UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,126
Published in 7 days
625
Critical in 30 days
389
Actively exploited
420

Latest vulnerabilities

38,126 vulnerabilities
  1. Medium 6.1

    CVE-2024-21725 · Joomla!

    Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.

    Published 29 Feb 2024 · Fixed in 4.4.3, 5.0.3 · NVD
  2. Medium 6.1

    CVE-2024-21724 · Joomla!

    Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.

    Published 29 Feb 2024 · Fixed in 3.10.15, 4.4.3, 5.0.3 · NVD
  3. Medium 4.3

    CVE-2024-21723 · Joomla!

    Inadequate parsing of URLs could result into an open redirect.

    Published 29 Feb 2024 · Fixed in 3.10.15, 4.4.3, 5.0.3 · NVD
  4. Medium 6.3

    CVE-2024-21722 · Joomla!

    The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.

    Published 29 Feb 2024 · Fixed in 3.10.15, 4.4.3, 5.0.3 · NVD
  5. Medium 6.1

    CVE-2023-6923 · Matomo

    The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a…

    Published 29 Feb 2024 · Fixed in 5.0.1 · NVD
  6. Medium 4.8

    CVE-2023-49337 · Concrete CMS

    Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. (8.5 and earlier are unaffected.)

    Published 29 Feb 2024 · Fixed in 9.2.3 · NVD
  7. Medium 4.3

    CVE-2023-48653 · Concrete CMS

    Concrete CMS before 8.5.14 and 9 before 9.2.3 allows Cross Site Request Forgery (CSRF) via ccm/calendar/dialogs/event/delete/submit. An attacker can force an admin to delete events on the site because the event ID is numeric and sequential.

    Published 29 Feb 2024 · Fixed in 8.5.14, 9.2.3 · NVD
  8. Medium 4.3

    CVE-2023-48651 · Concrete CMS

    Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) at /ccm/system/dialogs/file/delete/1/submit.

    Published 29 Feb 2024 · Fixed in 9.2.3 · NVD
  9. Medium 4.8

    CVE-2023-48650 · Concrete CMS

    Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name.

    Published 29 Feb 2024 · Fixed in 8.5.14, 9.2.3 · NVD
  10. Medium 5.4

    CVE-2024-26016 · Apache Superset

    A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges. This issue affects Apache Superset: before…

    Published 28 Feb 2024 · Fixed in 3.0.4, 3.1.1 · NVD
  11. Medium 6.5

    CVE-2024-24779 · Apache Superset

    Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version…

    Published 28 Feb 2024 · Fixed in 3.1.1 · NVD
  12. Medium 6.5

    CVE-2024-24773 · Apache Superset

    Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue.

    Published 28 Feb 2024 · Fixed in 3.0.4, 3.1.1 · NVD
  13. Medium 4.3

    CVE-2024-24772 · Apache Superset

    A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

    Published 28 Feb 2024 · Fixed in 3.0.4, 3.1.1 · NVD
  14. Medium 4.3

    CVE-2024-27315 · Apache Superset

    An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before…

    Published 28 Feb 2024 · Fixed in 3.0.4, 3.1.1 · NVD
  15. Medium 5.3

    CVE-2023-45000 · LiteSpeed Cache

    LiteSpeed Cache: Missing Authorization

    Published 27 Feb 2024 · Fixed in 5.7.0.1 · NVD, WPVulnerability
  16. Medium 6.1

    CVE-2023-40000 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 27 Feb 2024 · Fixed in 5.7.0.1 · NVD, WPVulnerability
  17. Low

    CVE-2024-26142 · Ruby on Rails

    Possible ReDoS vulnerability in Accept header parsing in Action Dispatch

    Published 26 Feb 2024 · Fixed in 7.1.3.1 · Project advisories (GitHub)
  18. High

    CVE-2024-26144 · Ruby on Rails

    Possible Sensitive Session Information Leak in Active Storage

    Published 26 Feb 2024 · Fixed in 6.1.7.7 · Project advisories (GitHub)
  19. Low

    CVE-2024-26143 · Ruby on Rails

    Possible XSS Vulnerability in Action Controller translation

    Published 26 Feb 2024 · Fixed in 7.0.8.1 · Project advisories (GitHub)
  20. Critical 9.8

    CVE-2024-24402 · Nagios XI

    An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component.

    Published 26 Feb 2024 · NVD
  21. Critical 9.8

    CVE-2024-24401 · Nagios XI

    SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php component.

    Published 26 Feb 2024 · NVD
  22. High 7.5

    CVE-2024-22201 · Eclipse Jetty

    Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20,…

    Published 26 Feb 2024 · Fixed in 10.0.20, 11.0.20, 12.0.6 · NVD
  23. Medium 5.4

    CVE-2024-27087 · Kirby

    Cross-site scripting (XSS) in the link field "Custom" type

    Published 26 Feb 2024 · Fixed in 4.1.1 · NVD, Project advisories (GitHub)
  24. Medium 6.5

    CVE-2024-23523 · Elementor Pro (WordPress plugin)

    Elementor Pro: Exposure of Sensitive Information to an Unauthorized Actor

    Published 26 Feb 2024 · Fixed in 3.19.3 · WPVulnerability
  25. Critical 9.6

    CVE-2024-27133 · MLflow

    Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over dataset table fields.

    Published 23 Feb 2024 · NVD
  26. Critical 9.6

    CVE-2024-27132 · MLflow

    Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. This issue leads to a client-side RCE when running an untrusted recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over template variables.

    Published 23 Feb 2024 · NVD
  27. Medium 5.5

    CVE-2024-25629 · c-ares

    Out of bounds read in ares__read_line()

    Published 23 Feb 2024 · Fixed in 1.27.0 · NVD, Project advisories (GitHub)
  28. High 8.8

    CVE-2023-29181 · Fortinet FortiProxy, Fortinet FortiOS

    A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12, FortiOS 6.2.0 through 6.2.14, FortiOS 6.0.0 through 6.0.16, FortiOS 5.6 all versions, FortiOS 5.4 all versions, FortiOS 5.2 all versions, FortiOS 5.0 all versions, FortiOS 4.3 all versions, FortiOS 4.2 all versions, FortiOS 4.1 all…

    Published 22 Feb 2024 · Fixed in 7.0.11, 7.0.12, 7.2.5 · NVD
  29. High 7.5

    CVE-2023-29180 · Fortinet FortiProxy, Fortinet FortiOS

    A null pointer dereference vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12, FortiOS 6.2.0 through 6.2.14, FortiOS 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.3, FortiProxy 7.0.0 through 7.0.10, FortiProxy 2.0.0 through 2.0.12, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions,…

    Published 22 Feb 2024 · Fixed in 7.0.12, 7.2.4, 7.2.5 · NVD
  30. Medium 6.5

    CVE-2023-29179 · Fortinet FortiProxy, Fortinet FortiOS

    A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, Fortiproxy version 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 allows attacker to denial of service via specially crafted HTTP requests.

    Published 22 Feb 2024 · Fixed in 7.0.11, 7.0.12, 7.2.5 · NVD
  31. Medium 6.1

    CVE-2024-26484 · Kirby

    A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Link field. NOTE: the vendor's position is that this issue did not affect any version of Kirby CMS. The only effect was on the trykirby.com demo site, which is not customer-controlled.

    Published 22 Feb 2024 · NVD
  32. High 8.8

    CVE-2024-26483 · Kirby

    Unrestricted file upload of user avatar images

    Published 22 Feb 2024 · Fixed in 3.7.5.4, 3.8.4.3, 3.9.8.1 · NVD, Project advisories (GitHub)
  33. High 7.1

    CVE-2024-26482 · Kirby

    An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is backend sanitization such that the reporter's mentioned "injecting malicious scripts" would not occur.

    Published 22 Feb 2024 · NVD
  34. Medium 4.7

    CVE-2024-26481 · Kirby

    Self cross-site scripting (self-XSS) in the URL field

    Published 22 Feb 2024 · Fixed in 3.7.5.4, 3.8.4.3, 3.9.8.1 · NVD, Project advisories (GitHub)
  35. Medium 4.3

    CVE-2023-4895 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.0 to 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. This vulnerability allows for bypassing the 'group ip restriction' settings to access environment details of projects

    Published 22 Feb 2024 · Fixed in 16.8.3 · NVD
  36. Medium 5.3

    CVE-2024-1525 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Under some specialized conditions, an LDAP user may be able to reset their password using their verified secondary email address and sign-in using direct authentication with the reset password,…

    Published 22 Feb 2024 · Fixed in 16.7.6, 16.8.3 · NVD
  37. High 8.7

    CVE-2024-1451 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload added to the user profile page could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of victims."

    Published 22 Feb 2024 · NVD
  38. Medium 4.3

    CVE-2024-0861 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the `Guest` role can change `Custom dashboard projects` settings contrary to permissions.

    Published 22 Feb 2024 · Fixed in 16.7.6, 16.8.3 · NVD
  39. High 7.7

    CVE-2024-0410 · GitLab

    An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.

    Published 22 Feb 2024 · Fixed in 16.7.6, 16.8.3 · NVD
  40. Medium 6.7

    CVE-2023-6477 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. When a user is assigned a custom role with admin_group_member permission, they may be able to make a group, other members or themselves Owners of that group, which may lead to privilege escalation.

    Published 22 Feb 2024 · Fixed in 16.7.6 · NVD
  41. Medium 5.4

    CVE-2023-3509 · GitLab

    An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for group members with sub-maintainer role to change the title of privately accessible deploy keys associated with projects in the group.

    Published 21 Feb 2024 · NVD
  42. Medium 6.1

    CVE-2024-1474 · WS_FTP Server

    In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface.

    Published 21 Feb 2024 · Fixed in 8.8.5 · NVD
  43. Medium 5.4

    CVE-2023-47795 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a document's “Title” text field.

    Published 21 Feb 2024 · Fixed in 7.4.3.102 · NVD
  44. Medium 5.4

    CVE-2024-25151 · Liferay Portal / DXP

    The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's…

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.3.4 · NVD
  45. Medium 6.1

    CVE-2024-26269 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL.

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.3.38 · NVD
  46. Medium 5.4

    CVE-2024-26266 · Liferay Portal / DXP

    Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name text field of…

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.3.14 · NVD
  47. Medium 5.4

    CVE-2024-25603 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.3.5 · NVD
  48. Medium 6.1

    CVE-2023-42498 · Liferay Portal / DXP

    Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.

    Published 21 Feb 2024 · Fixed in 7.4.3.98 · NVD
  49. Medium 6.1

    CVE-2023-42496 · Liferay Portal / DXP

    Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2 parameter.

    Published 21 Feb 2024 · Fixed in 7.4.3.98 · NVD
  50. Medium 6.1

    CVE-2023-40191 · Liferay Portal / DXP

    Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the “Blocked Email Domains” text field

    Published 21 Feb 2024 · Fixed in 7.4.3.98 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.