UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,702
Published in 7 days
770
Critical in 30 days
202
Actively exploited
405

Latest vulnerabilities

32,702 vulnerabilities
  1. Medium 4.8

    CVE-2024-26050 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  2. Medium 5.4

    CVE-2024-26045 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  3. Medium 5.4

    CVE-2024-26044 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into a webpage. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script. This could result in arbitrary code execution in the context of the…

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  4. Medium 5.4

    CVE-2024-26043 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  5. Medium 5.4

    CVE-2024-26042 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable web pages. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script. This could result in arbitrary code execution in the context of…

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  6. Medium 5.4

    CVE-2024-26041 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  7. Medium 5.4

    CVE-2024-26040 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  8. Medium 5.4

    CVE-2024-26038 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  9. Medium 5.4

    CVE-2024-26035 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  10. Medium 5.4

    CVE-2024-26034 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  11. Medium 5.4

    CVE-2024-26033 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  12. Medium 5.4

    CVE-2024-26032 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable web pages. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script. This could result in arbitrary code execution in the context of…

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  13. Medium 5.4

    CVE-2024-26031 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  14. Medium 5.4

    CVE-2024-26030 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  15. Medium 5.4

    CVE-2024-26028 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  16. Critical 9.8

    CVE-2024-21652 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a chain of vulnerabilities, including a Denial of Service (DoS) flaw and in-memory data storage weakness, to effectively bypass the application's brute force login protection. This is a critical security vulnerability that allows attackers to bypass the…

    Published 18 Mar 2024 · Fixed in 2.8.13, 2.9.9, 2.10.4 · NVD
  17. Medium 5.4

    CVE-2024-20768 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  18. Medium 5.4

    CVE-2024-20760 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  19. Medium 6.1

    CVE-2024-27914 · GLPI

    GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS vulnerability. The XSS will only trigger if the administrator navigates through the debug bar. This issue has been patched in version 10.0.13.

    Published 18 Mar 2024 · Fixed in 10.0.13 · NVD
  20. Medium 4.8

    CVE-2024-27104 · GLPI

    GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13.

    Published 18 Mar 2024 · Fixed in 10.0.13 · NVD
  21. Critical 9.6

    CVE-2024-27098 · GLPI

    GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13.

    Published 18 Mar 2024 · Fixed in 10.0.13 · NVD
  22. Medium 6.5

    CVE-2024-27096 · GLPI

    GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. This issue has been patched in version 10.0.13.

    Published 18 Mar 2024 · Fixed in 10.0.13 · NVD
  23. Medium 4.3

    CVE-2024-27937 · GLPI

    GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.

    Published 18 Mar 2024 · Fixed in 10.0.13 · NVD
  24. Medium 6.5

    CVE-2024-27930 · GLPI

    GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13.

    Published 18 Mar 2024 · Fixed in 10.0.13 · NVD
  25. High 7.4Actively exploited

    CVE-2024-20767 · Adobe ColdFusion

    ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.

    Published 18 Mar 2024 · NVD
  26. High 7.5

    CVE-2024-28242 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can learn that secret categories exist when they have backgrounds set. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable to upgrade should temporarily remove category backgrounds.

    Published 15 Mar 2024 · Fixed in 3.2.0, 3.3.0 · NVD
  27. Medium 6.5

    CVE-2024-27100 · Discourse

    Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files weren't enforcing limits on the sizes of the parameters that they accept. This could lead to excessive resource consumption which could render an instance inoperable. A site could be disrupted by either a malicious moderator on the same…

    Published 15 Mar 2024 · Fixed in 3.2.1, 3.3.0 · NVD
  28. Medium 6.5

    CVE-2024-27085 · Discourse

    Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable invites or restrict access to them using the `invite allowed…

    Published 15 Mar 2024 · Fixed in 3.2.0, 3.3.0 · NVD
  29. High 7.5

    CVE-2024-24827 · Discourse

    Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to site as various site settings like `max_image_size_kb`, `max_attachment_size_kb` and…

    Published 15 Mar 2024 · Fixed in 3.2.0, 3.3.0 · NVD
  30. Medium 5.3

    CVE-2024-24748 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public category which has no public subcategories. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 15 Mar 2024 · NVD
  31. High 8.8

    CVE-2024-2450 · Mattermost

    Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switching from email to SAML authentication, allowing an authenticated attacker to take over other user accounts via a crafted switch request under specific conditions.

    Published 15 Mar 2024 · Fixed in 9.2.6, 9.3.2, 9.4.3 · NVD
  32. Medium 4.3

    CVE-2024-2446 · Mattermost

    Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per message, allowing an authenticated attacker to crash the client applications of other users via large, crafted messages.

    Published 15 Mar 2024 · Fixed in 9.2.6, 9.3.2, 9.4.3 · NVD
  33. Medium 6.1

    CVE-2024-2445 · Mattermost

    Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to escape user-controlled outputs when generating HTML pages, which allows an attacker to perform reflected cross-site scripting attacks against the users of the Mattermost server.

    Published 15 Mar 2024 · Fixed in 9.2.6, 9.3.2, 9.4.3 · NVD
  34. Medium 6.5

    CVE-2024-28053 · Mattermost

    Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server.

    Published 15 Mar 2024 · Fixed in 8.1.10 · NVD
  35. High 8.8

    CVE-2024-27756 · GLPI

    GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title.

    Published 15 Mar 2024 · NVD
  36. Medium 6.5

    CVE-2024-25156 · GoAnywhere MFT

    A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients.

    Published 14 Mar 2024 · Fixed in 7.4.2 · NVD
  37. High 8.1

    CVE-2024-28746 · Apache Airflow

    Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access.  Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability

    Published 14 Mar 2024 · Fixed in 2.8.3 · NVD
  38. Medium 5.4

    CVE-2024-1960 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 14 Mar 2024 · Fixed in 2.8.2 · WPVulnerability
  39. Medium 5.4

    CVE-2024-28175 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the `link.argocd.argoproj.io` annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug…

    Published 13 Mar 2024 · Fixed in 2.8.12, 2.9.8, 2.10.3 · NVD
  40. Medium 6.4

    CVE-2023-50726 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git. An improper validation bug allows users who…

    Published 13 Mar 2024 · Fixed in 2.8.12, 2.9.7, 2.10.3 · NVD
  41. Low 2.7

    CVE-2024-2433 · Palo Alto Networks PAN-OS

    An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web interface and completely fill one of the disk partitions with those uploaded files, which prevents the ability to log into the web interface or to download PAN-OS, WildFire, and content images. This issue affects only the web interface of…

    Published 13 Mar 2024 · Fixed in 10.1.12, 10.2.8, 11.0.3 · NVD
  42. High 7.5

    CVE-2024-24549 · Apache Tomcat

    Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18,…

    Published 13 Mar 2024 · Fixed in 8.5.99, 9.0.86, 10.1.19 · NVD
  43. Medium 6.3

    CVE-2024-23672 · Apache Tomcat

    Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Older, EOL versions may also be affected. Users are…

    Published 13 Mar 2024 · Fixed in 8.5.99, 9.0.86, 10.1.19 · NVD
  44. Medium 6.1

    CVE-2024-2247 · JFrog Artifactory

    JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism.

    Published 13 Mar 2024 · NVD
  45. Medium 6.1

    CVE-2024-2242 · Contact Form 7

    Contact Form 7: Cross-site Scripting

    Published 13 Mar 2024 · Fixed in 5.9.2 · NVD, WPVulnerability
  46. Medium 4.3

    CVE-2024-28239 · Directus

    Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL. There's a redirect that is done after successful login via the Auth API GET request to `directus/auth/login/google?redirect=http://malicious-fishing-site.com`. While…

    Published 12 Mar 2024 · Fixed in 10.10.0 · NVD
  47. Low 2.3

    CVE-2024-28238 · Directus

    Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places (e.g., web server logs, browser history). Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to…

    Published 12 Mar 2024 · Fixed in 10.10.0 · NVD
  48. High 8.8

    CVE-2024-26198 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 12 Mar 2024 · NVD
  49. High 7.5

    CVE-2024-26190 · .NET

    Microsoft QUIC Denial of Service Vulnerability

    Published 12 Mar 2024 · Fixed in 7.0.17, 8.0.3 · NVD
  50. High 7.5

    CVE-2024-21392 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 12 Mar 2024 · Fixed in 7.0.17, 8.0.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.