UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,717
Published in 7 days
770
Critical in 30 days
202
Actively exploited
405

Latest vulnerabilities

32,717 vulnerabilities
  1. High 8.8

    CVE-2024-27756 · GLPI

    GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title.

    Published 15 Mar 2024 · NVD
  2. Medium 6.5

    CVE-2024-25156 · GoAnywhere MFT

    A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients.

    Published 14 Mar 2024 · Fixed in 7.4.2 · NVD
  3. High 8.1

    CVE-2024-28746 · Apache Airflow

    Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access.  Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability

    Published 14 Mar 2024 · Fixed in 2.8.3 · NVD
  4. Medium 5.4

    CVE-2024-1960 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 14 Mar 2024 · Fixed in 2.8.2 · WPVulnerability
  5. Medium 5.4

    CVE-2024-28175 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the `link.argocd.argoproj.io` annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug…

    Published 13 Mar 2024 · Fixed in 2.8.12, 2.9.8, 2.10.3 · NVD
  6. Medium 6.4

    CVE-2023-50726 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git. An improper validation bug allows users who…

    Published 13 Mar 2024 · Fixed in 2.8.12, 2.9.7, 2.10.3 · NVD
  7. Low 2.7

    CVE-2024-2433 · Palo Alto Networks PAN-OS

    An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web interface and completely fill one of the disk partitions with those uploaded files, which prevents the ability to log into the web interface or to download PAN-OS, WildFire, and content images. This issue affects only the web interface of…

    Published 13 Mar 2024 · Fixed in 10.1.12, 10.2.8, 11.0.3 · NVD
  8. High 7.5

    CVE-2024-24549 · Apache Tomcat

    Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18,…

    Published 13 Mar 2024 · Fixed in 8.5.99, 9.0.86, 10.1.19 · NVD
  9. Medium 6.3

    CVE-2024-23672 · Apache Tomcat

    Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Older, EOL versions may also be affected. Users are…

    Published 13 Mar 2024 · Fixed in 8.5.99, 9.0.86, 10.1.19 · NVD
  10. Medium 6.1

    CVE-2024-2247 · JFrog Artifactory

    JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism.

    Published 13 Mar 2024 · NVD
  11. Medium 6.1

    CVE-2024-2242 · Contact Form 7

    Contact Form 7: Cross-site Scripting

    Published 13 Mar 2024 · Fixed in 5.9.2 · NVD, WPVulnerability
  12. Medium 4.3

    CVE-2024-28239 · Directus

    Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL. There's a redirect that is done after successful login via the Auth API GET request to `directus/auth/login/google?redirect=http://malicious-fishing-site.com`. While…

    Published 12 Mar 2024 · Fixed in 10.10.0 · NVD
  13. Low 2.3

    CVE-2024-28238 · Directus

    Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places (e.g., web server logs, browser history). Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to…

    Published 12 Mar 2024 · Fixed in 10.10.0 · NVD
  14. High 8.8

    CVE-2024-26198 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 12 Mar 2024 · NVD
  15. High 7.5

    CVE-2024-26190 · .NET

    Microsoft QUIC Denial of Service Vulnerability

    Published 12 Mar 2024 · Fixed in 7.0.17, 8.0.3 · NVD
  16. High 7.5

    CVE-2024-21392 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 12 Mar 2024 · Fixed in 7.0.17, 8.0.3 · NVD
  17. Medium 4.3

    CVE-2024-23112 · Fortinet FortiProxy, Fortinet FortiOS

    An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticated attacker to gain access to another user’s bookmark via URL manipulation.

    Published 12 Mar 2024 · NVD
  18. High 8.8

    CVE-2023-46717 · Fortinet FortiOS

    An improper authentication vulnerability [CWE-287] in FortiOS versions 7.4.1 and below, versions 7.2.6 and below, and versions 7.0.12 and below when configured with FortiAuthenticator in HA may allow a readonly user to gain read-write access via successive login attempts.

    Published 12 Mar 2024 · Fixed in 7.0.13, 7.2.7, 7.4.2 · NVD
  19. High 8.1

    CVE-2023-42790 · Fortinet FortiProxy, Fortinet FortiOS

    A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiProxy 7.4.0, FortiProxy 7.2.0 through 7.2.6, FortiProxy 7.0.0 through 7.0.12, FortiProxy 2.0.0 through 2.0.13, FortiSASE 23.2.b allows attacker to execute unauthorized code or commands via…

    Published 12 Mar 2024 · NVD
  20. Critical 9.8

    CVE-2023-42789 · Fortinet FortiProxy, Fortinet FortiOS

    A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiProxy 7.4.0, FortiProxy 7.2.0 through 7.2.6, FortiProxy 7.0.0 through 7.0.12, FortiProxy 2.0.0 through 2.0.13, FortiSASE 23.2.b allows attacker to execute unauthorized code or commands via…

    Published 12 Mar 2024 · NVD
  21. Medium 4.3

    CVE-2024-2395 · Bulgarisation For Woocommerce (WordPress plugin)

    Bulgarisation for WooCommerce: Cross-Site Request Forgery (CSRF)

    Published 12 Mar 2024 · Fixed in 3.0.15 · WPVulnerability
  22. Medium 5.4

    CVE-2024-1894 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Cross-site Scripting

    Published 12 Mar 2024 · Fixed in 1.5.7 · WPVulnerability
  23. High 7.5

    CVE-2024-0683 · Bulgarisation For Woocommerce (WordPress plugin)

    Bulgarisation for WooCommerce: Missing Authorization

    Published 12 Mar 2024 · Fixed in 3.0.15 · WPVulnerability
  24. High 7.5

    CVE-2024-28197 · ZITADEL

    Zitadel is an open source identity management system. Zitadel uses a cookie to identify the user agent (browser) and its user sessions. Although the cookie was handled according to best practices, it was accessible on subdomains of the ZITADEL instance. An attacker could take advantage of this and provide a malicious link hosted on the subdomain to the user to gain access to the victim’s account…

    Published 11 Mar 2024 · Fixed in 2.44.3 · NVD
  25. High 7.5

    CVE-2024-28757 · Expat

    libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

    Published 10 Mar 2024 · Fixed in 2.6.2 · NVD
  26. Critical 9.9

    CVE-2024-2044 · pgAdmin

    pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.

    Published 7 Mar 2024 · Fixed in 8.4 · NVD
  27. High 8.8

    CVE-2024-1442 · Grafana

    A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

    Published 7 Mar 2024 · Fixed in 10.1.8, 10.2.5, 10.3.4 · NVD
  28. Critical 9.8

    CVE-2024-1351 · MongoDB

    Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including…

    Published 7 Mar 2024 · Fixed in 5.0.25, 6.0.14, 7.0.6 · NVD
  29. High 8.8

    CVE-2023-42661 · JFrog Artifactory

    JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validation of artifacts.

    Published 7 Mar 2024 · Fixed in 7.76.2 · NVD
  30. High 7.5

    CVE-2023-42509 · JFrog Artifactory

    JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration initialization steps may lead to exposure of sensitive data.

    Published 7 Mar 2024 · Fixed in 7.77.0 · NVD
  31. High 7.5

    CVE-2024-1931 · Unbound

    NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can lead to an infinite loop. Unbound 1.18.0 introduced a feature that removes EDE records from responses with size higher than the client's advertised buffer size. Before removing all the EDE records however, it would try to see if trimming…

    Published 7 Mar 2024 · Fixed in 1.19.2 · NVD
  32. Medium 6.5

    CVE-2023-42662 · JFrog Artifactory

    JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.

    Published 7 Mar 2024 · Fixed in 7.63.18, 7.68.19, 7.71.8 · NVD
  33. High 8.1

    CVE-2024-1299 · GitLab

    A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of `manage_group_access_tokens` to rotate group access tokens with owner privileges.

    Published 7 Mar 2024 · Fixed in 16.8.4, 16.9.2 · NVD
  34. High 8.0

    CVE-2024-0199 · GitLab

    An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An attacker could bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions.

    Published 7 Mar 2024 · Fixed in 16.7.7, 16.8.4, 16.9.2 · NVD
  35. High 7.5

    CVE-2024-27917 · Shopware

    Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. Since Shopware 6.5.8.0, the 404 pages are cached to improve the performance of 404 pages. So the cached Response which contains a Session Cookie when the Browser accessing the 404 page, has no cookies yet. The Symfony Session Handler is in…

    Published 6 Mar 2024 · Fixed in 6.5.8.7 · NVD
  36. High 7.5

    CVE-2024-25111 · Squid

    Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this…

    Published 6 Mar 2024 · Fixed in 6.8 · NVD
  37. Medium 5.8

    CVE-2024-28174 · TeamCity

    In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly

    Published 6 Mar 2024 · Fixed in 2023.11.4 · NVD
  38. Medium 4.3

    CVE-2024-28173 · TeamCity

    In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed

    Published 6 Mar 2024 · Fixed in 2023.11.4 · NVD
  39. Medium 4.8

    CVE-2024-2179 · Concrete CMS

    Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Name field which might be executed when users visit the affected page. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 2.2…

    Published 5 Mar 2024 · Fixed in 9.2.7 · NVD
  40. High 7.1

    CVE-2024-22255 · VMware ESXi

    VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process.

    Published 5 Mar 2024 · NVD
  41. High 8.2

    CVE-2024-22254 · VMware ESXi

    VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox.

    Published 5 Mar 2024 · NVD
  42. Medium 6.7

    CVE-2024-22253 · VMware ESXi

    VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code…

    Published 5 Mar 2024 · NVD
  43. Medium 6.7

    CVE-2024-22252 · VMware ESXi

    VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code…

    Published 5 Mar 2024 · NVD
  44. Medium 6.5

    CVE-2024-27931 · Deno

    Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Insufficient validation of parameters in `Deno.makeTemp*` APIs would allow for creation of files outside of the allowed directories. This may allow the user to overwrite important files on the system that may affect other systems. A user may provide a prefix or suffix to a `Deno.makeTemp*` API containing path…

    Published 5 Mar 2024 · Fixed in 1.41.1 · NVD
  45. High 7.2

    CVE-2024-22188 · TYPO3

    TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, and 13.0.1.

    Published 5 Mar 2024 · Fixed in 10.4.43, 11.5.35, 12.4.11 · NVD
  46. Critical 9.8

    CVE-2024-2048 · HashiCorp Vault, OpenBao

    Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10.

    Published 4 Mar 2024 · Fixed in 1.14.10, 1.15.5, 2.0.0 · NVD
  47. High 7.3Actively exploited

    CVE-2024-27199 · TeamCity

    In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

    Published 4 Mar 2024 · Fixed in 2023.11.4 · NVD
  48. Critical 9.8Actively exploited

    CVE-2024-27198 · TeamCity

    In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

    Published 4 Mar 2024 · Fixed in 2023.11.4 · NVD
  49. Medium 5.3

    CVE-2024-20328 · ClamAV

    A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the…

    Published 1 Mar 2024 · Fixed in 1.0.5, 1.2.2 · NVD
  50. Critical 10.0

    CVE-2024-27298 · Parse Server

    parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.

    Published 1 Mar 2024 · Fixed in 6.5.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.