UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,126
Published in 7 days
625
Critical in 30 days
389
Actively exploited
420

Latest vulnerabilities

38,126 vulnerabilities
  1. Medium 5.4

    CVE-2024-25602 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into an organization’s “Name” text field

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.3.4 · NVD
  2. Medium 5.4

    CVE-2024-25601 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the name text field of a…

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.3.4 · NVD
  3. Medium 5.4

    CVE-2024-25152 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the filename of an attachment.

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.3.4 · NVD
  4. Medium 6.1

    CVE-2024-25147 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links.

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.2 · NVD
  5. Medium 6.3

    CVE-2021-29038 · Liferay Portal / DXP

    Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not obfuscate password reminder answers on the page, which allows attackers to use man-in-the-middle or shoulder surfing attacks to steal user's password reminder answers.

    Published 20 Feb 2024 · Fixed in 7.2, 7.3.6 · NVD
  6. High 8.5

    CVE-2024-21678 · Confluence

    This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to confidentiality, low impact to integrity, no impact to availability, and requires no user interaction. Data Center…

    Published 20 Feb 2024 · Fixed in 7.19.19, 8.5.5, 8.7.2 · NVD
  7. Medium 5.3

    CVE-2024-26270 · Liferay Portal / DXP

    The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.

    Published 20 Feb 2024 · Fixed in 7.4.3.100 · NVD
  8. Medium 5.3

    CVE-2024-26268 · Liferay Portal / DXP

    User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time.

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.27 · NVD
  9. Medium 5.3

    CVE-2024-26267 · Liferay Portal / DXP

    In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities…

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.26 · NVD
  10. Medium 6.5

    CVE-2024-26265 · Liferay Portal / DXP

    The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, which allows remote authenticated users to upload arbitrarily large files to the system's temp folder by…

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.16 · NVD
  11. Medium 5.4

    CVE-2024-25610 · Liferay Portal / DXP

    In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry’s…

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.13 · NVD
  12. Medium 6.1

    CVE-2024-25609 · Liferay Portal / DXP

    HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL`…

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.13 · NVD
  13. Medium 6.1

    CVE-2024-25608 · Liferay Portal / DXP

    HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2)…

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.19 · NVD
  14. High 7.5

    CVE-2024-25607 · Liferay Portal / DXP

    The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes.

    Published 20 Feb 2024 · Fixed in 7.2 · NVD
  15. High 8.7

    CVE-2024-25606 · Liferay Portal / DXP

    XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.8 · NVD
  16. Medium 5.3

    CVE-2024-25605 · Liferay Portal / DXP

    The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API.

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.5 · NVD
  17. Medium 6.5

    CVE-2024-25604 · Liferay Portal / DXP

    Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.5 · NVD
  18. Medium 4.3

    CVE-2024-25150 · Liferay Portal / DXP

    Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.4 · NVD
  19. Medium 5.4

    CVE-2024-25149 · Liferay Portal / DXP

    Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the "Limit membership to members of the parent site" option is enabled, which allows remote authenticated users to add users who are not a member of the parent site to a…

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.2 · NVD
  20. Medium 6.1

    CVE-2023-44308 · Liferay Portal / DXP

    Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_adaptive_media_web_portlet_AMPortlet_redirect parameter.

    Published 20 Feb 2024 · NVD
  21. Medium 6.1

    CVE-2023-5190 · Liferay Portal / DXP

    Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter.

    Published 20 Feb 2024 · Fixed in 7.4.3.102 · NVD
  22. Medium 6.3

    CVE-2022-45320 · Liferay Portal / DXP

    Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki page by editing the wiki page.

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.16 · NVD
  23. High 7.5

    CVE-2024-22019 · Node.js

    A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard…

    Published 20 Feb 2024 · Fixed in 18.19.1, 20.11.1, 21.6.2 · NVD
  24. Critical 9.8

    CVE-2024-21896 · Node.js

    The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which…

    Published 20 Feb 2024 · Fixed in 20.11.1, 21.6.2 · NVD
  25. High 7.8

    CVE-2024-21892 · Node.js

    On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to…

    Published 20 Feb 2024 · Fixed in 18.19.1, 20.11.1, 21.6.2 · NVD
  26. High 8.8

    CVE-2024-21891 · Node.js

    Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued,…

    Published 20 Feb 2024 · Fixed in 20.11.1, 21.6.2 · NVD
  27. Medium 6.5

    CVE-2024-21890 · Node.js

    The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that…

    Published 20 Feb 2024 · Fixed in 20.11.1, 21.6.2 · NVD
  28. Medium 5.3

    CVE-2024-25983 · Moodle

    Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page).

    Published 19 Feb 2024 · Fixed in 4.1.9, 4.2.6, 4.3.3 · NVD
  29. High 8.8

    CVE-2024-25982 · Moodle

    The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.

    Published 19 Feb 2024 · Fixed in 4.1.9, 4.2.6, 4.3.3 · NVD
  30. Medium 5.3

    CVE-2024-25981 · Moodle

    Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers.

    Published 19 Feb 2024 · Fixed in 4.1.9, 4.2.6, 4.3.3 · NVD
  31. Medium 5.3

    CVE-2024-25980 · Moodle

    Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.

    Published 19 Feb 2024 · Fixed in 4.1.9, 4.2.6, 4.3.3 · NVD
  32. Medium 5.3

    CVE-2024-25979 · Moodle

    The URL parameters accepted by forum search were not limited to the allowed parameters.

    Published 19 Feb 2024 · Fixed in 4.1.9, 4.2.6, 4.3.3 · NVD
  33. High 7.5

    CVE-2024-25978 · Moodle

    Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.

    Published 19 Feb 2024 · Fixed in 4.1.9, 4.2.6, 4.3.3 · NVD
  34. Medium 5.3

    CVE-2024-26129 · PrestaShop

    Path disclosure in JavaScript variable

    Published 19 Feb 2024 · Fixed in 8.1.4 · NVD, Project advisories (GitHub)
  35. High 7.7

    CVE-2024-25623 · Mastodon

    Lack of media type verification of Activity Streams objects allows impersonation of remote accounts

    Published 17 Feb 2024 · Fixed in 4.0.15, 4.1.15, 4.2.7 · NVD, Project advisories (GitHub)
  36. High 7.2

    CVE-2024-25298 · REDAXO

    An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php.

    Published 17 Feb 2024 · NVD
  37. Medium 6.1

    CVE-2024-20986 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the…

    Published 17 Feb 2024 · NVD
  38. Medium 4.4

    CVE-2024-20984 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server : Security : Firewall). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 17 Feb 2024 · NVD
  39. Medium 4.9

    CVE-2024-20982 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Feb 2024 · NVD
  40. Medium 4.9

    CVE-2024-20978 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Feb 2024 · NVD
  41. Medium 4.9

    CVE-2024-20976 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Feb 2024 · NVD
  42. Medium 4.9

    CVE-2024-20974 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Feb 2024 · NVD
  43. Medium 4.9

    CVE-2024-20972 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Feb 2024 · NVD
  44. Medium 4.9

    CVE-2024-20970 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Feb 2024 · NVD
  45. Medium 4.4

    CVE-2024-20968 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Feb 2024 · NVD
  46. Medium 4.9

    CVE-2024-20966 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Feb 2024 · NVD
  47. Medium 5.3

    CVE-2024-20964 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 17 Feb 2024 · NVD
  48. Medium 6.5

    CVE-2024-20962 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Feb 2024 · NVD
  49. Medium 6.5

    CVE-2024-20960 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: RAPID). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Feb 2024 · NVD
  50. Medium 4.7

    CVE-2024-20945 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows low…

    Published 17 Feb 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.