76dc · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Vulnerability in Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing

    Published 25 Jun 2024 · Fixed in 1.43.4 · WPVulnerability
  5. Medium 4.3

    CVE-2024-37236 · Loco Translate (WordPress plugin)

    Loco Translate: Cross-Site Request Forgery (CSRF)

    Published 21 Jun 2024 · Fixed in 2.6.10 · WPVulnerability
  6. Medium 5.4

    CVE-2024-1168 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 19 Jun 2024 · Fixed in 7.9.1 · WPVulnerability
  7. Critical 9.8

    CVE-2024-5488 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Deserialization of Untrusted Data

    Published 18 Jun 2024 · Fixed in 7.9 · WPVulnerability
  8. Low 3.5

    CVE-2024-37887 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that the Nextcloud Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1 and that the Nextcloud Enterprise Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1.

    Published 14 Jun 2024 · Fixed in 27.1.10, 28.0.6 · NVD
  9. Medium 5.4

    CVE-2024-37884 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3.

    Published 14 Jun 2024 · Fixed in 26.0.13, 27.1.8, 28.0.4 · NVD
  10. High 8.1

    CVE-2024-37882 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4 and that the Nextcloud Enterprise Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4.

    Published 14 Jun 2024 · Fixed in 26.0.13, 27.1.8, 28.0.4 · NVD
  11. Medium 4.3

    CVE-2024-37315 · Nextcloud

    Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled. It is recommended that the Nextcloud Server is upgraded to 26.0.12, 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 23.0.12.16, 24.0.12.12, 25.0.13.6, 26.0.12, 27.1.7 or 28.0.3.

    Published 14 Jun 2024 · Fixed in 26.0.12, 27.1.7, 28.0.3 · NVD
  12. Low 3.5

    CVE-2024-37314 · Nextcloud

    Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud Enterprise Server is upgraded to 25.0.7 or 26.0.2.

    Published 14 Jun 2024 · Fixed in 25.0.7, 26.0.2 · NVD
  13. High 7.5

    CVE-2024-37313 · Nextcloud

    Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Server is upgraded to 21.0.9.17, 22.2.10.22, 23.0.12.17, 24.0.12.13, 25.0.13.8, 26.0.13, 27.1.8 or 28.0.4.

    Published 14 Jun 2024 · Fixed in 26.0.13, 27.1.8, 28.0.4 · NVD
  14. Medium 4.3

    CVE-2024-5469 · GitLab

    DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests.

    Published 14 Jun 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  15. Medium 4.9

    CVE-2024-37280 · Elasticsearch

    A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. Note that passthrough fields is an experimental feature.

    Published 13 Jun 2024 · Fixed in 8.14.0 · NVD
  16. High 8.8

    CVE-2024-34111 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..

    Published 13 Jun 2024 · NVD
  17. High 7.2

    CVE-2024-34110 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction.

    Published 13 Jun 2024 · NVD
  18. High 7.2

    CVE-2024-34109 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required.

    Published 13 Jun 2024 · NVD
  19. High 7.2

    CVE-2024-34108 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required and scope is changed.

    Published 13 Jun 2024 · NVD
  20. Critical 9.8

    CVE-2024-34107 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction.

    Published 13 Jun 2024 · NVD
  21. Medium 5.3

    CVE-2024-34106 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction.

    Published 13 Jun 2024 · NVD
  22. Medium 4.8

    CVE-2024-34105 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · NVD
  23. High 8.2

    CVE-2024-34104 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction.

    Published 13 Jun 2024 · NVD
  24. High 8.1

    CVE-2024-34103 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

    Published 13 Jun 2024 · NVD
  25. Critical 9.8Actively exploited

    CVE-2024-34102 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

    Published 13 Jun 2024 · NVD
  26. Medium 4.4

    CVE-2024-4201 · GitLab

    A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting from 16.11 before 16.111.4, all versions starting from 17.0 before 17.0.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances.

    Published 12 Jun 2024 · Fixed in 16.10.7, 16.111.4, 17.0.2 · NVD
  27. Medium 6.5

    CVE-2024-1963 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.4 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's Asana integration allowed an attacker to potentially cause a regular expression denial of service by sending specially crafted requests.

    Published 12 Jun 2024 · Fixed in 16.10.7, 16.11.4, 17.0.2 · NVD
  28. Medium 6.5

    CVE-2024-1736 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's CI/CD pipeline editor could allow for denial of service attacks through maliciously crafted configuration files.

    Published 12 Jun 2024 · Fixed in 16.10.7, 16.11.4, 17.0.2 · NVD
  29. Medium 6.5

    CVE-2024-1495 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.1 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. It was possible for an attacker to cause a denial of service using maliciously crafted file.

    Published 12 Jun 2024 · Fixed in 16.10.7, 16.11.4, 17.0.2 · NVD
  30. Medium 6.5

    CVE-2024-23445 · Elasticsearch

    It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#security-api-create-cross-cluster-api-key-request-body  restricts search for a given index using the query or the field_security parameter, and the same cross-cluster API key also grants replication for the same index, the search…

    Published 12 Jun 2024 · Fixed in 8.14.0 · NVD
  31. Medium 5.3

    CVE-2023-28775 · Yoast SEO

    Missing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4.

    Published 11 Jun 2024 · Fixed in 20.5 · NVD
  32. Unrated

    WPV-a4fb4d839020 · WooCommerce

    Vulnerability in WooCommerce

    Published 11 Jun 2024 · Fixed in 8.9.3 · WPVulnerability
  33. Medium 5.4

    CVE-2024-4627 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 11 Jun 2024 · Fixed in 1.0.219 · WPVulnerability
  34. Medium 5.4

    CVE-2024-5530 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 10 Jun 2024 · Fixed in 2.9.1 · WPVulnerability
  35. Medium 5.4

    CVE-2024-37297 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 10 Jun 2024 · Fixed in 8.8.5, 8.9.3 · NVD, WPVulnerability
  36. Critical 9.8Actively exploited

    CVE-2024-4577 · PHP

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP…

    Published 9 Jun 2024 · Fixed in 8.1.29, 8.2.20, 8.3.8 · NVD
  37. Medium 5.9

    CVE-2024-2408 · PHP

    The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to…

    Published 9 Jun 2024 · Fixed in 8.1.29, 8.2.20, 8.3.8 · NVD
  38. High 8.8

    CVE-2024-5585 · PHP

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary…

    Published 9 Jun 2024 · Fixed in 8.1.29, 8.2.20, 8.3.8 · NVD
  39. Medium 5.3

    CVE-2024-5458 · PHP

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid…

    Published 9 Jun 2024 · Fixed in 8.1.29, 8.2.20, 8.3.8 · NVD
  40. Medium 6.1

    CVE-2024-4704 · Contact Form 7

    Contact Form 7: Open Redirect

    Published 5 Jun 2024 · Fixed in 5.9.5 · NVD, WPVulnerability
  41. Medium 6.1

    CVE-2024-4900 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Open Redirect

    Published 3 Jun 2024 · Fixed in 7.8 · WPVulnerability
  42. Medium 5.0

    CVE-2024-4899 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 3 Jun 2024 · Fixed in 7.8 · WPVulnerability
  43. Medium 5.4

    CVE-2024-4637 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 3 Jun 2024 · Fixed in 6.7.11 · NVD, WPVulnerability
  44. Medium 5.4

    CVE-2024-4581 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 3 Jun 2024 · Fixed in 6.7.11 · NVD, WPVulnerability
  45. Medium 6.5

    CVE-2024-4565 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Improper Access Control

    Published 30 May 2024 · Fixed in 6.3, 6.3.0 · NVD, WPVulnerability
  46. Medium 5.9

    CVE-2024-34385 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Cross-site Scripting

    Published 30 May 2024 · Fixed in 3.33.0 · WPVulnerability
  47. Medium 5.3

    CVE-2024-35200 · nginx

    When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.

    Published 29 May 2024 · Fixed in 1.26.1 · NVD
  48. Medium 5.3

    CVE-2024-34161 · nginx

    When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.

    Published 29 May 2024 · Fixed in 1.26.1 · NVD
  49. Medium 6.5

    CVE-2024-32760 · nginx

    When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.

    Published 29 May 2024 · Fixed in 1.26.1 · NVD
  50. Medium 4.8

    CVE-2024-31079 · nginx

    When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.

    Published 29 May 2024 · Fixed in 1.26.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.