UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,652
Published in 7 days
756
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,652 vulnerabilities
  1. Medium 5.4

    CVE-2024-36371 · TeamCity

    In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible

    Published 29 May 2024 · Fixed in 2023.05.6, 2023.11.5 · NVD
  2. Medium 5.4

    CVE-2024-36370 · TeamCity

    In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible

    Published 29 May 2024 · Fixed in 2022.10.6, 2023.05.6, 2023.11.5 · NVD
  3. Medium 5.4

    CVE-2024-36369 · TeamCity

    In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible

    Published 29 May 2024 · Fixed in 2022.10.6, 2023.05.6, 2023.11.5 · NVD
  4. Medium 5.4

    CVE-2024-36368 · TeamCity

    In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible

    Published 29 May 2024 · Fixed in 2022.10.6, 2023.05.6, 2023.11.5 · NVD
  5. Medium 6.1

    CVE-2024-36367 · TeamCity

    In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible

    Published 29 May 2024 · Fixed in 2022.10.6, 2023.05.6, 2023.11.5 · NVD
  6. Medium 6.1

    CVE-2024-36366 · TeamCity

    In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering operations

    Published 29 May 2024 · Fixed in 2022.10.6, 2023.05.6, 2023.11.5 · NVD
  7. High 8.1

    CVE-2024-36365 · TeamCity

    In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent

    Published 29 May 2024 · Fixed in 2023.05.6, 2023.11.5, 2024.03.2 · NVD
  8. Medium 6.5

    CVE-2024-36364 · TeamCity

    In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was possible

    Published 29 May 2024 · Fixed in 2022.10.6, 2023.05.6, 2023.11.5 · NVD
  9. Medium 5.4

    CVE-2024-36363 · TeamCity

    In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible

    Published 29 May 2024 · Fixed in 2022.10.6, 2023.05.6, 2023.11.5 · NVD
  10. Medium 6.5

    CVE-2024-36362 · TeamCity

    In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible

    Published 29 May 2024 · Fixed in 2023.05.6, 2023.11.5, 2024.03.2 · NVD
  11. High 8.8

    CVE-2024-34444 · Slider Revolution

    Slider Revolution: Missing Authorization

    Published 28 May 2024 · Fixed in 6.7.0 · NVD, WPVulnerability
  12. Medium 5.4

    CVE-2024-34443 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 28 May 2024 · Fixed in 6.7.11 · NVD, WPVulnerability
  13. Medium 4.3

    CVE-2024-5272 · Mattermost

    Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to restrict the audience of the "custom_playbooks_playbook_run_updated" webhook event, which allows a guest on a channel with a playbook run linked to see all the details of the playbook run when the run is marked by finished.

    Published 26 May 2024 · Fixed in 8.1.13, 9.5.4, 9.6.2 · NVD
  14. Medium 4.3

    CVE-2024-5270 · Mattermost

    Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to check if the email signup configuration option is enabled when a user requests to switch from SAML to Email. This allows the user to switch their authentication mail from SAML to email and possibly edit personal details that were otherwise non-editable and provided by the SAML provider.

    Published 26 May 2024 · Fixed in 9.5.4, 9.6.2, 9.7.2 · NVD
  15. Medium 5.7

    CVE-2024-36255 · Mattermost

    Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in some arbitrary channel.

    Published 26 May 2024 · Fixed in 8.1.13, 9.5.4, 9.6.2 · NVD
  16. Medium 4.3

    CVE-2024-36241 · Mattermost

    Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to enforce proper access controls which allows user to view arbitrary post contents via the /playbook add slash command

    Published 26 May 2024 · Fixed in 8.1.13, 9.5.4, 9.6.2 · NVD
  17. Medium 4.3

    CVE-2024-34152 · Mattermost

    Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a public playbook run that linked to the channel they are guest via sending an RHSRuns GraphQL query request to the server

    Published 26 May 2024 · Fixed in 8.1.13, 9.5.4, 9.6.2 · NVD
  18. Medium 4.3

    CVE-2024-34029 · Mattermost

    Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1 and 8.1.x <= 8.1.12 fail to perform a proper authorization check in the /api/v4/groups/<group-id>/channels/<channel-id>/link endpoint which allows a user to learn the members of an AD/LDAP group that is linked to a team by adding the group to a channel, even if the user has no access to the team.

    Published 26 May 2024 · Fixed in 8.1.13, 9.5.4, 9.7.2 · NVD
  19. Medium 5.9

    CVE-2024-32045 · Mattermost

    Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playbook run to a channel which allows members to link their runs to private channels they were not members of.

    Published 26 May 2024 · Fixed in 8.1.13, 9.5.4, 9.6.2 · NVD
  20. Medium 6.3

    CVE-2024-31859 · Mattermost

    Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in an existing channel to be promoted to a channel admin

    Published 26 May 2024 · Fixed in 8.1.13, 9.5.4, 9.6.2 · NVD
  21. Medium 4.3

    CVE-2024-29215 · Mattermost

    Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a user to run a slash command in a channel they are not a member of via linking a playbook run to that channel and running a slash command as a playbook task command.

    Published 26 May 2024 · Fixed in 9.5.4, 9.6.2, 9.7.2 · NVD
  22. Medium 5.3

    CVE-2024-5318 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.11 prior to 16.10.6, starting from 16.11 prior to 16.11.3, and starting from 17.0 prior to 17.0.1. A Guest user can view dependency lists of private projects through job artifacts.

    Published 24 May 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  23. Critical 9.1

    CVE-2024-5315 · Dolibarr ERP CRM

    Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters viewstatut in /dolibarr/commande/list.php.

    Published 24 May 2024 · NVD
  24. Critical 9.1

    CVE-2024-5314 · Dolibarr ERP CRM

    Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in /dolibarr/admin/dict.php.

    Published 24 May 2024 · NVD
  25. Medium 5.4

    CVE-2024-35224 · OpenProject

    OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via `{icon}` substitution in table header values. This attack requires the permissions "Edit work packages" as well as "Add attachments". A project admin could attempt to escalate their privileges by…

    Published 23 May 2024 · Fixed in 13.4.2, 14.0.2 · NVD
  26. Medium 4.3

    CVE-2024-5258 · GitLab

    An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated attacker could utilize a crafted naming convention to bypass pipeline authorization logic.

    Published 23 May 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  27. Medium 6.5

    CVE-2024-1947 · GitLab

    A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls.

    Published 23 May 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  28. Medium 6.1

    CVE-2023-7045 · GitLab

    A CSRF vulnerability exists within GitLab CE/EE from versions 13.11 before 16.10.6, from 16.11 before 16.11.3, from 17.0 before 17.0.1. By leveraging this vulnerability, an attacker could exfiltrate anti-CSRF tokens via the Kubernetes Agent Server (KAS).

    Published 23 May 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  29. Medium 6.5

    CVE-2023-6502 · GitLab

    A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. It is possible for an attacker to cause a denial of service using a crafted wiki page.

    Published 23 May 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  30. High 8.2

    CVE-2024-4835 · GitLab

    A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condition, an attacker can craft a malicious page to exfiltrate sensitive user information.

    Published 23 May 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  31. Medium 6.5

    CVE-2024-2874 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered with a crafted description has the potential to disrupt the loading of targeted GitLab web resources.

    Published 23 May 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  32. Medium 5.4

    CVE-2024-1134 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 23 May 2024 · Fixed in 7.6 · WPVulnerability
  33. Medium 5.3

    CVE-2024-31617 · OpenLiteSpeed

    OpenLiteSpeed before 1.8.1 mishandles chunked encoding.

    Published 22 May 2024 · Fixed in 1.8.1 · NVD
  34. Medium 5.0

    CVE-2024-20355 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the implementation of SAML 2.0 single sign-on (SSO) for remote access VPN services in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to successfully establish a VPN session on an affected device. This vulnerability is due to improper separation of authorization domains when using…

    Published 22 May 2024 · NVD
  35. Medium 5.8

    CVE-2024-20293 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the activation of an access control list (ACL) on Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the protection that is offered by a configured ACL on an affected device. This vulnerability is due to a logic error that occurs when an ACL changes from inactive to active…

    Published 22 May 2024 · NVD
  36. High 8.8

    CVE-2024-34448 · Ghost

    Ghost before 5.82.0 allows CSV Injection during a member CSV export.

    Published 22 May 2024 · Fixed in 5.82.0 · NVD
  37. High 8.8

    CVE-2024-21683 · Confluence, Jira

    This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. …

    Published 21 May 2024 · Fixed in 8.9.3, 9.4.21, 9.12.8 · NVD
  38. Critical 9.0

    CVE-2024-31989 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed the latest version of the VPC CNI plugin on the EKS cluster, it requires manual enablement through configuration to enforce network policies. This raises…

    Published 21 May 2024 · Fixed in 2.9.15, 2.10.10, 2.11.1 · NVD
  39. Medium 4.9

    CVE-2024-22275 · VMware vCenter Server

    The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially read arbitrary files containing sensitive data.

    Published 21 May 2024 · NVD
  40. High 7.2

    CVE-2024-22274 · VMware vCenter Server

    The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system.

    Published 21 May 2024 · NVD
  41. High 7.8

    CVE-2024-22273 · VMware ESXi

    The storage controllers on VMware ESXi, Workstation, and Fusion have out-of-bounds read/write vulnerability. A malicious actor with access to a virtual machine with storage controllers enabled may exploit this issue to create a denial of service condition or execute code on the hypervisor from a virtual machine in conjunction with other issues.

    Published 21 May 2024 · NVD
  42. Medium 4.8

    CVE-2024-35218 · Umbraco CMS

    Umbraco CMS is an ASP.NET CMS used by more than 730.000 websites. Stored Cross-site scripting (XSS) enable attackers that have access to backoffice to bring malicious content into a website or application. This vulnerability has been patched in version(s) 8.18.13, 10.8.4, 12.3.7, 13.1.1 by implementing IHtmlSanitizer.

    Published 21 May 2024 · Fixed in 10.8.4, 12.3.7, 13.1.1 · NVD
  43. Medium 6.1

    CVE-2024-34071 · Umbraco CMS

    Umbraco is an ASP.NET CMS used by more than 730.000 websites. Umbraco has an endpoint that is vulnerable to open redirects. The endpoint is protected so it requires the user to be signed into backoffice before the vulnerable is exposed. This vulnerability has been patched in version(s) 8.18.14, 10.8.6, 12.3.10 and 13.3.1.

    Published 21 May 2024 · Fixed in 10.8.6, 12.3.10, 13.3.1 · NVD
  44. Medium 5.4

    CVE-2024-4619 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 20 May 2024 · Fixed in 3.21.5, 3.22.0-beta2 · NVD, WPVulnerability
  45. High 7.1

    CVE-2024-4566 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Missing Authorization

    Published 20 May 2024 · Fixed in 2.8.9 · WPVulnerability
  46. Medium 5.4

    CVE-2024-3345 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 20 May 2024 · Fixed in 2.8.9 · WPVulnerability
  47. High 8.8

    CVE-2024-22120 · Zabbix

    Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "clientip" field is not sanitized, it is possible to injection SQL into "clientip" and exploit time based blind SQL injection.

    Published 17 May 2024 · Fixed in 6.0.28, 6.4.13 · NVD
  48. Medium 5.4

    CVE-2024-34767 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 17 May 2024 · Fixed in 2.8.8 · WPVulnerability
  49. High 7.5

    CVE-2024-31142 · Xen

    Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-434 (Speculative Return Stack Overflow) uses the same infrastructure, so is equally impacted. For more details, see: https://xenbits.xen.org/xsa/advisory-407.html https://xenbits.xen.org/xsa/advisory-434.html

    Published 16 May 2024 · Fixed in 4.16.6, 4.17.4, 4.18.2 · NVD
  50. Medium 6.5

    CVE-2023-46842 · Xen

    Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes. This in particular means that they may set registers used to pass 32-bit-mode hypercall arguments to values outside of the range 32-bit code would be able to set them to. When processing of hypercalls takes a considerable amount of time, the hypervisor may choose to invoke a hypercall continuation. Doing so…

    Published 16 May 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.