UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
251
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. High 8.8

    CVE-2024-34444 · Slider Revolution

    Slider Revolution: Missing Authorization

    Published 28 May 2024 · Fixed in 6.7.0 · NVD, WPVulnerability
  2. Medium 5.4

    CVE-2024-34443 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 28 May 2024 · Fixed in 6.7.11 · NVD, WPVulnerability
  3. Medium 5.3

    CVE-2024-5318 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.11 prior to 16.10.6, starting from 16.11 prior to 16.11.3, and starting from 17.0 prior to 17.0.1. A Guest user can view dependency lists of private projects through job artifacts.

    Published 24 May 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  4. Medium 4.3

    CVE-2024-5258 · GitLab

    An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated attacker could utilize a crafted naming convention to bypass pipeline authorization logic.

    Published 23 May 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  5. Medium 6.5

    CVE-2024-1947 · GitLab

    A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls.

    Published 23 May 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  6. Medium 6.1

    CVE-2023-7045 · GitLab

    A CSRF vulnerability exists within GitLab CE/EE from versions 13.11 before 16.10.6, from 16.11 before 16.11.3, from 17.0 before 17.0.1. By leveraging this vulnerability, an attacker could exfiltrate anti-CSRF tokens via the Kubernetes Agent Server (KAS).

    Published 23 May 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  7. Medium 6.5

    CVE-2023-6502 · GitLab

    A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. It is possible for an attacker to cause a denial of service using a crafted wiki page.

    Published 23 May 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  8. High 8.2

    CVE-2024-4835 · GitLab

    A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condition, an attacker can craft a malicious page to exfiltrate sensitive user information.

    Published 23 May 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  9. Medium 6.5

    CVE-2024-2874 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered with a crafted description has the potential to disrupt the loading of targeted GitLab web resources.

    Published 23 May 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  10. Medium 5.4

    CVE-2024-1134 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 23 May 2024 · Fixed in 7.6 · WPVulnerability
  11. Medium 5.3

    CVE-2024-31617 · OpenLiteSpeed

    OpenLiteSpeed before 1.8.1 mishandles chunked encoding.

    Published 22 May 2024 · Fixed in 1.8.1 · NVD
  12. High 8.8

    CVE-2024-21683 · Confluence

    This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. …

    Published 21 May 2024 · Fixed in 7.19.24, 8.5.11, 8.9.3 · NVD
  13. Medium 5.4

    CVE-2024-4619 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 20 May 2024 · Fixed in 3.21.5, 3.22.0-beta2 · NVD, WPVulnerability
  14. High 7.1

    CVE-2024-4566 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Missing Authorization

    Published 20 May 2024 · Fixed in 2.8.9 · WPVulnerability
  15. Medium 5.4

    CVE-2024-3345 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 20 May 2024 · Fixed in 2.8.9 · WPVulnerability
  16. Medium 5.4

    CVE-2024-34767 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 17 May 2024 · Fixed in 2.8.8 · WPVulnerability
  17. Critical 9.1

    CVE-2024-35187 · Stalwart

    Privilege escalation by design

    Published 16 May 2024 · Project advisories (GitHub)
  18. Medium 6.8

    CVE-2024-35179 · Stalwart

    Unprivileged user can read files as root

    Published 15 May 2024 · Project advisories (GitHub)
  19. Medium 6.4

    CVE-2024-4617 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 15 May 2024 · Fixed in 1.0.219 · WPVulnerability
  20. Critical 9.9

    CVE-2024-34762 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Path Traversal

    Published 15 May 2024 · Fixed in 6.2.10 · WPVulnerability
  21. High 8.5

    CVE-2024-34761 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Code Injection

    Published 15 May 2024 · Fixed in 6.2.10 · WPVulnerability
  22. Medium 5.9

    CVE-2024-30046 · .NET

    Visual Studio Denial of Service Vulnerability

    Published 14 May 2024 · Fixed in 7.0.19, 8.0.5 · NVD
  23. Medium 6.3

    CVE-2024-30045 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 14 May 2024 · Fixed in 7.0.19, 8.0.5 · NVD
  24. Medium 5.3

    CVE-2024-3374 · MongoDB

    An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.16 and MongoDB Server v6.0 versions prior to and including 6.0.5.

    Published 14 May 2024 · NVD
  25. High 7.5

    CVE-2024-3372 · MongoDB

    Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause unexpected application behavior including unavailability of serverStatus responses. This issue affects MongoDB Server v7.0 versions prior to 7.0.6, MongoDB Server v6.0 versions prior to 6.0.14 and MongoDB Server v.5.0 versions prior to…

    Published 14 May 2024 · Fixed in 5.0.25, 6.0.14, 7.0.6 · NVD
  26. Medium 6.5

    CVE-2024-4597 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. An attacker could force a user with an active SAML session to approve an MR via CSRF.

    Published 14 May 2024 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  27. Medium 6.5

    CVE-2024-4539 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 where abusing the API to filter branch and tags could lead to Denial of Service.

    Published 14 May 2024 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  28. Medium 4.3

    CVE-2024-4317 · PostgreSQL

    Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes…

    Published 14 May 2024 · Fixed in 14.12, 15.7, 16.3 · NVD
  29. Medium 5.4

    CVE-2024-4107 · Elementor

    The Elementor Website Builder – More than Just a Page Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in versions up to, and including, 3.21.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages…

    Published 14 May 2024 · Fixed in 3.21.1 · NVD
  30. Medium 6.5

    CVE-2024-2651 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. It was possible for an attacker to cause a denial of service using maliciously crafted markdown content.

    Published 14 May 2024 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  31. Medium 6.5

    CVE-2024-2454 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. The pins endpoint is susceptible to DoS through a crafted request.

    Published 14 May 2024 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  32. Medium 6.5

    CVE-2023-6688 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.11 prior to 16.11.2. A problem with the processing logic for Google Chat Messages integration may lead to a regular expression DoS attack on the server.

    Published 14 May 2024 · Fixed in 16.11.2 · NVD
  33. Medium 6.5

    CVE-2023-6682 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. A problem with the processing logic for Discord Integrations Chat Messages can lead to a regular expression DoS attack on the server.

    Published 14 May 2024 · Fixed in 16.9.7, 16.10.5, 16.11.2 · NVD
  34. Medium 6.4

    CVE-2024-4984 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 14 May 2024 · Fixed in 22.7 · WPVulnerability
  35. Medium 5.4

    CVE-2024-4392 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting

    Published 13 May 2024 · Fixed in 13.4 · NVD, WPVulnerability
  36. High 7.5

    CVE-2024-34351 · Next.js

    Next.js Server-Side Request Forgery in Server Actions

    Published 9 May 2024 · Fixed in 14.1.1 · OSV.dev and GitHub
  37. High 7.5

    CVE-2024-34350 · Next.js

    Next.js Vulnerable to HTTP Request Smuggling

    Published 9 May 2024 · Fixed in 13.5.1 · OSV.dev and GitHub
  38. Medium 6.1

    CVE-2024-4041 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 6 May 2024 · Fixed in 22.6 · WPVulnerability
  39. High 7.4

    CVE-2024-34507 · MediaWiki

    An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occur because of mishandling of the 0x1b character, as demonstrated by Special:RecentChanges#%1b0000000.

    Published 5 May 2024 · Fixed in 1.39.7, 1.40.3, 1.41.1 · NVD
  40. High 7.5

    CVE-2024-34506 · MediaWiki

    An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. If a user with the necessary rights to move the page opens Special:MovePage for a page with tens of thousands of subpages, then the page will exceed the maximum request time, leading to a denial of service.

    Published 5 May 2024 · Fixed in 1.39.7, 1.40.3, 1.41.1 · NVD
  41. Critical 9.8

    CVE-2024-34502 · MediaWiki

    An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.

    Published 5 May 2024 · Fixed in 1.39.6, 1.40.2, 1.41.1 · NVD
  42. Medium 6.1

    CVE-2024-34500 · MediaWiki

    An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.

    Published 5 May 2024 · Fixed in 1.39.6, 1.40.2, 1.41.1 · NVD
  43. Medium 6.1

    CVE-2024-4439 · WordPress

    WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In…

    Published 3 May 2024 · NVD
  44. Medium 5.4

    CVE-2024-4335 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 3 May 2024 · Fixed in 1.0.218 · WPVulnerability
  45. Medium 5.3

    CVE-2024-34383 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Authorization Bypass Through User-Controlled Key

    Published 3 May 2024 · Fixed in 7.7 · WPVulnerability
  46. Medium 5.3

    CVE-2023-6327 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Missing Authorization

    Published 3 May 2024 · Fixed in 2.8.8 · WPVulnerability
  47. Medium 5.4

    CVE-2024-3991 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 2 May 2024 · Fixed in 2.8.8 · WPVulnerability
  48. Medium 5.3

    CVE-2024-3649 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: External Control of Assumed-Immutable Web Parameter

    Published 1 May 2024 · Fixed in 1.8.8.2 · WPVulnerability
  49. Medium 5.4

    CVE-2024-4092 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 30 Apr 2024 · Fixed in 6.7.8 · NVD, WPVulnerability
  50. Medium 6.5

    CVE-2024-3096 · PHP

    In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

    Published 29 Apr 2024 · Fixed in 8.1.28, 8.2.18, 8.3.5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.