Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 38,126
- Published in 7 days
- 623
- Critical in 30 days
- 389
- Actively exploited
- 420
Latest vulnerabilities
38,126 vulnerabilities- Medium 5.4
CVE-2024-24812 · Frappe Framework
Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages
Published 6 Feb 2024 · Fixed in 14.59.0, 15.5.0 · NVD, Project advisories (GitHub) - Medium 5.3
CVE-2024-24942 · TeamCity
In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives
Published 6 Feb 2024 · Fixed in 2023.11.3 · NVD - Medium 5.3
CVE-2024-24938 · TeamCity
In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation
Published 6 Feb 2024 · Fixed in 2023.11.2 · NVD - Medium 5.4
CVE-2024-24937 · TeamCity
In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible
Published 6 Feb 2024 · Fixed in 2023.11.2 · NVD - Medium 5.3
CVE-2024-24936 · TeamCity
In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed
Published 6 Feb 2024 · Fixed in 2023.11.2 · NVD - Critical 9.8
CVE-2024-23917 · TeamCity
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible
Published 6 Feb 2024 · Fixed in 2023.11.3 · NVD - Medium 5.4
CVE-2024-0977 · Timeline Widget Addon For Elementor (WordPress plugin)
Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline): Cross-site Scripting
Published 6 Feb 2024 · Fixed in 1.5.4 · WPVulnerability - Medium 5.5
CVE-2023-52426 · Expat
libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
Published 4 Feb 2024 · NVD - High 7.5
CVE-2023-52425 · Expat
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
Published 4 Feb 2024 · NVD - Critical 9.8
CVE-2020-36773 · Ghostscript
Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).
Published 4 Feb 2024 · NVD - High 7.5
CVE-2024-25062 · libxml2
An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
Published 4 Feb 2024 · Fixed in 2.11.7, 2.12.5 · NVD - Medium 5.3
CVE-2024-0853 · curl
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
Published 3 Feb 2024 · NVD - Medium 5.4
CVE-2023-51072 · Nagios XI
A stored cross-site scripting (XSS) vulnerability in the NOC component of Nagios XI version up to and including 2024R1 allows low-privileged users to execute malicious HTML or JavaScript code via the audio file upload functionality from the Operation Center section. This allows any authenticated user to execute arbitrary JavaScript code on behalf of other users, including the administrators.
Published 2 Feb 2024 · Fixed in 2024 · NVD - Medium 6.1
CVE-2024-23645 · GLPI
GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12.
Published 1 Feb 2024 · Fixed in 10.0.12 · NVD - High 8.1
CVE-2023-51446 · GLPI
GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12.
Published 1 Feb 2024 · Fixed in 10.0.12 · NVD - Critical 9.8
CVE-2024-23832 · Mastodon
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x versions…
Published 1 Feb 2024 · Fixed in 4.0.13, 4.1.13, 4.2.5 · NVD - Medium 6.1
CVE-2024-24570 · Statamic
Account takeover via XSS and password reset link
Published 1 Feb 2024 · Fixed in 3.4.17, 4.46.0 · NVD, Project advisories (GitHub) - High 7.8
CVE-2024-24557 · Docker Engine
Classic builder cache poisoning
Published 1 Feb 2024 · Fixed in 23.0.10, 24.0.9, 25.0.2 · NVD, Project advisories (GitHub) - Medium 6.5
CVE-2024-0831 · HashiCorp Vault
Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`.
Published 1 Feb 2024 · Fixed in 1.15.5 · NVD - High 8.8
CVE-2024-24747 · MinIO
MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability…
Published 31 Jan 2024 · NVD - High 8.6
CVE-2024-21626 · runc
several container breakouts due to internally leaked fds
Published 31 Jan 2024 · Fixed in 1.1.12 · NVD, Project advisories (GitHub) - High 8.2Actively exploited
CVE-2024-21893 · Ivanti Connect Secure
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
Published 31 Jan 2024 · NVD - High 8.8
CVE-2024-21888 · Ivanti Connect Secure
A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.
Published 31 Jan 2024 · NVD - Medium 5.3
CVE-2023-6780 · GNU C Library
An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer.
Published 31 Jan 2024 · Fixed in 2.39 · NVD - High 7.5
CVE-2023-6779 · GNU C Library
An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes, leading to an incorrect calculation of the buffer size to store the message, resulting in an application crash. This issue affects glibc…
Published 31 Jan 2024 · Fixed in 2.39 · NVD - High 7.8
CVE-2023-6246 · GNU C Library
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege…
Published 31 Jan 2024 · Fixed in 2.39 · NVD - Medium 6.1
CVE-2024-23834 · Discourse
Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. The vulnerability is patched in 3.1.5 and 3.2.0.beta5. As a workaround, ensure Content Security Policy is enabled and does not include `unsafe-inline`.
Published 30 Jan 2024 · Fixed in 3.1.5, 3.2.0 · NVD - High 8.6
CVE-2024-1019 · ModSecurity
ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string component. This results in an impedance mismatch versus RFC compliant back-end applications. The…
Published 30 Jan 2024 · Fixed in 3.0.12 · NVD - High 7.5
CVE-2023-36260 · Craft CMS
An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about code provided by the Craft CMS product; it is only a report about the Feed Me plugin. NOTE: a…
Published 30 Jan 2024 · Fixed in 4.6.1.1 · NVD - Medium 5.4
CVE-2023-36259 · Craft CMS
Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.
Published 30 Jan 2024 · Fixed in 3.0.2 · NVD - High 8.8
CVE-2024-23647 · authentik
PKCE downgrade attack in authentik
Published 29 Jan 2024 · Fixed in 2023.8.7, 2023.10.7 · NVD, Project advisories (GitHub) - Critical 9.8
CVE-2024-23827 · Nginx UI
Arbitrary file write through the Import Certificate feature
Published 28 Jan 2024 · Fixed in 2.0.0-beta.11 · NVD, Project advisories (GitHub) - High 8.8
CVE-2024-23828 · Nginx UI
Authenticated RCE through injecting into the application config via CRLF
Published 28 Jan 2024 · Fixed in 2.0.0-beta.11, 2.0.0 · NVD, Project advisories (GitHub) - High 7.5
CVE-2024-22861 · FFmpeg
Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module.
Published 27 Jan 2024 · NVD - Critical 9.8
CVE-2024-22862 · FFmpeg
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser.
Published 27 Jan 2024 · NVD - Critical 9.8
CVE-2024-22860 · FFmpeg
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxl_anim_read_packet component in the JPEG XL Animation decoder.
Published 27 Jan 2024 · NVD - Medium 5.5
CVE-2024-0727 · OpenSSL
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be…
Published 26 Jan 2024 · Fixed in 1.1.1x, 3.0.13, 3.1.5 · NVD - Medium 6.5
CVE-2023-6159 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a `Cargo.toml` containing maliciously crafted input.
Published 26 Jan 2024 · Fixed in 16.6.6, 16.7.4 · NVD - Medium 5.3
CVE-2023-5612 · GitLab
An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.
Published 26 Jan 2024 · Fixed in 16.6.6, 16.7.4 · NVD - Medium 4.3
CVE-2024-0456 · GitLab
An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project
Published 26 Jan 2024 · Fixed in 16.6.6, 16.7.4 · NVD - Critical 9.9
CVE-2024-0402 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace.
Published 26 Jan 2024 · Fixed in 16.5.8, 16.6.6, 16.7.4 · NVD - Medium 5.4
CVE-2023-5933 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests.
Published 26 Jan 2024 · Fixed in 16.6.6, 16.7.4 · NVD - Medium 4.8
CVE-2023-52046 · Webmin
Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the "Execute cron job as" tab Input field.
Published 25 Jan 2024 · NVD - Medium 6.1
CVE-2024-23817 · Dolibarr ERP CRM
HTML injection vulnerability in Dolibarr Application Home Page
Published 25 Jan 2024 · NVD, Project advisories (GitHub) - High 8.8
CVE-2024-23898 · Jenkins
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.
Published 24 Jan 2024 · NVD - Critical 9.8Actively exploited
CVE-2024-23897 · Jenkins
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
Published 24 Jan 2024 · Fixed in 2.426.3, 2.442 · NVD - Medium 6.5
CVE-2023-51702 · Apache Airflow
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in…
Published 24 Jan 2024 · Fixed in 2.6.1 · NVD - Medium 6.5
CVE-2023-50944 · Apache Airflow
Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.
Published 24 Jan 2024 · Fixed in 2.8.1 · NVD - High 7.5
CVE-2023-50943 · Apache Airflow
Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later,…
Published 24 Jan 2024 · Fixed in 2.8.1 · NVD - High 7.5
CVE-2024-23641 · SvelteKit
Sending a GET or HEAD request with a body crashes SvelteKit
Published 24 Jan 2024 · Fixed in 2.4.3 · Project advisories (GitHub)
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.