UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,126
Published in 7 days
623
Critical in 30 days
389
Actively exploited
420

Latest vulnerabilities

38,126 vulnerabilities
  1. Critical 9.8

    CVE-2023-6933 · Better Search Replace (WordPress plugin)

    Better Search Replace: Deserialization of Untrusted Data

    Published 24 Jan 2024 · Fixed in 1.4.5 · WPVulnerability
  2. Medium 6.5

    CVE-2024-23638 · Squid

    SQUID-2023:11 Denial of Service in Cache Manager

    Published 23 Jan 2024 · Fixed in 6.6 · NVD, Project advisories (GitHub)
  3. Medium 5.4

    CVE-2023-49657 · Apache Superset

    A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their config to include: TALISMAN_CONFIG = {     "content_security_policy": {         "base-uri":…

    Published 23 Jan 2024 · Fixed in 3.0.3 · NVD
  4. Medium 4.3

    CVE-2023-48714 · Silverstripe CMS

    Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter

    Published 22 Jan 2024 · Fixed in 4.13.39, 5.1.11 · NVD, Project advisories (GitHub)
  5. High 8.8

    CVE-2024-23678 · Splunk Enterprise

    In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerability only affects Splunk Enterprise for Windows.

    Published 22 Jan 2024 · Fixed in 9.0.8, 9.1.3 · NVD
  6. Medium 5.3

    CVE-2024-23677 · Splunk Enterprise

    In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file.

    Published 22 Jan 2024 · Fixed in 9.0.8 · NVD
  7. Low 3.5

    CVE-2024-23676 · Splunk Enterprise

    In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.

    Published 22 Jan 2024 · Fixed in 9.0.8, 9.1.3 · NVD
  8. Medium 6.5

    CVE-2024-23675 · Splunk Enterprise

    In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.

    Published 22 Jan 2024 · Fixed in 9.0.8, 9.1.3 · NVD
  9. Critical 9.8

    CVE-2024-0204 · GoAnywhere MFT

    Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.

    Published 22 Jan 2024 · Fixed in 7.4.1 · NVD
  10. Medium

    CVE-2023-6927 · Keycloak

    keycloak-core: open redirect via "form_post.jwt" JARM response mode

    Published 22 Jan 2024 · Fixed in 23.0.4 · Project advisories (GitHub)
  11. Medium 6.1

    CVE-2024-23725 · Ghost

    Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries.

    Published 21 Jan 2024 · Fixed in 5.76.0 · NVD
  12. Medium 5.3

    CVE-2024-21733 · Apache Tomcat

    Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.

    Published 19 Jan 2024 · Fixed in 8.5.64, 9.0.44 · NVD
  13. Medium 6.1

    CVE-2024-23659 · SPIP

    SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js.

    Published 19 Jan 2024 · Fixed in 4.1.14, 4.2.8 · NVD
  14. High 8.3

    CVE-2024-22424 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable to a cross-server request forgery (CSRF) attack when the attacker has the ability to write HTML to a page on the same parent domain as Argo CD. A CSRF attack works by tricking an authenticated Argo CD user into loading a web page which…

    Published 19 Jan 2024 · Fixed in 2.7.16, 2.8.8, 2.9.4 · NVD
  15. Unrated

    CVE-2026-10818 · WPForms

    Vulnerability in WPForms Pro

    Published 19 Jan 2024 · Fixed in 2.0.0 · WPVulnerability
  16. Medium 6.1

    CVE-2023-7063 · WPForms

    WPForms Pro: Cross-site Scripting

    Published 19 Jan 2024 · Fixed in 1.8.5.4 · NVD, WPVulnerability
  17. Low 3.7

    CVE-2024-22403 · Nextcloud

    Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth…

    Published 18 Jan 2024 · Fixed in 28.0.0 · NVD
  18. Medium 5.4

    CVE-2023-51464 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 18 Jan 2024 · NVD
  19. Medium 5.4

    CVE-2023-51463 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 18 Jan 2024 · NVD
  20. High 7.5Actively exploited

    CVE-2023-6549 · NetScaler ADC and Gateway

    Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read

    Published 17 Jan 2024 · Fixed in 13.1-37.176, 13.1-51.15, 14.1-12.35 · NVD
  21. High 8.8Actively exploited

    CVE-2023-6548 · NetScaler ADC and Gateway

    Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

    Published 17 Jan 2024 · Fixed in 13.1-37.176, 13.1-51.15, 14.1-12.35 · NVD
  22. High 7.1

    CVE-2024-0396 · MOVEit Transfer

    In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue was discovered. An authenticated user can manipulate a parameter in an HTTPS transaction. The modified transaction could lead to computational errors within MOVEit Transfer and potentially result in a denial of service.

    Published 17 Jan 2024 · Fixed in 2022.1.11, 2023.0.8, 2023.1.3 · NVD
  23. Medium 5.4

    CVE-2023-6701 · Advanced Custom Fields

    Advanced Custom Fields (ACF®): Cross-site Scripting

    Published 17 Jan 2024 · Fixed in 6.2.5 · NVD, WPVulnerability
  24. Medium 6.5

    CVE-2024-20985 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jan 2024 · NVD
  25. Medium 4.9

    CVE-2024-20983 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 16 Jan 2024 · NVD
  26. Medium 4.9

    CVE-2024-20981 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jan 2024 · NVD
  27. Medium 6.5

    CVE-2024-20977 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jan 2024 · NVD
  28. Medium 6.5

    CVE-2024-20975 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 16 Jan 2024 · NVD
  29. Medium 6.5

    CVE-2024-20973 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jan 2024 · NVD
  30. Medium 4.9

    CVE-2024-20971 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 16 Jan 2024 · NVD
  31. Medium 5.5

    CVE-2024-20969 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jan 2024 · NVD
  32. Medium 5.5

    CVE-2024-20967 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 16 Jan 2024 · NVD
  33. Medium 4.9

    CVE-2024-20965 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 16 Jan 2024 · NVD
  34. Medium 6.5

    CVE-2024-20963 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 16 Jan 2024 · NVD
  35. Medium 6.5

    CVE-2024-20961 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jan 2024 · NVD
  36. High 7.4

    CVE-2024-20952 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows…

    Published 16 Jan 2024 · Fixed in 11.0.24, 17.0.10, 21.0.2 · NVD
  37. High 7.5

    CVE-2024-20932 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 17.0.9; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 21.3.8 and 22.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple…

    Published 16 Jan 2024 · NVD
  38. Medium 5.9

    CVE-2024-20926 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with…

    Published 16 Jan 2024 · NVD
  39. Low 2.5

    CVE-2024-20922 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition…

    Published 16 Jan 2024 · NVD
  40. High 7.4

    CVE-2024-20918 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows…

    Published 16 Jan 2024 · NVD
  41. High 7.5

    CVE-2023-22512 · Confluence

    This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS Score of 7.5, this vulnerability allows an unauthenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a vulnerable host (Confluence instance) connected to a network, which has no…

    Published 16 Jan 2024 · Fixed in 7.19.14, 8.5.1 · NVD
  42. High 8.1

    CVE-2024-22408 · Shopware

    Server-Side Request Forgery (SSRF) in Flow Builder

    Published 16 Jan 2024 · Fixed in 5.7.4, 6.5.7.4 · NVD, Project advisories (GitHub)
  43. Critical 9.8

    CVE-2024-22406 · Shopware

    Blind SQL-injection in DAL aggregations

    Published 16 Jan 2024 · Fixed in 6.5.7.4 · NVD, Project advisories (GitHub)
  44. Medium 6.5

    CVE-2024-22407 · Shopware

    Broken Access Control order API

    Published 16 Jan 2024 · Fixed in 6.5.7.4 · NVD, Project advisories (GitHub)
  45. Medium 5.5

    CVE-2024-0232 · SQLite

    A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.

    Published 16 Jan 2024 · Fixed in 3.43.2 · NVD
  46. High 7.5

    CVE-2024-21674 · Confluence

    This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.6 and a CVSS Vector of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N allows an unauthenticated attacker to expose assets in your environment susceptible to exploitation which has high impact to…

    Published 16 Jan 2024 · Fixed in 7.19.18, 8.5.5, 8.7.2 · NVD
  47. High 8.8

    CVE-2024-21673 · Confluence

    This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.0 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H allows an authenticated attacker to expose assets in your environment susceptible to exploitation which has high impact to…

    Published 16 Jan 2024 · Fixed in 7.19.18, 8.5.5, 8.7.2 · NVD
  48. High 8.8

    CVE-2024-21672 · Confluence

    This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H allows an unauthenticated attacker to remotely expose assets in your environment susceptible to exploitation which has high impact to…

    Published 16 Jan 2024 · Fixed in 7.19.18, 8.5.5, 8.7.2 · NVD
  49. Critical 9.8Actively exploited

    CVE-2023-22527 · Confluence

    A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates.…

    Published 16 Jan 2024 · Fixed in 8.5.4 · NVD
  50. High 8.8

    CVE-2023-22526 · Confluence

    This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian…

    Published 16 Jan 2024 · Fixed in 7.19.17, 8.5.5, 8.7.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.