UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,121
Published in 7 days
626
Critical in 30 days
389
Actively exploited
420

Latest vulnerabilities

38,121 vulnerabilities
  1. High 8.1

    CVE-2024-31139 · TeamCity

    In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector

    Published 28 Mar 2024 · Fixed in 2024.03 · NVD
  2. Medium 5.4

    CVE-2024-31138 · TeamCity

    In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings

    Published 28 Mar 2024 · Fixed in 2024.03 · NVD
  3. Medium 6.1

    CVE-2024-31137 · TeamCity

    In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration

    Published 28 Mar 2024 · Fixed in 2024.03 · NVD
  4. High 7.4

    CVE-2024-31136 · TeamCity

    In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter

    Published 28 Mar 2024 · Fixed in 2024.03 · NVD
  5. Medium 6.1

    CVE-2024-31135 · TeamCity

    In JetBrains TeamCity before 2024.03 open redirect was possible on the login page

    Published 28 Mar 2024 · Fixed in 2024.03 · NVD
  6. Medium 6.5

    CVE-2024-31134 · TeamCity

    In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled

    Published 28 Mar 2024 · Fixed in 2024.03 · NVD
  7. Medium 6.5

    CVE-2024-2818 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. It was possible for an attacker to cause a denial of service using malicious crafted description parameter for labels.

    Published 28 Mar 2024 · Fixed in 16.8.5, 16.9.3 · NVD
  8. Medium 5.4

    CVE-2023-6371 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. A wiki page with a crafted payload may lead to a Stored XSS, allowing attackers to perform arbitrary actions on behalf of victims.

    Published 28 Mar 2024 · Fixed in 16.8.5, 16.9.3 · NVD
  9. Medium 6.5

    CVE-2024-23451 · Elasticsearch

    Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0. This allows a malicious user with a valid API key for a remote cluster configured to use the new Remote Cluster Security to read arbitrary documents from any index on the remote cluster, and only if they use the Elasticsearch…

    Published 27 Mar 2024 · Fixed in 8.13.0 · NVD
  10. High 8.1

    CVE-2024-29946 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phish the victim by tricking them into initiating a request within their browser.

    Published 27 Mar 2024 · Fixed in 9.0.9, 9.1.4, 9.2.1 · NVD
  11. High 7.2

    CVE-2024-29945 · Splunk Enterprise

    In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the software potentially exposes authentication tokens during the token validation process. This exposure happens when either Splunk Enterprise runs in debug mode or the JsonWebToken component has been configured to log its activity at the DEBUG logging level.

    Published 27 Mar 2024 · Fixed in 9.0.9, 9.1.4, 9.2.1 · NVD
  12. High 7.5

    CVE-2024-23450 · Elasticsearch

    A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

    Published 27 Mar 2024 · Fixed in 7.17.19, 8.13.0 · NVD
  13. High 8.7

    CVE-2024-29891 · ZITADEL

    Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass

    Published 27 Mar 2024 · Fixed in 2.46.5, 2.47.8, 2.48.3 · NVD, Project advisories (GitHub)
  14. Medium 4.9

    CVE-2024-29892 · ZITADEL

    Actions can overload reserved claims

    Published 27 Mar 2024 · Fixed in 2.46.5, 2.47.8, 2.48.3 · NVD, Project advisories (GitHub)
  15. Medium 6.1

    CVE-2024-27270 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in a specially crafted URI. IBM X-Force ID: 284576.

    Published 27 Mar 2024 · Fixed in 24.0.0.4 · NVD
  16. Medium 6.5

    CVE-2024-2466 · curl

    libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

    Published 27 Mar 2024 · Fixed in 8.7.0 · NVD
  17. High 8.6

    CVE-2024-2398 · curl

    When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by…

    Published 27 Mar 2024 · Fixed in 8.7.0 · NVD
  18. Medium 6.3

    CVE-2024-2379 · curl

    libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

    Published 27 Mar 2024 · NVD
  19. Low 3.5

    CVE-2024-2004 · curl

    When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of…

    Published 27 Mar 2024 · Fixed in 8.7.0 · NVD
  20. Medium 5.3

    CVE-2024-29735 · Apache Airflow

    Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3. Airflow's local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix group of the folders. In the case Airflow is run with the root user (not recommended) it added group…

    Published 26 Mar 2024 · NVD
  21. Medium 6.5

    CVE-2024-29197 · Pimcore

    Pimcore Preview Documents are not restricted to logged in users anymore

    Published 26 Mar 2024 · Fixed in 11.1.6.1, 11.2.2 · NVD, Project advisories (GitHub)
  22. Medium 5.4

    CVE-2024-2781 · Elementor Pro (WordPress plugin)

    Elementor Pro: Cross-site Scripting

    Published 26 Mar 2024 · Fixed in 3.20.2 · WPVulnerability
  23. Medium 5.4

    CVE-2024-2121 · Elementor Pro (WordPress plugin)

    Elementor Pro: Cross-site Scripting

    Published 26 Mar 2024 · Fixed in 3.20.2 · WPVulnerability
  24. Medium 5.4

    CVE-2024-2120 · Elementor, Elementor Pro (WordPress plugin)

    Elementor Pro: Cross-site Scripting

    Published 26 Mar 2024 · Fixed in 3.20.2 · NVD, WPVulnerability
  25. Medium 5.4

    CVE-2024-2117 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 26 Mar 2024 · Fixed in 3.20.3 · NVD, WPVulnerability
  26. Medium 5.4

    CVE-2024-1521 · Elementor Pro (WordPress plugin)

    Elementor Pro: Cross-site Scripting

    Published 26 Mar 2024 · Fixed in 3.20.2 · WPVulnerability
  27. Medium 5.4

    CVE-2024-1364 · Elementor Pro (WordPress plugin)

    Elementor Pro: Cross-site Scripting

    Published 26 Mar 2024 · Fixed in 3.20.2 · WPVulnerability
  28. Medium 6.1

    CVE-2024-29041 · Express

    Express.js Open Redirect in malformed URLs

    Published 25 Mar 2024 · Fixed in 4.19.2, 5.0.0-beta.3 · Project advisories (GitHub)
  29. Medium 4.9

    CVE-2024-1310 · WooCommerce

    WooCommerce: Improper Access Control

    Published 25 Mar 2024 · Fixed in 8.6 · WPVulnerability
  30. Medium 5.4

    CVE-2024-28593 · Moodle

    The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's Using_Chat page says "If you know some HTML code, you can use it in your text to do things like insert images, play sounds or create different coloured and sized text." This page also says "Chat is due to be…

    Published 22 Mar 2024 · NVD
  31. Medium 5.4

    CVE-2024-2165 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Improper Input Validation

    Published 22 Mar 2024 · Fixed in 7.6 · WPVulnerability
  32. High 8.8

    CVE-2024-28119 · Grav

    Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs…

    Published 21 Mar 2024 · Fixed in 1.7.45 · NVD
  33. High 8.8

    CVE-2024-28118 · Grav

    Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a previous SSTI mitigation. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the…

    Published 21 Mar 2024 · Fixed in 1.7.45 · NVD
  34. High 8.8

    CVE-2024-28117 · Grav

    Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twig_array_map, allowing attackers to bypass the validation and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any…

    Published 21 Mar 2024 · Fixed in 1.7.45 · NVD
  35. High 8.8

    CVE-2024-28116 · Grav

    Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. Version 1.7.45 contains a patch for this issue.

    Published 21 Mar 2024 · Fixed in 1.7.45 · NVD
  36. High 8.8

    CVE-2024-27921 · Grav

    Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw poses severe risks, that can allow attackers to inject arbitrary code on the server, undermine integrity…

    Published 21 Mar 2024 · Fixed in 1.7.45 · NVD
  37. Medium 6.1

    CVE-2024-29374 · Moodle

    A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.

    Published 21 Mar 2024 · NVD
  38. High 7.8

    CVE-2024-29880 · TeamCity

    In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process

    Published 21 Mar 2024 · Fixed in 2023.11 · NVD
  39. High 8.8

    CVE-2024-27923 · Grav

    Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.

    Published 21 Mar 2024 · Fixed in 1.7.43 · NVD
  40. Medium 5.4

    CVE-2024-2536 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Improper Input Validation

    Published 21 Mar 2024 · Fixed in 1.0.215 · WPVulnerability
  41. Medium 4.3

    CVE-2024-2291 · MOVEit Transfer

    In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered.  An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results in user activity not being logged properly.

    Published 20 Mar 2024 · Fixed in 2022.1.12, 2023.0.9, 2023.1.4 · NVD
  42. Medium 6.5

    CVE-2023-46841 · Xen

    Recent x86 CPUs offer functionality named Control-flow Enforcement Technology (CET). A sub-feature of this are Shadow Stacks (CET-SS). CET-SS is a hardware feature designed to protect against Return Oriented Programming attacks. When enabled, traditional stacks holding both data and return addresses are accompanied by so called "shadow stacks", holding little more than return addresses. Shadow…

    Published 20 Mar 2024 · NVD
  43. Medium 4.1

    CVE-2023-46840 · Xen

    Incorrect placement of a preprocessor directive in source code results in logic that doesn't operate as intended when support for HVM guests is compiled out of Xen.

    Published 20 Mar 2024 · NVD
  44. Medium 5.3

    CVE-2023-46839 · Xen

    PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests. Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device…

    Published 20 Mar 2024 · NVD
  45. Medium 5.3

    CVE-2024-28868 · Umbraco CMS

    Possible user enumeration

    Published 20 Mar 2024 · Fixed in 10.8.5 · NVD, Project advisories (GitHub)
  46. High 7.5

    CVE-2024-24813 · Frappe Framework

    SQL Injection from reporting logic

    Published 20 Mar 2024 · Fixed in 14.64.0 · NVD, Project advisories (GitHub)
  47. Medium 6.5

    CVE-2024-27105 · Frappe Framework

    File Permissions can by bypassed using certain endpoints

    Published 20 Mar 2024 · Fixed in 14.66.3, 15.16.0 · NVD, Project advisories (GitHub)
  48. High 7.5

    CVE-2024-29018 · Docker Engine

    External DNS requests from 'internal' networks could lead to data exfiltration

    Published 19 Mar 2024 · Fixed in 23.0.11, 25.0.5, 26.0.0-rc3 · NVD, Project advisories (GitHub)
  49. Critical 9.0

    CVE-2024-29027 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation…

    Published 19 Mar 2024 · Fixed in 6.5.5 · NVD
  50. High 8.8

    CVE-2024-21677 · Confluence

    This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Score of 8.3, allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that…

    Published 19 Mar 2024 · Fixed in 7.19.20, 8.5.7, 8.8.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.