UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,126
Published in 7 days
625
Critical in 30 days
389
Actively exploited
420

Latest vulnerabilities

38,126 vulnerabilities
  1. High 7.5

    CVE-2023-5517 · BIND 9

    A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1…

    Published 13 Feb 2024 · NVD
  2. High 7.5

    CVE-2023-4408 · BIND 9

    The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through…

    Published 13 Feb 2024 · NVD
  3. High 7.1

    CVE-2024-25121 · TYPO3

    Improper Access Control Persisting File Abstraction Layer Entities via Data Handler

    Published 13 Feb 2024 · Fixed in 10.4.43, 11.5.35, 12.4.11 · NVD, Project advisories (GitHub)
  4. Medium 4.3

    CVE-2024-25120 · TYPO3

    Improper Access Control of Resources Referenced by t3:// URI Scheme

    Published 13 Feb 2024 · Fixed in 10.4.43, 11.5.35, 12.4.11 · NVD, Project advisories (GitHub)
  5. Medium 4.9

    CVE-2024-25119 · TYPO3

    Information Disclosure of Encryption Key in TYPO3 Install Tool

    Published 13 Feb 2024 · Fixed in 10.4.43, 11.5.35, 12.4.11 · NVD, Project advisories (GitHub)
  6. Medium 6.5

    CVE-2024-25118 · TYPO3

    Information Disclosure of Hashed Passwords in TYPO3 Backend Forms

    Published 13 Feb 2024 · Fixed in 10.4.43, 11.5.35, 12.4.11 · NVD, Project advisories (GitHub)
  7. High 7.2

    CVE-2024-22188 · TYPO3

    Code Execution in TYPO3 Install Tool

    Published 13 Feb 2024 · Fixed in 10.4.43, 11.5.35, 12.4.11 · NVD, Project advisories (GitHub)
  8. High 8.3

    CVE-2024-22024 · Ivanti Connect Secure

    An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.

    Published 13 Feb 2024 · NVD
  9. Medium 6.5

    CVE-2024-1250 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.8 before 16.8.2. When a user is assigned a custom role with manage_group_access_tokens permission, they may be able to create group access tokens with Owner privileges, which may lead to privilege escalation.

    Published 12 Feb 2024 · Fixed in 16.8.2 · NVD
  10. Low 3.3

    CVE-2024-1439 · Moodle

    Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent.

    Published 12 Feb 2024 · NVD
  11. Critical 9.0

    CVE-2024-23724 · Ghost

    Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector."

    Published 11 Feb 2024 · NVD
  12. Medium 4.8

    CVE-2024-1246 · Concrete CMS

    Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execution of the malicious code on the website user’s browser. The Concrete CMS Security team scored this 2 with CVSS v3 vector…

    Published 9 Feb 2024 · Fixed in 9.2.5 · NVD
  13. Medium 4.8

    CVE-2024-1245 · Concrete CMS

    Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administrator entered file attributes are not sufficiently sanitized in the Edit Attributes page. A rogue administrator could put malicious code into the file tags or description attributes and, when another administrator opens the same file for editing, the malicious code could execute.…

    Published 9 Feb 2024 · Fixed in 9.2.5 · NVD
  14. Medium 4.8

    CVE-2024-1247 · Concrete CMS

    Concrete CMS version 9 before 9.2.5 is vulnerable to  stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the affected page. The Concrete CMS Security team scored this 2 with CVSS v3 vector…

    Published 9 Feb 2024 · Fixed in 9.2.5 · NVD
  15. High 8.8

    CVE-2023-50386 · Apache Solr

    Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. In the affected versions, Solr ConfigSets accepted Java jar and class files to be uploaded through the ConfigSets API. When…

    Published 9 Feb 2024 · Fixed in 8.11.3, 9.4.1 · NVD
  16. High 7.5

    CVE-2023-50298 · Apache Solr

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. Solr Streaming Expressions allows users to extract data from other Solr Clouds, using a "zkHost" parameter. When original SolrCloud is setup to use ZooKeeper credentials and ACLs, they will be sent to whatever "zkHost" the…

    Published 9 Feb 2024 · Fixed in 8.11.3, 9.4.1 · NVD
  17. High 7.5

    CVE-2023-50292 · Apache Solr

    Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0. The Schema Designer was introduced to allow users to more easily configure and test new Schemas and configSets. However, when the feature was created, the "trust"…

    Published 9 Feb 2024 · Fixed in 8.11.3, 9.4.1 · NVD
  18. High 7.5

    CVE-2023-50291 · Apache Solr

    Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name. There are a number of sensitive system properties, such…

    Published 9 Feb 2024 · Fixed in 8.11.3, 9.3.0 · NVD
  19. Medium 4.3

    CVE-2024-1402 · Mattermost

    Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker sending a huge amount of non-existent custom emojis in a post to crash the mobile app of a user seeing the post and to crash the server due to overloading when clients attempt to retrive the aforementioned post.

    Published 9 Feb 2024 · NVD
  20. High 7.5

    CVE-2024-23324 · Envoy

    Ext_authz can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata

    Published 9 Feb 2024 · Fixed in 1.27.3, 1.28.1, 1.29.1 · NVD, Project advisories (GitHub)
  21. High 7.5

    CVE-2024-23325 · Envoy

    Envoy crashes when using an address type that isn’t supported by the OS

    Published 9 Feb 2024 · Fixed in 1.27.3, 1.28.1, 1.29.1 · NVD, Project advisories (GitHub)
  22. High 7.5

    CVE-2024-23322 · Envoy

    Envoy crashes when idle and request per try timeout occur within the backoff interval

    Published 9 Feb 2024 · Fixed in 1.27.3, 1.28.1, 1.29.1 · NVD, Project advisories (GitHub)
  23. Medium 5.3

    CVE-2024-23323 · Envoy

    Excessive CPU usage when URI template matcher is configured using regex

    Published 9 Feb 2024 · Fixed in 1.27.3, 1.28.1, 1.29.1 · NVD, Project advisories (GitHub)
  24. High 7.5

    CVE-2024-23327 · Envoy

    Crash in proxy protocol when command type of LOCAL

    Published 9 Feb 2024 · Fixed in 1.27.3, 1.28.1, 1.29.1 · NVD, Project advisories (GitHub)
  25. Medium 4.3

    CVE-2024-24776 · Mattermost

    Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a user without permissions.

    Published 9 Feb 2024 · NVD
  26. Medium 4.1

    CVE-2024-24774 · Mattermost

    Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues.

    Published 9 Feb 2024 · NVD
  27. Low 3.5

    CVE-2024-23319 · Mattermost

    Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.

    Published 9 Feb 2024 · NVD
  28. Medium 5.4

    CVE-2024-22119 · Zabbix

    The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.

    Published 9 Feb 2024 · Fixed in 5.0.40, 6.0.24, 6.4.9 · NVD
  29. Critical 9.8Actively exploited

    CVE-2024-21762 · Fortinet FortiProxy, Fortinet FortiOS

    A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2…

    Published 9 Feb 2024 · Fixed in 7.2.7, 7.2.9, 7.4.3 · NVD
  30. Medium 5.4

    CVE-2023-31506 · Grav

    A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element.

    Published 9 Feb 2024 · NVD
  31. Medium 5.3

    CVE-2024-24829 · Sentry

    SSRF via Phabricator integration

    Published 8 Feb 2024 · Fixed in 24.1.2 · NVD, Project advisories (GitHub)
  32. High 7.8

    CVE-2023-25365 · October CMS

    Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3

    Published 8 Feb 2024 · NVD
  33. High 8.4

    CVE-2023-22649 · Rancher

    Rancher 'Audit Log' leaks sensitive information

    Published 8 Feb 2024 · Fixed in 2.6.14, 2.7.10, 2.8.2 · NVD, Project advisories (GitHub)
  34. High 7.2

    CVE-2023-32194 · Rancher

    Permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'

    Published 8 Feb 2024 · Fixed in 2.6.14, 2.7.10, 2.8.2 · Project advisories (GitHub)
  35. High 8.0

    CVE-2024-0985 · PostgreSQL

    Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the…

    Published 8 Feb 2024 · Fixed in 13.14, 14.11, 15.6 · NVD
  36. Medium 6.5

    CVE-2023-6564 · GitLab

    An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push and/or merge to protected branches, there may have been instances in which subgroup members with the Developer role were able to push or merge to protected branches.

    Published 8 Feb 2024 · NVD
  37. High 8.1

    CVE-2024-25148 · Liferay Portal / DXP

    In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content.

    Published 8 Feb 2024 · NVD
  38. Medium 5.3

    CVE-2024-25146 · Liferay Portal / DXP

    Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This…

    Published 8 Feb 2024 · NVD
  39. Medium 6.5

    CVE-2024-25144 · Liferay Portal / DXP

    The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.

    Published 8 Feb 2024 · Fixed in 7.4.3.26 · NVD
  40. Medium 4.6

    CVE-2023-47798 · Liferay Portal / DXP

    Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.

    Published 8 Feb 2024 · Fixed in 7.2, 7.3.0 · NVD
  41. Critical 9.8

    CVE-2024-22394 · SonicWall SonicOS

    An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow a remote attacker to bypass authentication.  This issue affects only firmware version SonicOS 7.1.1-7040.

    Published 8 Feb 2024 · NVD
  42. Medium 6.5

    CVE-2024-1066 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 13.3.0 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows an attacker to do a resource exhaustion using GraphQL `vulnerabilitiesCountByDay`

    Published 7 Feb 2024 · Fixed in 16.6.7, 16.7.5, 16.8.2 · NVD
  43. Medium 6.7

    CVE-2023-6840 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maintainer to change the name of a protected branch that bypasses the security policy added to block MR.

    Published 7 Feb 2024 · Fixed in 16.6.7, 16.7.5, 16.8.2 · NVD
  44. Medium 6.5

    CVE-2023-6736 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 11.3 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted content in the CODEOWNERS file.

    Published 7 Feb 2024 · Fixed in 16.7.6, 16.8.3 · NVD
  45. Medium 5.4

    CVE-2024-25145 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result…

    Published 7 Feb 2024 · Fixed in 7.2, 7.4.3.12 · NVD
  46. Medium 6.5

    CVE-2024-25143 · Liferay Portal / DXP

    The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote authenticated users to cause a denial of service (memory consumption) via crafted PNG images.

    Published 7 Feb 2024 · Fixed in 7.2, 7.2.0, 7.3.7 · NVD
  47. Medium 6.5

    CVE-2024-23446 · Kibana

    An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.

    Published 7 Feb 2024 · Fixed in 8.12.1 · NVD
  48. High 8.1

    CVE-2024-24934 · Elementor

    Elementor Website Builder – more than just a page builder: Path Traversal

    Published 7 Feb 2024 · Fixed in 3.19.1 · NVD, WPVulnerability
  49. Medium 5.4

    CVE-2024-0506 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 7 Feb 2024 · Fixed in 3.19.0 · NVD, WPVulnerability
  50. Medium 4.3

    GHSA-v248-pv3c-jvgw · Frappe Framework

    HTML injection in printview

    Published 6 Feb 2024 · Fixed in 14.57.0, 15.3.0 · Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.