UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,083
Published in 7 days
640
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,083 vulnerabilities
  1. Medium 5.4

    CVE-2024-43740 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  2. Medium 5.4

    CVE-2024-43739 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  3. Medium 5.4

    CVE-2024-43738 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim's browser. This issue occurs when data from a malicious source is processed by a web application and subsequently written to the web page without proper sanitization, allowing for the…

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  4. Medium 5.4

    CVE-2024-43737 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  5. Medium 5.4

    CVE-2024-43736 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  6. Medium 5.4

    CVE-2024-43735 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  7. Medium 5.4

    CVE-2024-43734 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  8. Medium 5.4

    CVE-2024-43733 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of…

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  9. Medium 4.6

    CVE-2024-43732 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim's browser. This issue occurs when data from a malicious source is processed by a web application's client-side scripts to update the DOM. Exploitation of this issue requires user interaction,…

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  10. Medium 4.3

    CVE-2024-43731 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  11. Medium 5.4

    CVE-2024-43730 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  12. Medium 6.5

    CVE-2024-43729 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a high impact on integrity. Exploitation of this issue does not require user interaction.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  13. Medium 5.4

    CVE-2024-43728 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  14. Medium 5.4

    CVE-2024-43727 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  15. Medium 5.4

    CVE-2024-43726 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  16. Medium 5.4

    CVE-2024-43725 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  17. Medium 5.4

    CVE-2024-43724 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. Exploitation of…

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  18. Medium 5.4

    CVE-2024-43723 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of…

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  19. Medium 5.4

    CVE-2024-43722 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of…

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  20. Medium 5.4

    CVE-2024-43721 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of…

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  21. Medium 5.4

    CVE-2024-43720 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code in the context of the victim's browser session. By manipulating the DOM environment in the victim's browser, an attacker can inject malicious scripts that are executed by the victim's browser. Exploitation of this issue…

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  22. Medium 5.4

    CVE-2024-43719 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of…

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  23. Medium 5.4

    CVE-2024-43718 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  24. Medium 4.3

    CVE-2024-43717 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality. Exploitation of this issue does not require user interaction.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  25. Medium 4.3

    CVE-2024-43716 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality. Exploitation of this issue does not require user interaction.

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  26. Medium 5.4

    CVE-2024-43715 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of…

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  27. Medium 5.4

    CVE-2024-43714 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of…

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  28. Medium 5.4

    CVE-2024-43713 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of…

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  29. Medium 5.4

    CVE-2024-43712 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim's browser. This issue occurs when data from a user-controllable source is improperly sanitized before being used in the Document Object Model (DOM) of a web page, leading to the execution of…

    Published 10 Dec 2024 · Fixed in 6.5.22.0, 2024.11.0 · NVD
  30. Low

    CVE-2024-54133 · Ruby on Rails

    Possible Content Security Policy bypass in Action Dispatch

    Published 10 Dec 2024 · Fixed in 7.1.5.1, 7.2.2.1, 8.0.0.1 · Project advisories (GitHub)
  31. High 8.8

    CVE-2024-9844 · Ivanti Connect Secure

    Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker to bypass restrictions.

    Published 10 Dec 2024 · Fixed in 22.7 · NVD
  32. High 7.2

    CVE-2024-11634 · Ivanti Connect Secure

    Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution. (Not applicable to 9.1Rx)

    Published 10 Dec 2024 · Fixed in 22.7 · NVD
  33. High 7.2

    CVE-2024-11633 · Ivanti Connect Secure

    Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution

    Published 10 Dec 2024 · Fixed in 22.7 · NVD
  34. High 7.5

    CVE-2024-53246 · Splunk Enterprise

    In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.111, and 9.1.2312.206, an SPL command can potentially disclose sensitive information. The vulnerability requires the exploitation of another vulnerability, such as a Risky Commands Bypass, for successful exploitation.

    Published 10 Dec 2024 · Fixed in 9.1.7, 9.2.4, 9.3.2 · NVD
  35. Medium 4.3

    CVE-2024-53245 · Splunk Enterprise

    In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles, that has a username with the same name as a role with read access to dashboards, could see the dashboard name and the dashboard XML by cloning the dashboard.

    Published 10 Dec 2024 · Fixed in 9.1.7, 9.2.4 · NVD
  36. Medium 5.7

    CVE-2024-53244 · Splunk Enterprise

    In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.2.2406.107, 9.2.2403.109, and 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on “/en-US/app/search/report“…

    Published 10 Dec 2024 · Fixed in 9.1.7, 9.2.4, 9.3.2 · NVD
  37. Critical 9.8

    CVE-2024-53552 · CrushFTP

    CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover.

    Published 10 Dec 2024 · Fixed in 10.8.3, 11.2.3 · NVD
  38. Critical 9.8

    CVE-2024-55638 · Drupal

    Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that…

    Published 10 Dec 2024 · Fixed in 7.102, 10.2.11, 10.3.9 · NVD
  39. Critical 9.8

    CVE-2024-55637 · Drupal

    Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector…

    Published 10 Dec 2024 · Fixed in 10.2.11, 10.3.9, 11.0.8 · NVD
  40. Critical 9.8

    CVE-2024-55636 · Drupal

    Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so called gadget chain presents no direct threat, but is a vector…

    Published 10 Dec 2024 · Fixed in 10.2.11, 10.3.9, 11.0.8 · NVD
  41. Medium 6.1

    CVE-2024-55635 · Drupal

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 7.0 before 7.102.

    Published 10 Dec 2024 · Fixed in 7.102 · NVD
  42. High 8.1

    CVE-2024-55634 · Drupal

    A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

    Published 10 Dec 2024 · Fixed in 10.2.11, 10.3.9, 11.0.8 · NVD
  43. Medium 5.4

    CVE-2024-12393 · Drupal

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

    Published 10 Dec 2024 · Fixed in 10.2.11, 10.3.9, 11.0.8 · NVD
  44. Low

    CVE-2024-55601 · Hugo

    Some attributes not escaped in internal templates

    Published 9 Dec 2024 · Fixed in 0.139.4 · Project advisories (GitHub)
  45. High 7.5

    CVE-2024-54151 · Directus

    Unauthenticated access to WebSocket events and operations

    Published 9 Dec 2024 · Fixed in 11.3.0 · NVD, Project advisories (GitHub)
  46. High 7.6

    CVE-2024-53949 · Apache Superset

    Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API.  issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue.

    Published 9 Dec 2024 · Fixed in 4.1.0 · NVD
  47. Medium 5.3

    CVE-2024-53948 · Apache Superset

    Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue.

    Published 9 Dec 2024 · Fixed in 4.1.0 · NVD
  48. Low 2.3

    CVE-2024-53947 · Apache Superset

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now…

    Published 9 Dec 2024 · Fixed in 4.1.0 · NVD
  49. Medium 6.5

    CVE-2024-11205 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Missing Authorization

    Published 9 Dec 2024 · Fixed in 1.9.2.2 · NVD, WPVulnerability
  50. Medium 4.3

    CVE-2024-12247 · Mattermost

    Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated.

    Published 5 Dec 2024 · Fixed in 9.7.6, 9.8.3, 9.9.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.