UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,123
Published in 7 days
628
Critical in 30 days
389
Actively exploited
420

Latest vulnerabilities

38,123 vulnerabilities
  1. Medium 4.3

    CVE-2024-27937 · GLPI

    GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.

    Published 18 Mar 2024 · Fixed in 10.0.13 · NVD
  2. Medium 6.5

    CVE-2024-27930 · GLPI

    GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13.

    Published 18 Mar 2024 · Fixed in 10.0.13 · NVD
  3. High 7.4Actively exploited

    CVE-2024-20767 · Adobe ColdFusion

    ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.

    Published 18 Mar 2024 · NVD
  4. High 7.5

    CVE-2024-21661 · Argo CD

    Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment

    Published 18 Mar 2024 · Fixed in 2.8.13, 2.9.9, 2.10.4 · NVD, Project advisories (GitHub)
  5. Critical 9.1

    CVE-2024-21662 · Argo CD

    Bypassing Rate Limit and Brute Force Protection Using Cache Overflow

    Published 18 Mar 2024 · Fixed in 2.8.13, 2.9.9, 2.10.4 · NVD, Project advisories (GitHub)
  6. Critical 9.8

    CVE-2024-21652 · Argo CD

    Bypassing Brute Force Protection via Application Crash and In-Memory Data Loss

    Published 18 Mar 2024 · Fixed in 2.8.13, 2.9.9, 2.10.4 · NVD, Project advisories (GitHub)
  7. Medium 4.9

    CVE-2024-22412 · ClickHouse

    Role-based Access Control is bypassed when query caching is enabled.

    Published 18 Mar 2024 · Fixed in 23.12.6.19, 24.0.2.54535, 24.1.1.2048 · NVD, Project advisories (GitHub)
  8. Medium 6.1

    CVE-2024-28855 · ZITADEL

    Improper HTML sanitization

    Published 18 Mar 2024 · Fixed in 2.43.9, 2.44.3, 2.47.4 · NVD, Project advisories (GitHub)
  9. High 7.5

    CVE-2024-28242 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can learn that secret categories exist when they have backgrounds set. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable to upgrade should temporarily remove category backgrounds.

    Published 15 Mar 2024 · Fixed in 3.2.0, 3.3.0 · NVD
  10. Medium 6.5

    CVE-2024-27100 · Discourse

    Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files weren't enforcing limits on the sizes of the parameters that they accept. This could lead to excessive resource consumption which could render an instance inoperable. A site could be disrupted by either a malicious moderator on the same…

    Published 15 Mar 2024 · Fixed in 3.2.1, 3.3.0 · NVD
  11. Medium 6.5

    CVE-2024-27085 · Discourse

    Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable invites or restrict access to them using the `invite allowed…

    Published 15 Mar 2024 · Fixed in 3.2.0, 3.3.0 · NVD
  12. High 7.5

    CVE-2024-24827 · Discourse

    Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to site as various site settings like `max_image_size_kb`, `max_attachment_size_kb` and…

    Published 15 Mar 2024 · Fixed in 3.2.0, 3.3.0 · NVD
  13. Medium 5.3

    CVE-2024-24748 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public category which has no public subcategories. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 15 Mar 2024 · NVD
  14. High 8.8

    CVE-2024-2450 · Mattermost

    Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switching from email to SAML authentication, allowing an authenticated attacker to take over other user accounts via a crafted switch request under specific conditions.

    Published 15 Mar 2024 · Fixed in 9.2.6, 9.3.2, 9.4.3 · NVD
  15. Medium 4.3

    CVE-2024-2446 · Mattermost

    Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentions processed per message, allowing an authenticated attacker to crash the client applications of other users via large, crafted messages.

    Published 15 Mar 2024 · Fixed in 9.2.6, 9.3.2, 9.4.3 · NVD
  16. Medium 6.1

    CVE-2024-2445 · Mattermost

    Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to escape user-controlled outputs when generating HTML pages, which allows an attacker to perform reflected cross-site scripting attacks against the users of the Mattermost server.

    Published 15 Mar 2024 · Fixed in 9.2.6, 9.3.2, 9.4.3 · NVD
  17. Medium 6.5

    CVE-2024-28053 · Mattermost

    Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server.

    Published 15 Mar 2024 · Fixed in 8.1.10 · NVD
  18. High 8.8

    CVE-2024-27756 · GLPI

    GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title.

    Published 15 Mar 2024 · NVD
  19. Medium 6.5

    CVE-2024-25156 · GoAnywhere MFT

    A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients.

    Published 14 Mar 2024 · Fixed in 7.4.2 · NVD
  20. High 8.1

    CVE-2024-28746 · Apache Airflow

    Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access.  Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability

    Published 14 Mar 2024 · Fixed in 2.8.3 · NVD
  21. Medium 5.4

    CVE-2024-1960 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 14 Mar 2024 · Fixed in 2.8.2 · WPVulnerability
  22. Medium 6.4

    CVE-2023-50726 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. "Local sync" is an Argo CD feature that allows developers to temporarily override an Application's manifests with locally-defined manifests. Use of the feature should generally be limited to highly-trusted users, since it allows the user to bypass any merge protections in git. An improper validation bug allows users who…

    Published 13 Mar 2024 · Fixed in 2.8.12, 2.9.7, 2.10.3 · NVD
  23. Medium 5.4

    CVE-2024-28175 · Argo CD

    Cross-site scripting on application summary component

    Published 13 Mar 2024 · Fixed in 2.8.12, 2.9.8, 2.10.3 · NVD, Project advisories (GitHub)
  24. Low 2.7

    CVE-2024-2433 · Palo Alto Networks PAN-OS

    An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web interface and completely fill one of the disk partitions with those uploaded files, which prevents the ability to log into the web interface or to download PAN-OS, WildFire, and content images. This issue affects only the web interface of…

    Published 13 Mar 2024 · Fixed in 10.1.12, 10.2.8, 11.0.3 · NVD
  25. High 7.5

    CVE-2024-24549 · Apache Tomcat

    Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18,…

    Published 13 Mar 2024 · Fixed in 8.5.99, 9.0.86, 10.1.19 · NVD
  26. Medium 6.3

    CVE-2024-23672 · Apache Tomcat

    Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Older, EOL versions may also be affected. Users are…

    Published 13 Mar 2024 · Fixed in 8.5.99, 9.0.86, 10.1.19 · NVD
  27. Medium 6.1

    CVE-2024-2247 · JFrog Artifactory

    JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism.

    Published 13 Mar 2024 · NVD
  28. Medium 6.1

    CVE-2024-2242 · Contact Form 7

    Contact Form 7: Cross-site Scripting

    Published 13 Mar 2024 · Fixed in 5.9.2 · NVD, WPVulnerability
  29. Medium 4.3

    CVE-2024-28239 · Directus

    CWE-601: URL Redirection to Untrusted Site in OAuth2/OpenID

    Published 12 Mar 2024 · Fixed in 10.10.0 · NVD, Project advisories (GitHub)
  30. Low 2.3

    CVE-2024-28238 · Directus

    Session Token in URL

    Published 12 Mar 2024 · Fixed in 10.10.0 · NVD, Project advisories (GitHub)
  31. High 8.8

    CVE-2024-26198 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 12 Mar 2024 · NVD
  32. High 7.5

    CVE-2024-26190 · .NET

    Microsoft QUIC Denial of Service Vulnerability

    Published 12 Mar 2024 · Fixed in 7.0.17, 8.0.3 · NVD
  33. High 7.5

    CVE-2024-21392 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 12 Mar 2024 · Fixed in 7.0.17, 8.0.3 · NVD
  34. Medium 4.3

    CVE-2024-23112 · Fortinet FortiProxy, Fortinet FortiOS

    An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticated attacker to gain access to another user’s bookmark via URL manipulation.

    Published 12 Mar 2024 · NVD
  35. High 8.8

    CVE-2023-46717 · Fortinet FortiOS

    An improper authentication vulnerability [CWE-287] in FortiOS versions 7.4.1 and below, versions 7.2.6 and below, and versions 7.0.12 and below when configured with FortiAuthenticator in HA may allow a readonly user to gain read-write access via successive login attempts.

    Published 12 Mar 2024 · Fixed in 7.0.13, 7.2.7, 7.4.2 · NVD
  36. High 8.1

    CVE-2023-42790 · Fortinet FortiProxy, Fortinet FortiOS

    A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiProxy 7.4.0, FortiProxy 7.2.0 through 7.2.6, FortiProxy 7.0.0 through 7.0.12, FortiProxy 2.0.0 through 2.0.13, FortiSASE 23.2.b allows attacker to execute unauthorized code or commands via…

    Published 12 Mar 2024 · NVD
  37. Critical 9.8

    CVE-2023-42789 · Fortinet FortiProxy, Fortinet FortiOS

    A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiProxy 7.4.0, FortiProxy 7.2.0 through 7.2.6, FortiProxy 7.0.0 through 7.0.12, FortiProxy 2.0.0 through 2.0.13, FortiSASE 23.2.b allows attacker to execute unauthorized code or commands via…

    Published 12 Mar 2024 · NVD
  38. Medium 4.3

    CVE-2024-2395 · Bulgarisation For Woocommerce (WordPress plugin)

    Bulgarisation for WooCommerce: Cross-Site Request Forgery (CSRF)

    Published 12 Mar 2024 · Fixed in 3.0.15 · WPVulnerability
  39. Medium 5.4

    CVE-2024-1894 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Cross-site Scripting

    Published 12 Mar 2024 · Fixed in 1.5.7 · WPVulnerability
  40. High 7.5

    CVE-2024-0683 · Bulgarisation For Woocommerce (WordPress plugin)

    Bulgarisation for WooCommerce: Missing Authorization

    Published 12 Mar 2024 · Fixed in 3.0.15 · WPVulnerability
  41. High 7.5

    CVE-2024-28197 · ZITADEL

    Account Takeover via Session Fixation in Zitadel [Bypassing MFA]

    Published 11 Mar 2024 · Fixed in 2.44.3, 2.45.1 · NVD, Project advisories (GitHub)
  42. High 7.5

    CVE-2024-28757 · Expat

    libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

    Published 10 Mar 2024 · Fixed in 2.6.2 · NVD
  43. Critical 9.9

    CVE-2024-2044 · pgAdmin

    pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.

    Published 7 Mar 2024 · Fixed in 8.4 · NVD
  44. High 8.8

    CVE-2024-1442 · Grafana

    A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

    Published 7 Mar 2024 · Fixed in 10.1.8, 10.2.5, 10.3.4 · NVD
  45. Critical 9.8

    CVE-2024-1351 · MongoDB

    Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including…

    Published 7 Mar 2024 · Fixed in 5.0.25, 6.0.14, 7.0.6 · NVD
  46. High 8.8

    CVE-2023-42661 · JFrog Artifactory

    JFrog Artifactory prior to version 7.76.2 is vulnerable to Arbitrary File Write of untrusted data, which may lead to DoS or Remote Code Execution when a specially crafted series of requests is sent by an authenticated user. This is due to insufficient validation of artifacts.

    Published 7 Mar 2024 · Fixed in 7.76.2 · NVD
  47. High 7.5

    CVE-2023-42509 · JFrog Artifactory

    JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled exceptions in repository configuration initialization steps may lead to exposure of sensitive data.

    Published 7 Mar 2024 · Fixed in 7.77.0 · NVD
  48. High 7.5

    CVE-2024-1931 · Unbound

    NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can lead to an infinite loop. Unbound 1.18.0 introduced a feature that removes EDE records from responses with size higher than the client's advertised buffer size. Before removing all the EDE records however, it would try to see if trimming…

    Published 7 Mar 2024 · Fixed in 1.19.2 · NVD
  49. Medium 6.5

    CVE-2023-42662 · JFrog Artifactory

    JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration.

    Published 7 Mar 2024 · Fixed in 7.63.18, 7.68.19, 7.71.8 · NVD
  50. High 8.1

    CVE-2024-1299 · GitLab

    A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of `manage_group_access_tokens` to rotate group access tokens with owner privileges.

    Published 7 Mar 2024 · Fixed in 16.8.4, 16.9.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.