UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,700
Published in 7 days
769
Critical in 30 days
201
Actively exploited
405

Latest vulnerabilities

32,700 vulnerabilities
  1. High 8.8

    CVE-2024-27921 · Grav

    Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw poses severe risks, that can allow attackers to inject arbitrary code on the server, undermine integrity…

    Published 21 Mar 2024 · Fixed in 1.7.45 · NVD
  2. Medium 6.1

    CVE-2024-29374 · Moodle

    A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.

    Published 21 Mar 2024 · NVD
  3. High 7.8

    CVE-2024-29880 · TeamCity

    In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process

    Published 21 Mar 2024 · Fixed in 2023.11 · NVD
  4. Medium 6.5

    CVE-2024-27936 · Deno

    Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents. Deno is stripping any ANSI escape sequences from the permission prompt, but permissions given…

    Published 21 Mar 2024 · Fixed in 1.41.0 · NVD
  5. High 8.3

    CVE-2024-27935 · Deno

    Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. The issue arises from the re-use of a global buffer (BUF) in stream_wrap.ts used as a…

    Published 21 Mar 2024 · Fixed in 1.36.3 · NVD
  6. High 8.8

    CVE-2024-27934 · Deno

    Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.36.2 and prior to version 1.40.3, use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. Use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying…

    Published 21 Mar 2024 · Fixed in 1.40.3 · NVD
  7. High 8.8

    CVE-2024-27933 · Deno

    Deno is a JavaScript, TypeScript, and WebAssembly runtime. In version 1.39.0, use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors, allowing standard input to be re-opened as a different resource resulting in permission prompt bypass. Node child_process IPC relies on the JS side to pass the raw IPC file descriptor to `op_node_ipc_pipe()`,…

    Published 21 Mar 2024 · NVD
  8. Medium 4.6

    CVE-2024-27932 · Deno

    Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example[.]com` may be sent to `notexample[.]com`. Anyone who uses…

    Published 21 Mar 2024 · Fixed in 1.40.4 · NVD
  9. High 8.8

    CVE-2024-27923 · Grav

    Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.

    Published 21 Mar 2024 · Fixed in 1.7.43 · NVD
  10. Medium 5.4

    CVE-2024-2536 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Improper Input Validation

    Published 21 Mar 2024 · Fixed in 1.0.215 · WPVulnerability
  11. Medium 5.3

    CVE-2024-28868 · Umbraco CMS

    Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins.

    Published 20 Mar 2024 · Fixed in 10.8.5 · NVD
  12. Medium 4.3

    CVE-2024-2291 · MOVEit Transfer

    In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered.  An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results in user activity not being logged properly.

    Published 20 Mar 2024 · Fixed in 2022.1.12, 2023.0.9, 2023.1.4 · NVD
  13. Medium 6.5

    CVE-2023-46841 · Xen

    Recent x86 CPUs offer functionality named Control-flow Enforcement Technology (CET). A sub-feature of this are Shadow Stacks (CET-SS). CET-SS is a hardware feature designed to protect against Return Oriented Programming attacks. When enabled, traditional stacks holding both data and return addresses are accompanied by so called "shadow stacks", holding little more than return addresses. Shadow…

    Published 20 Mar 2024 · NVD
  14. Medium 4.1

    CVE-2023-46840 · Xen

    Incorrect placement of a preprocessor directive in source code results in logic that doesn't operate as intended when support for HVM guests is compiled out of Xen.

    Published 20 Mar 2024 · NVD
  15. Medium 5.3

    CVE-2023-46839 · Xen

    PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests. Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device…

    Published 20 Mar 2024 · NVD
  16. High 7.5

    CVE-2024-29018 · Docker Engine

    External DNS requests from 'internal' networks could lead to data exfiltration

    Published 19 Mar 2024 · Fixed in 23.0.11, 25.0.5, 26.0.0-rc3 · NVD, Project advisories (GitHub)
  17. Critical 9.0

    CVE-2024-29027 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation…

    Published 19 Mar 2024 · Fixed in 6.5.5 · NVD
  18. High 8.8

    CVE-2024-21677 · Confluence

    This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Score of 8.3, allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that…

    Published 19 Mar 2024 · Fixed in 7.19.20, 8.5.7, 8.8.1 · NVD
  19. Medium 6.1

    CVE-2024-28855 · ZITADEL

    ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/template` instead of the `html/template` package, the Login UI did not sanitize input parameters prior to versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15. An attacker could create a malicious link, where he injected code which would be…

    Published 18 Mar 2024 · Fixed in 2.43.9, 2.44.3, 2.47.4 · NVD
  20. Medium 4.9

    CVE-2024-22412 · ClickHouse

    ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles. In affected versions, the query cache only respects separate users, however this is not documented…

    Published 18 Mar 2024 · Fixed in 23.8.12.13, 23.12.6.19, 24.1.1.2048 · NVD
  21. Critical 9.1

    CVE-2024-21662 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combined with other vulnerabilities to attack the default admin account. This flaw undermines a patch for…

    Published 18 Mar 2024 · Fixed in 2.8.13, 2.9.9, 2.10.4 · NVD
  22. High 7.5

    CVE-2024-21661 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a critical flaw in the application to initiate a Denial of Service (DoS) attack, rendering the application inoperable and affecting all users. The issue arises from unsafe manipulation of an array in a multi-threaded environment. The vulnerability is…

    Published 18 Mar 2024 · Fixed in 2.8.13, 2.9.9, 2.10.4 · NVD
  23. Medium 5.4

    CVE-2024-26125 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  24. Medium 5.4

    CVE-2024-26124 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  25. Medium 5.4

    CVE-2024-26120 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  26. Medium 5.3

    CVE-2024-26119 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to achieve a low-confidentiality impact within the application. Exploitation of this issue does not require user interaction.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  27. Medium 5.4

    CVE-2024-26118 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  28. Medium 5.4

    CVE-2024-26107 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  29. Medium 5.4

    CVE-2024-26106 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  30. Medium 5.4

    CVE-2024-26105 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  31. Medium 5.4

    CVE-2024-26104 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  32. Medium 5.4

    CVE-2024-26103 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  33. Medium 5.4

    CVE-2024-26102 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  34. Medium 5.4

    CVE-2024-26101 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  35. Medium 5.4

    CVE-2024-26096 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  36. Medium 5.4

    CVE-2024-26094 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  37. Medium 5.4

    CVE-2024-26080 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable web pages. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  38. Medium 5.4

    CVE-2024-26073 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  39. Medium 5.4

    CVE-2024-26069 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  40. Medium 5.4

    CVE-2024-26067 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  41. Medium 5.4

    CVE-2024-26065 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  42. Medium 5.4

    CVE-2024-26064 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into a webpage. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script. This could result in arbitrary code execution in the context of the…

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  43. Medium 5.3

    CVE-2024-26063 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by an Information Exposure vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to gain unauthorized access to sensitive information, potentially bypassing security measures. Exploitation of this issue does not require user interaction.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  44. Medium 5.4

    CVE-2024-26062 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  45. Medium 5.4

    CVE-2024-26061 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  46. Medium 5.4

    CVE-2024-26059 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  47. Medium 5.4

    CVE-2024-26056 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  48. Medium 5.4

    CVE-2024-26052 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  49. Medium 5.4

    CVE-2024-26051 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  50. Medium 4.8

    CVE-2024-26050 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.