Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 38,123
- Published in 7 days
- 628
- Critical in 30 days
- 389
- Actively exploited
- 420
Latest vulnerabilities
38,123 vulnerabilities- Critical 9.0
CVE-2024-29027 · Parse Server
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation…
Published 19 Mar 2024 · Fixed in 6.5.5 · NVD - High 8.8
CVE-2024-21677 · Confluence
This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Score of 8.3, allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that…
Published 19 Mar 2024 · Fixed in 7.19.20, 8.5.7, 8.8.1 · NVD - Medium 5.4
CVE-2024-26125 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26124 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26120 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.3
CVE-2024-26119 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to achieve a low-confidentiality impact within the application. Exploitation of this issue does not require user interaction.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26118 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26107 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26106 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26105 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26104 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26103 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26102 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26101 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26096 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26094 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26080 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable web pages. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26073 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26069 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26067 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26065 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26064 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into a webpage. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script. This could result in arbitrary code execution in the context of the…
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.3
CVE-2024-26063 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by an Information Exposure vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to gain unauthorized access to sensitive information, potentially bypassing security measures. Exploitation of this issue does not require user interaction.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26062 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26061 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26059 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26056 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26052 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26051 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 4.8
CVE-2024-26050 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26045 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26044 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into a webpage. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script. This could result in arbitrary code execution in the context of the…
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26043 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26042 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable web pages. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script. This could result in arbitrary code execution in the context of…
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26041 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26040 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26038 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26035 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26034 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26033 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26032 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable web pages. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script. This could result in arbitrary code execution in the context of…
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26031 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26030 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-26028 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-20768 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 5.4
CVE-2024-20760 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 18 Mar 2024 · Fixed in 6.5.20.0, 2024.3.0 · NVD - Medium 6.1
CVE-2024-27914 · GLPI
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS vulnerability. The XSS will only trigger if the administrator navigates through the debug bar. This issue has been patched in version 10.0.13.
Published 18 Mar 2024 · Fixed in 10.0.13 · NVD - Medium 4.8
CVE-2024-27104 · GLPI
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13.
Published 18 Mar 2024 · Fixed in 10.0.13 · NVD - Critical 9.6
CVE-2024-27098 · GLPI
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13.
Published 18 Mar 2024 · Fixed in 10.0.13 · NVD - Medium 6.5
CVE-2024-27096 · GLPI
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. This issue has been patched in version 10.0.13.
Published 18 Mar 2024 · Fixed in 10.0.13 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.