UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,679
Published in 7 days
767
Critical in 30 days
199
Actively exploited
405

Latest vulnerabilities

32,679 vulnerabilities
  1. High 8.8

    CVE-2024-28906 · Microsoft SQL Server

    Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

    Published 9 Apr 2024 · Fixed in 15.0.4360.2, 16.0.1115.1, 16.0.4120.1 · NVD
  2. High 7.3

    CVE-2024-21409 · .NET

    .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

    Published 9 Apr 2024 · Fixed in 6.0.29, 7.0.18, 8.0.4 · NVD
  3. Critical 10.0

    CVE-2024-24576 · Rust

    `std::process::Command` did not properly escape arguments of batch files on Windows

    Published 9 Apr 2024 · Fixed in 1.77.2 · NVD, Project advisories (GitHub)
  4. Medium 6.5

    CVE-2024-28235 · Contao

    Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling…

    Published 9 Apr 2024 · Fixed in 4.13.40, 5.3.4 · NVD
  5. High 7.5

    CVE-2024-23662 · Fortinet FortiOS

    An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.15 and 6.4.0 through 6.4.15 allows attacker to information disclosure via HTTP requests.

    Published 9 Apr 2024 · Fixed in 7.2.6, 7.4.2 · NVD
  6. Medium 6.7

    CVE-2023-48784 · Fortinet FortiOS

    A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all versions, 6.4 all versions command line interface may allow a local privileged attacker with super-admin profile and CLI access to execute arbitrary code or commands via specially crafted requests.

    Published 9 Apr 2024 · Fixed in 7.0.16, 7.2.8, 7.4.2 · NVD
  7. High 8.8

    CVE-2023-41677 · Fortinet FortiProxy, Fortinet FortiOS

    A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.1, FortiProxy 7.2.0 through 7.2.7, FortiProxy 7.0.0 through 7.0.13, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions,…

    Published 9 Apr 2024 · Fixed in 7.2.7, 7.2.8, 7.4.2 · NVD
  8. Medium 4.7

    CVE-2024-28234 · Contao

    Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments.

    Published 9 Apr 2024 · Fixed in 4.13.40, 5.3.4 · NVD
  9. Medium 5.4

    CVE-2024-28191 · Contao

    Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at…

    Published 9 Apr 2024 · Fixed in 4.13.40, 5.3.4 · NVD
  10. Medium 5.4

    CVE-2024-28190 · Contao

    Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and…

    Published 9 Apr 2024 · Fixed in 4.13.40, 5.3.4 · NVD
  11. Medium 6.6

    CVE-2024-28224 · Ollama

    Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).

    Published 8 Apr 2024 · Fixed in 0.1.29 · NVD
  12. Medium 5.3

    CVE-2024-31447 · Shopware

    Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and…

    Published 8 Apr 2024 · Fixed in 6.5.8.8, 6.6.1.0 · NVD
  13. Medium 6.4

    CVE-2024-2306 · Slider Revolution

    Slider Revolution: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

    Published 8 Apr 2024 · Fixed in 6.7.0 · WPVulnerability
  14. Medium 6.5

    CVE-2024-2447 · Mattermost

    Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.

    Published 5 Apr 2024 · Fixed in 9.3.3, 9.4.4, 9.5.2 · NVD
  15. Low 3.8

    CVE-2024-29221 · Mattermost

    Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the `/api/v4/users/me/teams` endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the "Add Members" permission was explicitly removed from team admins.

    Published 5 Apr 2024 · Fixed in 9.3.3, 9.4.4, 9.5.2 · NVD
  16. Medium 6.5

    CVE-2024-28949 · Mattermost

    Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.

    Published 5 Apr 2024 · Fixed in 9.3.3, 9.4.4, 9.5.2 · NVD
  17. Low 3.1

    CVE-2024-21848 · Mattermost

    Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in the call even if they are removed from the channel

    Published 5 Apr 2024 · Fixed in 8.1.11 · NVD
  18. Medium 4.3

    CVE-2024-22155 · WooCommerce

    WooCommerce: Cross-Site Request Forgery (CSRF)

    Published 5 Apr 2024 · Fixed in 8.6.0 · WPVulnerability
  19. Critical 9.8

    CVE-2024-21894 · Ivanti Connect Secure

    A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this may lead to execution of arbitrary code

    Published 4 Apr 2024 · NVD
  20. High 7.5

    CVE-2024-30255 · Envoy

    Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames. Envoy's HTTP/2 codec allows the client to send an unlimited number of CONTINUATION frames even after exceeding Envoy's header map limits. This allows an attacker to send a…

    Published 4 Apr 2024 · Fixed in 1.27.4, 1.28.2, 1.29.3 · NVD
  21. High 7.5

    CVE-2024-27316 · Apache HTTP Server

    HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

    Published 4 Apr 2024 · Fixed in 2.4.59 · NVD
  22. Medium 6.3

    CVE-2024-24795 · Apache HTTP Server

    HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.

    Published 4 Apr 2024 · Fixed in 2.4.59 · NVD
  23. High 8.2

    CVE-2024-22053 · Ivanti Connect Secure

    A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack or in certain conditions read contents from memory.

    Published 4 Apr 2024 · NVD
  24. High 7.5

    CVE-2024-22052 · Ivanti Connect Secure

    A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack

    Published 4 Apr 2024 · NVD
  25. Medium 5.3

    CVE-2024-22023 · Ivanti Connect Secure

    An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.

    Published 4 Apr 2024 · NVD
  26. High 7.3

    CVE-2023-38709 · Apache HTTP Server

    Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.

    Published 4 Apr 2024 · Fixed in 2.4.59 · NVD
  27. Medium 6.8

    CVE-2024-2660 · HashiCorp Vault

    Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.

    Published 4 Apr 2024 · Fixed in 1.14.11, 1.15.7, 1.16.0 · NVD
  28. High 7.5

    CVE-2024-27268 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 284574.

    Published 4 Apr 2024 · Fixed in 24.0.0.5 · NVD
  29. Critical 9.8

    CVE-2024-3116 · pgAdmin

    pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.

    Published 4 Apr 2024 · NVD
  30. High 7.5

    CVE-2024-27919 · Envoy

    Envoy is a cloud-native, open-source edge and service proxy. In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of CONTINUATION frames. Envoy's HTTP/2 codec does not reset a request when header map limits have been exceeded. This allows an attacker to send an sequence of CONTINUATION frames without the END_HEADERS bit set causing unlimited memory…

    Published 4 Apr 2024 · NVD
  31. Medium 5.4

    CVE-2024-20800 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable web pages. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script. This could result in arbitrary code execution…

    Published 4 Apr 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  32. Medium 5.4

    CVE-2024-2946 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 4 Apr 2024 · Fixed in 2.8.5 · WPVulnerability
  33. Critical 9.8

    CVE-2024-31211 · WordPress

    Remote Code Execution in `WP_HTML_Token`

    Published 3 Apr 2024 · Fixed in 6.4.2 · NVD, WordPress
  34. High 8.8

    CVE-2024-31210 · WordPress

    PHP file upload bypass via Plugin installer

    Published 3 Apr 2024 · Fixed in 6.2.4, 6.3.3, 6.4.3 · NVD, WordPress
  35. Medium 4.8

    CVE-2024-3181 · Concrete CMS

    Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. Prior to the fix, stored XSS could be executed by an administrator changing a filter to which a rogue administrator had previously added malicious code. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of…

    Published 3 Apr 2024 · Fixed in 8.5.16, 9.2.8 · NVD
  36. Medium 4.8

    CVE-2024-3180 · Concrete CMS

    Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file. Stored XSS could be caused by a rogue administrator adding malicious code to the link-text field when creating a block of type file. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L…

    Published 3 Apr 2024 · Fixed in 8.5.16, 9.2.8 · NVD
  37. Medium 4.8

    CVE-2024-3179 · Concrete CMS

    Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. Prior to the fix, a rogue administrator could insert malicious code in the custom class field due to insufficient validation of administrator provided data. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of…

    Published 3 Apr 2024 · Fixed in 8.5.16, 9.2.8 · NVD
  38. Medium 4.8

    CVE-2024-3178 · Concrete CMS

    Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter. Prior to the fix, a rogue administrator could add malicious code in the file manager because of insufficient validation of administrator provided data. All administrators have access to the File Manager and hence could create a search filter with the…

    Published 3 Apr 2024 · Fixed in 8.5.16, 9.2.8 · NVD
  39. Medium 4.8

    CVE-2024-2753 · Concrete CMS

    Concrete CMS version 9 before 9.2.8 and previous versions prior to 8.5.16 is vulnerable to Stored XSS on the calendar color settings screen since Information input by the user is output without escaping. A rogue administrator could inject malicious javascript into the Calendar Color Settings screen which might be executed when users visit the affected page. The Concrete CMS security team gave…

    Published 3 Apr 2024 · Fixed in 8.5.16, 9.2.8 · NVD
  40. High 8.8

    CVE-2024-29477 · Dolibarr ERP CRM

    Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.

    Published 3 Apr 2024 · Fixed in 19.0.1 · NVD
  41. Medium 6.1

    CVE-2024-24506 · LimeSurvey

    Cross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitrary code via the Administrator email address parameter in the General Setting function.

    Published 3 Apr 2024 · NVD
  42. Medium 6.4

    CVE-2024-2868 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 3 Apr 2024 · Fixed in 2.8.4 · WPVulnerability
  43. Medium 6.5

    CVE-2023-50313 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274812.

    Published 2 Apr 2024 · NVD
  44. Medium 5.4

    CVE-2024-20799 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 2 Apr 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  45. High 7.5

    CVE-2024-22353 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 280400.

    Published 31 Mar 2024 · NVD
  46. Medium 6.5

    CVE-2024-29893 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the…

    Published 29 Mar 2024 · Fixed in 2.8.14, 2.9.10, 2.10.5 · NVD
  47. Medium 5.3

    CVE-2024-23449 · Elasticsearch

    An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

    Published 29 Mar 2024 · Fixed in 8.11.1 · NVD
  48. Medium 4.9

    CVE-2024-31140 · TeamCity

    In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools

    Published 28 Mar 2024 · Fixed in 2024.03 · NVD
  49. High 8.1

    CVE-2024-31139 · TeamCity

    In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector

    Published 28 Mar 2024 · Fixed in 2024.03 · NVD
  50. Medium 5.4

    CVE-2024-31138 · TeamCity

    In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings

    Published 28 Mar 2024 · Fixed in 2024.03 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.