Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 38,106
- Published in 7 days
- 651
- Critical in 30 days
- 388
- Actively exploited
- 420
Latest vulnerabilities
38,106 vulnerabilities- Low 3.5
CVE-2024-26127 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and affect the integrity of the page. Exploitation of this issue requires user interaction.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Low 3.5
CVE-2024-26126 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and affect the integrity of the page. Exploitation of this issue requires user interaction.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26123 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26121 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26117 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26116 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26115 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26114 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26113 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26111 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26110 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26095 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26093 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26092 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26091 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a victim to click on a specially crafted link or to…
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26090 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26089 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue requires user interaction, as the victim needs to visit a web page with a maliciously crafted script.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26088 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26086 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26085 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26083 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26082 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26081 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26078 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26077 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26075 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26074 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26072 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a…
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26071 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26070 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26068 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26066 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26060 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26058 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26057 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit…
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26055 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a…
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26054 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26053 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a form…
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 4.8
CVE-2024-26049 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26039 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a form…
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26037 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit…
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-26036 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Critical 9.8
CVE-2024-26029 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain disclose information. Exploitation of this issue does not require user interaction.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-20784 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 5.4
CVE-2024-20769 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD - Medium 4.4
CVE-2024-4201 · GitLab
A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting from 16.11 before 16.111.4, all versions starting from 17.0 before 17.0.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances.
Published 12 Jun 2024 · Fixed in 16.10.7, 16.111.4, 17.0.2 · NVD - Medium 6.5
CVE-2024-1963 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.4 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's Asana integration allowed an attacker to potentially cause a regular expression denial of service by sending specially crafted requests.
Published 12 Jun 2024 · Fixed in 16.10.7, 16.11.4, 17.0.2 · NVD - Medium 6.5
CVE-2024-1736 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's CI/CD pipeline editor could allow for denial of service attacks through maliciously crafted configuration files.
Published 12 Jun 2024 · Fixed in 16.10.7, 16.11.4, 17.0.2 · NVD - Medium 6.5
CVE-2024-1495 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.1 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. It was possible for an attacker to cause a denial of service using maliciously crafted file.
Published 12 Jun 2024 · Fixed in 16.10.7, 16.11.4, 17.0.2 · NVD - High 7.5
CVE-2024-5798 · HashiCorp Vault
Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0,…
Published 12 Jun 2024 · Fixed in 1.15.9, 1.16.3 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.