Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 32,686
- Published in 7 days
- 764
- Critical in 30 days
- 201
- Actively exploited
- 405
Latest vulnerabilities
32,686 vulnerabilities- Medium 6.5
CVE-2023-50313 · IBM WebSphere Application Server
IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274812.
Published 2 Apr 2024 · NVD - Medium 5.4
CVE-2024-20799 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 2 Apr 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - High 7.5
CVE-2024-22353 · IBM WebSphere Application Server
IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 280400.
Published 31 Mar 2024 · NVD - Medium 6.5
CVE-2024-29893 · Argo CD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the…
Published 29 Mar 2024 · Fixed in 2.8.14, 2.9.10, 2.10.5 · NVD - Medium 5.3
CVE-2024-23449 · Elasticsearch
An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.
Published 29 Mar 2024 · Fixed in 8.11.1 · NVD - Medium 4.9
CVE-2024-31140 · TeamCity
In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools
Published 28 Mar 2024 · Fixed in 2024.03 · NVD - High 8.1
CVE-2024-31139 · TeamCity
In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector
Published 28 Mar 2024 · Fixed in 2024.03 · NVD - Medium 5.4
CVE-2024-31138 · TeamCity
In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings
Published 28 Mar 2024 · Fixed in 2024.03 · NVD - Medium 6.1
CVE-2024-31137 · TeamCity
In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration
Published 28 Mar 2024 · Fixed in 2024.03 · NVD - High 7.4
CVE-2024-31136 · TeamCity
In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter
Published 28 Mar 2024 · Fixed in 2024.03 · NVD - Medium 6.1
CVE-2024-31135 · TeamCity
In JetBrains TeamCity before 2024.03 open redirect was possible on the login page
Published 28 Mar 2024 · Fixed in 2024.03 · NVD - Medium 6.5
CVE-2024-31134 · TeamCity
In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled
Published 28 Mar 2024 · Fixed in 2024.03 · NVD - Medium 6.5
CVE-2024-2818 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. It was possible for an attacker to cause a denial of service using malicious crafted description parameter for labels.
Published 28 Mar 2024 · Fixed in 16.8.5, 16.9.3 · NVD - Medium 5.4
CVE-2023-6371 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. A wiki page with a crafted payload may lead to a Stored XSS, allowing attackers to perform arbitrary actions on behalf of victims.
Published 28 Mar 2024 · Fixed in 16.8.5, 16.9.3 · NVD - Medium 4.9
CVE-2024-29892 · ZITADEL
ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim `urn:zitadel:iam:user:resourceowner:name`. To compensate for this we introduced a protection that does prevent actions from changing claims that start with…
Published 27 Mar 2024 · Fixed in 2.46.5, 2.47.8, 2.48.3 · NVD - High 8.7
CVE-2024-29891 · ZITADEL
ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's account in certain scenarios. A possible victim would need to directly open the supposed image in the browser, where a session in ZITADEL needs to be active for this exploit to work. The exploit could…
Published 27 Mar 2024 · Fixed in 2.46.5, 2.47.8, 2.48.3 · NVD - Medium 6.5
CVE-2024-23451 · Elasticsearch
Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0. This allows a malicious user with a valid API key for a remote cluster configured to use the new Remote Cluster Security to read arbitrary documents from any index on the remote cluster, and only if they use the Elasticsearch…
Published 27 Mar 2024 · Fixed in 8.13.0 · NVD - High 8.1
CVE-2024-29946 · Splunk Enterprise
In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phish the victim by tricking them into initiating a request within their browser.
Published 27 Mar 2024 · Fixed in 9.0.9, 9.1.4, 9.2.1 · NVD - High 7.2
CVE-2024-29945 · Splunk Enterprise
In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the software potentially exposes authentication tokens during the token validation process. This exposure happens when either Splunk Enterprise runs in debug mode or the JsonWebToken component has been configured to log its activity at the DEBUG logging level.
Published 27 Mar 2024 · Fixed in 9.0.9, 9.1.4, 9.2.1 · NVD - High 7.5
CVE-2024-23450 · Elasticsearch
A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.
Published 27 Mar 2024 · Fixed in 7.17.19, 8.13.0 · NVD - Medium 6.1
CVE-2024-27270 · IBM WebSphere Application Server
IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in a specially crafted URI. IBM X-Force ID: 284576.
Published 27 Mar 2024 · Fixed in 24.0.0.4 · NVD - Medium 6.5
CVE-2024-2466 · curl
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
Published 27 Mar 2024 · Fixed in 8.7.0 · NVD - High 8.6
CVE-2024-2398 · curl
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by…
Published 27 Mar 2024 · Fixed in 8.7.0 · NVD - Medium 6.3
CVE-2024-2379 · curl
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
Published 27 Mar 2024 · NVD - Low 3.5
CVE-2024-2004 · curl
When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of…
Published 27 Mar 2024 · Fixed in 8.7.0 · NVD - Medium 5.4
CVE-2024-2120 · Elementor
The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Navigation widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web…
Published 27 Mar 2024 · Fixed in 3.20.2 · NVD - Medium 5.3
CVE-2024-29735 · Apache Airflow
Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3. Airflow's local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix group of the folders. In the case Airflow is run with the root user (not recommended) it added group…
Published 26 Mar 2024 · NVD - Medium 6.5
CVE-2024-29197 · Pimcore
Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument `?pimcore_preview=true` allows to view unpublished sites. In previous versions of Pimcore, session information would propagate to previews, so only a logged in user could open a preview. This no longer applies. Previews are broad open to any user and with just the hint of a restricted link one could…
Published 26 Mar 2024 · Fixed in 11.1.6.1, 11.2.2 · NVD - Medium 5.4
CVE-2024-2117 · Elementor
Elementor Website Builder – more than just a page builder: Cross-site Scripting
Published 26 Mar 2024 · Fixed in 3.20.3 · NVD, WPVulnerability - Medium 4.9
CVE-2024-1310 · WooCommerce
WooCommerce: Improper Access Control
Published 25 Mar 2024 · Fixed in 8.6 · WPVulnerability - Medium 5.4
CVE-2024-28593 · Moodle
The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's Using_Chat page says "If you know some HTML code, you can use it in your text to do things like insert images, play sounds or create different coloured and sized text." This page also says "Chat is due to be…
Published 22 Mar 2024 · NVD - Medium 5.4
CVE-2024-2165 · WP Seopress (WordPress plugin)
SEOPress – AI SEO Plugin & On-site SEO: Improper Input Validation
Published 22 Mar 2024 · Fixed in 7.6 · WPVulnerability - High 8.8
CVE-2024-28119 · Grav
Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs…
Published 21 Mar 2024 · Fixed in 1.7.45 · NVD - High 8.8
CVE-2024-28118 · Grav
Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a previous SSTI mitigation. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the…
Published 21 Mar 2024 · Fixed in 1.7.45 · NVD - High 8.8
CVE-2024-28117 · Grav
Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twig_array_map, allowing attackers to bypass the validation and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any…
Published 21 Mar 2024 · Fixed in 1.7.45 · NVD - High 8.8
CVE-2024-28116 · Grav
Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. Version 1.7.45 contains a patch for this issue.
Published 21 Mar 2024 · Fixed in 1.7.45 · NVD - High 8.8
CVE-2024-27921 · Grav
Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw poses severe risks, that can allow attackers to inject arbitrary code on the server, undermine integrity…
Published 21 Mar 2024 · Fixed in 1.7.45 · NVD - Medium 6.1
CVE-2024-29374 · Moodle
A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.
Published 21 Mar 2024 · NVD - High 7.8
CVE-2024-29880 · TeamCity
In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process
Published 21 Mar 2024 · Fixed in 2023.11 · NVD - Medium 6.5
CVE-2024-27936 · Deno
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents. Deno is stripping any ANSI escape sequences from the permission prompt, but permissions given…
Published 21 Mar 2024 · Fixed in 1.41.0 · NVD - High 8.3
CVE-2024-27935 · Deno
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. The issue arises from the re-use of a global buffer (BUF) in stream_wrap.ts used as a…
Published 21 Mar 2024 · Fixed in 1.36.3 · NVD - High 8.8
CVE-2024-27934 · Deno
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.36.2 and prior to version 1.40.3, use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. Use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying…
Published 21 Mar 2024 · Fixed in 1.40.3 · NVD - High 8.8
CVE-2024-27933 · Deno
Deno is a JavaScript, TypeScript, and WebAssembly runtime. In version 1.39.0, use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors, allowing standard input to be re-opened as a different resource resulting in permission prompt bypass. Node child_process IPC relies on the JS side to pass the raw IPC file descriptor to `op_node_ipc_pipe()`,…
Published 21 Mar 2024 · NVD - Medium 4.6
CVE-2024-27932 · Deno
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example[.]com` may be sent to `notexample[.]com`. Anyone who uses…
Published 21 Mar 2024 · Fixed in 1.40.4 · NVD - High 8.8
CVE-2024-27923 · Grav
Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.
Published 21 Mar 2024 · Fixed in 1.7.43 · NVD - Medium 5.4
CVE-2024-2536 · SEO By Rank Math (WordPress plugin)
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Improper Input Validation
Published 21 Mar 2024 · Fixed in 1.0.215 · WPVulnerability - Medium 5.3
CVE-2024-28868 · Umbraco CMS
Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins.
Published 20 Mar 2024 · Fixed in 10.8.5 · NVD - Medium 4.3
CVE-2024-2291 · MOVEit Transfer
In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered. An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results in user activity not being logged properly.
Published 20 Mar 2024 · Fixed in 2022.1.12, 2023.0.9, 2023.1.4 · NVD - Medium 6.5
CVE-2023-46841 · Xen
Recent x86 CPUs offer functionality named Control-flow Enforcement Technology (CET). A sub-feature of this are Shadow Stacks (CET-SS). CET-SS is a hardware feature designed to protect against Return Oriented Programming attacks. When enabled, traditional stacks holding both data and return addresses are accompanied by so called "shadow stacks", holding little more than return addresses. Shadow…
Published 20 Mar 2024 · NVD - Medium 4.1
CVE-2023-46840 · Xen
Incorrect placement of a preprocessor directive in source code results in logic that doesn't operate as intended when support for HVM guests is compiled out of Xen.
Published 20 Mar 2024 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.