UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,121
Published in 7 days
626
Critical in 30 days
389
Actively exploited
420

Latest vulnerabilities

38,121 vulnerabilities
  1. High 8.8

    CVE-2024-21756 · Fortinet FortiSandbox

    A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted requests..

    Published 9 Apr 2024 · Fixed in 4.0.5, 4.2.7, 4.4.4 · NVD
  2. High 8.8

    CVE-2024-21755 · Fortinet FortiSandbox

    A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted requests..

    Published 9 Apr 2024 · Fixed in 4.0.5, 4.2.7, 4.4.4 · NVD
  3. Medium 6.7

    CVE-2023-48784 · Fortinet FortiOS

    A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all versions, 6.4 all versions command line interface may allow a local privileged attacker with super-admin profile and CLI access to execute arbitrary code or commands via specially crafted requests.

    Published 9 Apr 2024 · Fixed in 7.0.16, 7.2.8, 7.4.2 · NVD
  4. Medium 6.7

    CVE-2023-47541 · Fortinet FortiSandbox

    An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4 all versions, FortiSandbox 2.3 all versions,…

    Published 9 Apr 2024 · Fixed in 4.2.7, 4.4.3 · NVD
  5. Medium 6.7

    CVE-2023-47540 · Fortinet FortiSandbox

    An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.0.5 through 3.0.7 allows attacker to execute unauthorized code or commands via CLI.

    Published 9 Apr 2024 · Fixed in 4.2.7, 4.4.3 · NVD
  6. High 8.8

    CVE-2023-41677 · Fortinet FortiProxy, Fortinet FortiOS

    A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.1, FortiProxy 7.2.0 through 7.2.7, FortiProxy 7.0.0 through 7.0.13, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions,…

    Published 9 Apr 2024 · Fixed in 7.2.7, 7.2.8, 7.4.2 · NVD
  7. Medium 6.5

    CVE-2024-28235 · Contao

    Session cookie disclosure in the crawler

    Published 9 Apr 2024 · Fixed in 4.13.40, 5.3.4 · NVD, Project advisories (GitHub)
  8. Medium 5.4

    CVE-2024-28190 · Contao

    Cross-site scripting in the file manager

    Published 9 Apr 2024 · Fixed in 4.13.40, 5.3.4 · NVD, Project advisories (GitHub)
  9. Medium 5.4

    CVE-2024-28191 · Contao

    Insert tag injection via the form generator

    Published 9 Apr 2024 · Fixed in 4.13.40, 5.3.4 · NVD, Project advisories (GitHub)
  10. High 7.1

    CVE-2024-30262 · Contao

    Remember-me tokens are not cleared after a password change

    Published 9 Apr 2024 · Fixed in 4.13.40 · NVD, Project advisories (GitHub)
  11. Medium 4.7

    CVE-2024-28234 · Contao

    Insufficient BBCode sanitization

    Published 9 Apr 2024 · Fixed in 4.13.40, 5.3.4 · NVD, Project advisories (GitHub)
  12. Medium 6.6

    CVE-2024-28224 · Ollama

    Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).

    Published 8 Apr 2024 · Fixed in 0.1.29 · NVD
  13. Medium 5.3

    CVE-2024-31447 · Shopware

    Improper Session Handling in store-api account logout

    Published 8 Apr 2024 · Fixed in 6.5.8.8, 6.6.1.0 · NVD, Project advisories (GitHub)
  14. Medium 6.4

    CVE-2024-2306 · Slider Revolution

    Slider Revolution: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

    Published 8 Apr 2024 · Fixed in 6.7.0 · WPVulnerability
  15. Medium 6.5

    CVE-2024-2447 · Mattermost

    Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.

    Published 5 Apr 2024 · Fixed in 9.3.3, 9.4.4, 9.5.2 · NVD
  16. Low 3.8

    CVE-2024-29221 · Mattermost

    Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the `/api/v4/users/me/teams` endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the "Add Members" permission was explicitly removed from team admins.

    Published 5 Apr 2024 · Fixed in 9.3.3, 9.4.4, 9.5.2 · NVD
  17. Medium 6.5

    CVE-2024-28949 · Mattermost

    Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.

    Published 5 Apr 2024 · Fixed in 9.3.3, 9.4.4, 9.5.2 · NVD
  18. Low 3.1

    CVE-2024-21848 · Mattermost

    Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in the call even if they are removed from the channel

    Published 5 Apr 2024 · Fixed in 8.1.11 · NVD
  19. Medium 4.3

    CVE-2024-31289 · Hello Elementor (WordPress theme)

    Hello Elementor: Cross-Site Request Forgery (CSRF)

    Published 5 Apr 2024 · Fixed in 3.0.1 · WPVulnerability
  20. Medium 4.3

    CVE-2024-22155 · WooCommerce

    WooCommerce: Cross-Site Request Forgery (CSRF)

    Published 5 Apr 2024 · Fixed in 8.6.0 · WPVulnerability
  21. Critical 9.8

    CVE-2024-21894 · Ivanti Connect Secure

    A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this may lead to execution of arbitrary code

    Published 4 Apr 2024 · NVD
  22. High 7.5

    CVE-2024-27316 · Apache HTTP Server

    HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

    Published 4 Apr 2024 · Fixed in 2.4.59 · NVD
  23. Medium 6.3

    CVE-2024-24795 · Apache HTTP Server

    HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.

    Published 4 Apr 2024 · Fixed in 2.4.59 · NVD
  24. High 8.2

    CVE-2024-22053 · Ivanti Connect Secure

    A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack or in certain conditions read contents from memory.

    Published 4 Apr 2024 · NVD
  25. High 7.5

    CVE-2024-22052 · Ivanti Connect Secure

    A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack

    Published 4 Apr 2024 · NVD
  26. Medium 5.3

    CVE-2024-22023 · Ivanti Connect Secure

    An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.

    Published 4 Apr 2024 · NVD
  27. High 7.3

    CVE-2023-38709 · Apache HTTP Server

    Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.

    Published 4 Apr 2024 · Fixed in 2.4.59 · NVD
  28. Medium 6.8

    CVE-2024-2660 · HashiCorp Vault

    Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.

    Published 4 Apr 2024 · Fixed in 1.14.11, 1.15.7, 1.16.0 · NVD
  29. High 7.5

    CVE-2024-27268 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 284574.

    Published 4 Apr 2024 · Fixed in 24.0.0.5 · NVD
  30. Critical 9.8

    CVE-2024-3116 · pgAdmin

    pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.

    Published 4 Apr 2024 · NVD
  31. High 7.5

    CVE-2024-30255 · Envoy

    HTTP/2: CPU exhaustion due to CONTINUATION frame flood

    Published 4 Apr 2024 · Fixed in 1.27.4, 1.28.2, 1.29.3 · NVD, Project advisories (GitHub)
  32. High 7.5

    CVE-2024-27919 · Envoy

    HTTP/2: memory exhaustion due to CONTINUATION frame flood

    Published 4 Apr 2024 · NVD, Project advisories (GitHub)
  33. Medium 5.4

    CVE-2024-20800 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable web pages. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script. This could result in arbitrary code execution…

    Published 4 Apr 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  34. Medium 5.4

    CVE-2024-2946 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 4 Apr 2024 · Fixed in 2.8.5 · WPVulnerability
  35. Critical 9.8

    CVE-2024-31211 · WordPress

    Remote Code Execution in `WP_HTML_Token`

    Published 3 Apr 2024 · Fixed in 6.4.2 · NVD, WordPress
  36. High 8.8

    CVE-2024-31210 · WordPress

    PHP file upload bypass via Plugin installer

    Published 3 Apr 2024 · Fixed in 6.2.4, 6.3.3, 6.4.3 · NVD, WordPress
  37. Medium 4.8

    CVE-2024-3181 · Concrete CMS

    Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. Prior to the fix, stored XSS could be executed by an administrator changing a filter to which a rogue administrator had previously added malicious code. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of…

    Published 3 Apr 2024 · Fixed in 8.5.16, 9.2.8 · NVD
  38. Medium 4.8

    CVE-2024-3180 · Concrete CMS

    Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file. Stored XSS could be caused by a rogue administrator adding malicious code to the link-text field when creating a block of type file. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L…

    Published 3 Apr 2024 · Fixed in 8.5.16, 9.2.8 · NVD
  39. Medium 4.8

    CVE-2024-3179 · Concrete CMS

    Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. Prior to the fix, a rogue administrator could insert malicious code in the custom class field due to insufficient validation of administrator provided data. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of…

    Published 3 Apr 2024 · Fixed in 8.5.16, 9.2.8 · NVD
  40. Medium 4.8

    CVE-2024-3178 · Concrete CMS

    Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter. Prior to the fix, a rogue administrator could add malicious code in the file manager because of insufficient validation of administrator provided data. All administrators have access to the File Manager and hence could create a search filter with the…

    Published 3 Apr 2024 · Fixed in 8.5.16, 9.2.8 · NVD
  41. Medium 4.8

    CVE-2024-2753 · Concrete CMS

    Concrete CMS version 9 before 9.2.8 and previous versions prior to 8.5.16 is vulnerable to Stored XSS on the calendar color settings screen since Information input by the user is output without escaping. A rogue administrator could inject malicious javascript into the Calendar Color Settings screen which might be executed when users visit the affected page. The Concrete CMS security team gave…

    Published 3 Apr 2024 · Fixed in 8.5.16, 9.2.8 · NVD
  42. High 8.8

    CVE-2024-29477 · Dolibarr ERP CRM

    Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.

    Published 3 Apr 2024 · Fixed in 19.0.1 · NVD
  43. Medium 6.1

    CVE-2024-24506 · LimeSurvey

    Cross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitrary code via the Administrator email address parameter in the General Setting function.

    Published 3 Apr 2024 · NVD
  44. Medium 6.4

    CVE-2024-2868 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 3 Apr 2024 · Fixed in 2.8.4 · WPVulnerability
  45. Medium 6.5

    CVE-2023-50313 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274812.

    Published 2 Apr 2024 · NVD
  46. Medium 5.4

    CVE-2024-20799 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 2 Apr 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD
  47. High 7.5

    CVE-2024-22353 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 280400.

    Published 31 Mar 2024 · NVD
  48. Medium 5.3

    CVE-2024-23449 · Elasticsearch

    An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

    Published 29 Mar 2024 · Fixed in 8.11.1 · NVD
  49. Medium 6.5

    CVE-2024-29893 · Argo CD

    Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server

    Published 28 Mar 2024 · Fixed in 2.8.14, 2.9.10, 2.10.5 · NVD, Project advisories (GitHub)
  50. Medium 4.9

    CVE-2024-31140 · TeamCity

    In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools

    Published 28 Mar 2024 · Fixed in 2024.03 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.