UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,123
Published in 7 days
628
Critical in 30 days
389
Actively exploited
420

Latest vulnerabilities

38,123 vulnerabilities
  1. High 8.0

    CVE-2024-0199 · GitLab

    An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An attacker could bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions.

    Published 7 Mar 2024 · Fixed in 16.7.7, 16.8.4, 16.9.2 · NVD
  2. High 7.5

    CVE-2024-27917 · Shopware

    Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. Since Shopware 6.5.8.0, the 404 pages are cached to improve the performance of 404 pages. So the cached Response which contains a Session Cookie when the Browser accessing the 404 page, has no cookies yet. The Symfony Session Handler is in…

    Published 6 Mar 2024 · Fixed in 6.5.8.7 · NVD
  3. Medium 5.8

    CVE-2024-28174 · TeamCity

    In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly

    Published 6 Mar 2024 · Fixed in 2023.11.4 · NVD
  4. Medium 4.3

    CVE-2024-28173 · TeamCity

    In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed

    Published 6 Mar 2024 · Fixed in 2023.11.4 · NVD
  5. Medium 4.8

    CVE-2024-2179 · Concrete CMS

    Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Name field which might be executed when users visit the affected page. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 2.2…

    Published 5 Mar 2024 · Fixed in 9.2.7 · NVD
  6. Low 3.7

    CVE-2024-25616 · HPE ArubaOS

    Aruba has identified certain configurations of ArubaOS that can lead to partial disclosure of sensitive information in the IKE_AUTH negotiation process. The scenarios in which disclosure of potentially sensitive information can occur are complex, and depend on factors beyond the control of attackers.

    Published 5 Mar 2024 · Fixed in 8.11.2.1, 10.4.1.0, 10.5.1.0 · NVD
  7. Medium 5.3

    CVE-2024-25615 · HPE ArubaOS

    An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Spectrum service accessed via the PAPI protocol in ArubaOS 8.x. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service.

    Published 5 Mar 2024 · Fixed in 8.11.2.1, 10.4.1.0, 10.5.1.0 · NVD
  8. Critical 9.1

    CVE-2024-25614 · HPE ArubaOS

    There is an arbitrary file deletion vulnerability in the CLI used by ArubaOS. Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to denial-of-service conditions and impact the integrity of the controller.

    Published 5 Mar 2024 · Fixed in 8.11.2.1, 10.4.1.0, 10.5.1.0 · NVD
  9. High 7.2

    CVE-2024-25613 · HPE ArubaOS

    Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

    Published 5 Mar 2024 · Fixed in 8.11.2.1, 10.4.1.0, 10.5.1.0 · NVD
  10. High 7.2

    CVE-2024-25612 · HPE ArubaOS

    Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

    Published 5 Mar 2024 · Fixed in 8.11.2.1, 10.4.1.0, 10.5.1.0 · NVD
  11. High 7.2

    CVE-2024-25611 · HPE ArubaOS

    Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

    Published 5 Mar 2024 · Fixed in 8.11.2.1, 10.4.1.0, 10.5.1.0 · NVD
  12. High 7.2

    CVE-2024-1356 · HPE ArubaOS

    Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

    Published 5 Mar 2024 · NVD
  13. High 7.1

    CVE-2024-22255 · VMware ESXi

    VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process.

    Published 5 Mar 2024 · NVD
  14. High 8.2

    CVE-2024-22254 · VMware ESXi

    VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox.

    Published 5 Mar 2024 · NVD
  15. Medium 6.7

    CVE-2024-22253 · VMware ESXi

    VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code…

    Published 5 Mar 2024 · NVD
  16. Medium 6.7

    CVE-2024-22252 · VMware ESXi

    VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code…

    Published 5 Mar 2024 · NVD
  17. Medium 6.5

    CVE-2024-27936 · Deno

    Interactive permission prompt spoofing via improper ANSI stripping

    Published 5 Mar 2024 · Fixed in 1.41.0 · NVD, Project advisories (GitHub)
  18. High 8.3

    CVE-2024-27935 · Deno

    Cross-Session Data Contamination in Deno's Node.js Compatibility Runtime

    Published 5 Mar 2024 · Fixed in 1.36.3 · NVD, Project advisories (GitHub)
  19. High 8.8

    CVE-2024-27933 · Deno

    Arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass

    Published 5 Mar 2024 · NVD, Project advisories (GitHub)
  20. Medium 4.6

    CVE-2024-27932 · Deno

    Improper suffix match testing for DENO_AUTH_TOKENS

    Published 5 Mar 2024 · Fixed in 1.40.4 · NVD, Project advisories (GitHub)
  21. High 8.8

    CVE-2024-27934 · Deno

    *const c_void / ExternalPointer unsoundness leading to use-after-free

    Published 5 Mar 2024 · Fixed in 1.40.3 · NVD, Project advisories (GitHub)
  22. Medium 6.5

    CVE-2024-27931 · Deno

    Insufficient permission checking in `Deno.makeTemp*` APIs

    Published 5 Mar 2024 · Fixed in 1.41.1 · NVD, Project advisories (GitHub)
  23. High 7.5

    CVE-2024-25111 · Squid

    SQUID-2024:1 Denial of Service in HTTP Chunked Decoding

    Published 5 Mar 2024 · Fixed in 6.8 · NVD, Project advisories (GitHub)
  24. Critical 9.8

    CVE-2024-2048 · HashiCorp Vault, OpenBao

    Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10.

    Published 4 Mar 2024 · Fixed in 1.14.10, 1.15.5, 2.0.0 · NVD
  25. High 7.3Actively exploited

    CVE-2024-27199 · TeamCity

    In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

    Published 4 Mar 2024 · Fixed in 2023.11.4 · NVD
  26. Critical 9.8Actively exploited

    CVE-2024-27198 · TeamCity

    In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

    Published 4 Mar 2024 · Fixed in 2023.11.4 · NVD
  27. Medium 5.3

    CVE-2024-20328 · ClamAV

    A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the…

    Published 1 Mar 2024 · Fixed in 1.0.5, 1.2.2 · NVD
  28. Critical 10.0

    CVE-2024-27298 · Parse Server

    parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.

    Published 1 Mar 2024 · Fixed in 6.5.0 · NVD
  29. Critical

    CVE-2023-37466 · Budibase

    VM2 Constructor Escape Vulnerability

    Published 1 Mar 2024 · Fixed in 2.20.0 · Project advisories (GitHub)
  30. Medium 5.3

    CVE-2024-27296 · Directus

    Directus version number disclosure

    Published 1 Mar 2024 · Fixed in 10.8.3 · NVD, Project advisories (GitHub)
  31. High 8.2

    CVE-2024-27295 · Directus

    MySQL accent insensitive email matching

    Published 1 Mar 2024 · Fixed in 10.8.3 · NVD, Project advisories (GitHub)
  32. Medium 4.7

    CVE-2024-26280 · Apache Airflow

    Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log…

    Published 1 Mar 2024 · Fixed in 2.8.2 · NVD
  33. Medium 6.5

    CVE-2023-50312 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274711.

    Published 1 Mar 2024 · Fixed in 24.0.0.3 · NVD
  34. Medium 5.9

    CVE-2024-27906 · Apache Airflow

    Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability

    Published 29 Feb 2024 · Fixed in 2.8.2 · NVD
  35. Medium 4.3

    CVE-2024-1953 · Mattermost

    Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request.

    Published 29 Feb 2024 · Fixed in 8.1.9, 9.2.5, 9.4.2 · NVD
  36. Medium 4.3

    CVE-2024-1952 · Mattermost

    Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated attacker who can control the ephemeral post update to access individual posts' contents in channels they are not a member of.

    Published 29 Feb 2024 · Fixed in 8.1.9 · NVD
  37. Low 2.6

    CVE-2024-1949 · Mattermost

    A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts.

    Published 29 Feb 2024 · Fixed in 8.1.9, 9.4.2 · NVD
  38. Medium 4.3

    CVE-2024-1942 · Mattermost

    Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of.

    Published 29 Feb 2024 · Fixed in 8.1.9, 9.2.5 · NVD
  39. Medium 4.3

    CVE-2024-1888 · Mattermost

    Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add guests to add a guest to a team as long as the guest was already a guest in another team of the server

    Published 29 Feb 2024 · Fixed in 9.2.5, 9.3.1, 9.4.2 · NVD
  40. Medium 6.5

    CVE-2024-24988 · Mattermost

    Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string as an emoji value causing high resource consumption and possibly crashing the server.

    Published 29 Feb 2024 · Fixed in 8.1.8, 9.1.5, 9.2.4 · NVD
  41. Medium 6.5

    CVE-2024-23493 · Mattermost

    Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of.

    Published 29 Feb 2024 · Fixed in 8.1.9, 9.2.5, 9.4.2 · NVD
  42. Medium 4.3

    CVE-2024-23488 · Mattermost

    Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.

    Published 29 Feb 2024 · Fixed in 8.1.9, 9.4.2 · NVD
  43. Medium 4.3

    CVE-2024-1887 · Mattermost

    Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.

    Published 29 Feb 2024 · Fixed in 8.1.9, 9.2.5, 9.3.1 · NVD
  44. Critical 9.1

    CVE-2024-25065 · Apache OFBiz

    Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue.

    Published 29 Feb 2024 · Fixed in 18.12.12 · NVD
  45. High 8.1

    CVE-2024-25006 · XenForo

    XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import.

    Published 29 Feb 2024 · Fixed in 2.2.14 · NVD
  46. Medium 5.3

    CVE-2024-23946 · Apache OFBiz

    Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue.

    Published 29 Feb 2024 · Fixed in 18.12.12 · NVD
  47. Medium 6.5

    CVE-2024-21726 · Joomla!

    Inadequate content filtering leads to XSS vulnerabilities in various components.

    Published 29 Feb 2024 · Fixed in 4.4.3, 5.0.3 · NVD
  48. Medium 6.1

    CVE-2024-21725 · Joomla!

    Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.

    Published 29 Feb 2024 · Fixed in 4.4.3, 5.0.3 · NVD
  49. Medium 6.1

    CVE-2024-21724 · Joomla!

    Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.

    Published 29 Feb 2024 · Fixed in 3.10.15, 4.4.3, 5.0.3 · NVD
  50. Medium 4.3

    CVE-2024-21723 · Joomla!

    Inadequate parsing of URLs could result into an open redirect.

    Published 29 Feb 2024 · Fixed in 3.10.15, 4.4.3, 5.0.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.