UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,126
Published in 7 days
623
Critical in 30 days
389
Actively exploited
420

Latest vulnerabilities

38,126 vulnerabilities
  1. High 7.5

    CVE-2024-22362 · Drupal

    Drupal contains a vulnerability with improper handling of structural elements. If this vulnerability is exploited, an attacker may be able to cause a denial-of-service (DoS) condition.

    Published 16 Jan 2024 · NVD
  2. Unrated

    WPV-536b163abc4b · Advanced Custom Fields Pro (WordPress plugin)

    Vulnerability in Advanced Custom Field Pro

    Published 16 Jan 2024 · Fixed in 6.2.5 · WPVulnerability
  3. Unrated

    WPV-364a4a1f8e18 · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Published 16 Jan 2024 · Fixed in 6.2.5 · WPVulnerability
  4. Medium 6.5

    CVE-2024-0405 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): SQL Injection

    Published 16 Jan 2024 · Fixed in 1.5.4 · WPVulnerability
  5. Medium 6.5

    CVE-2023-50290 · Apache Solr

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined…

    Published 15 Jan 2024 · Fixed in 9.3.0 · NVD
  6. Medium 4.3

    CVE-2024-21655 · Discourse

    Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4.

    Published 12 Jan 2024 · Fixed in 3.1.4 · NVD
  7. Medium 4.3

    CVE-2023-49099 · Discourse

    Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.

    Published 12 Jan 2024 · Fixed in 3.1.4 · NVD
  8. High 7.5

    CVE-2023-48297 · Discourse

    Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.

    Published 12 Jan 2024 · Fixed in 3.1.4 · NVD
  9. Critical 9.0

    CVE-2024-22206 · @clerk/nextjs

    @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

    Published 12 Jan 2024 · Fixed in 4.29.3 · OSV.dev and GitHub
  10. Critical 9.1Actively exploited

    CVE-2024-21887 · Ivanti Connect Secure

    A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

    Published 12 Jan 2024 · NVD
  11. High 8.2Actively exploited

    CVE-2023-46805 · Ivanti Connect Secure

    An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

    Published 12 Jan 2024 · NVD
  12. Critical 9.8Actively exploited

    CVE-2023-7028 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

    Published 12 Jan 2024 · Fixed in 16.5.6, 16.6.4, 16.7.2 · NVD
  13. Medium 5.3

    CVE-2023-6955 · GitLab

    A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.

    Published 12 Jan 2024 · Fixed in 16.5.6, 16.6.4 · NVD
  14. High 8.8

    CVE-2023-5356 · GitLab

    Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user.

    Published 12 Jan 2024 · Fixed in 16.5.6, 16.6.4 · NVD
  15. Medium 5.3

    CVE-2023-4812 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding changes to a previously approved merge request.

    Published 12 Jan 2024 · Fixed in 16.5.5, 16.6.4 · NVD
  16. Medium 5.3

    CVE-2023-2030 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits.

    Published 12 Jan 2024 · Fixed in 16.5.6, 16.6.4 · NVD
  17. Medium 6.1

    CVE-2024-23179 · MediaWiki

    An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special:GlobalBlock?uselang=x-xss URI, i18n-based XSS can occur via the parentheses message. This affects subtitle links in buildSubtitleLinks.

    Published 12 Jan 2024 · Fixed in 1.40.2 · NVD
  18. Medium 5.4

    CVE-2024-23178 · MediaWiki

    An issue was discovered in the Phonos extension in MediaWiki before 1.40.2. PhonosButton.js allows i18n-based XSS via the phonos-purge-needed-error message.

    Published 12 Jan 2024 · Fixed in 1.40.2 · NVD
  19. Medium 6.1

    CVE-2024-23177 · MediaWiki

    An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2. XSS can occur via the Special:PageStatistics page parameter.

    Published 12 Jan 2024 · Fixed in 1.40.2 · NVD
  20. Medium 5.4

    CVE-2024-23174 · MediaWiki

    An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via the rev-deleted-user, pagetriage-tags-quickfilter-label, pagetriage-triage, pagetriage-filter-date-range-format-placeholder, pagetriage-filter-date-range-to, pagetriage-filter-date-range-from, pagetriage-filter-date-range-heading,…

    Published 12 Jan 2024 · Fixed in 1.35.14, 1.39.6, 1.40.2 · NVD
  21. Medium 6.1

    CVE-2024-23173 · MediaWiki

    An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php.

    Published 12 Jan 2024 · Fixed in 1.35.14, 1.39.6, 1.40.2 · NVD
  22. Medium 5.4

    CVE-2024-23172 · MediaWiki

    An issue was discovered in the CheckUser extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via message definitions. e.g., in SpecialCheckUserLog.

    Published 12 Jan 2024 · Fixed in 1.35.14, 1.39.6, 1.40.2 · NVD
  23. Medium 5.4

    CVE-2024-23171 · MediaWiki

    An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:EventDetails page allows XSS via the x-xss language setting for internationalization (i18n).

    Published 12 Jan 2024 · Fixed in 1.35.14, 1.39.6, 1.40.2 · NVD
  24. Unrated

    WPV-95e6a6f56398 · WooCommerce

    Vulnerability in WooCommerce

    Published 12 Jan 2024 · Fixed in 8.4.0 · WPVulnerability
  25. High 8.8

    CVE-2024-22198 · Nginx UI

    Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

    Published 11 Jan 2024 · Fixed in 2.0.0.beta.8, 2.0.0 · NVD, Project advisories (GitHub)
  26. High 8.8

    CVE-2024-22197 · Nginx UI

    Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

    Published 11 Jan 2024 · Fixed in 2.0.0.beta.8, 2.0.0 · NVD, Project advisories (GitHub)
  27. Medium 6.5

    CVE-2024-22196 · Nginx UI

    Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

    Published 11 Jan 2024 · Fixed in 2.0.0.beta.8, 2.0.0 · NVD, Project advisories (GitHub)
  28. Medium 4.3

    CVE-2023-6630 · Contact Form 7

    The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any…

    Published 11 Jan 2024 · NVD
  29. High 8.8

    CVE-2023-44250 · Fortinet FortiProxy, Fortinet FortiOS

    An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests.

    Published 10 Jan 2024 · NVD
  30. Medium 5.3

    CVE-2023-50172 · AVideo

    A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pass code for any user.

    Published 10 Jan 2024 · NVD
  31. Medium 6.5

    CVE-2023-49864 · AVideo

    An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the `downloadURL_image` parameter.

    Published 10 Jan 2024 · NVD
  32. Medium 6.5

    CVE-2023-49810 · AVideo

    A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacker can send a series of HTTP requests to trigger this vulnerability.

    Published 10 Jan 2024 · NVD
  33. High 7.5

    CVE-2023-49738 · AVideo

    An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.

    Published 10 Jan 2024 · NVD
  34. High 8.8

    CVE-2023-49715 · AVideo

    A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution when chained with an LFI vulnerability. An attacker can send a series of HTTP requests to trigger this vulnerability.

    Published 10 Jan 2024 · NVD
  35. Critical 9.8

    CVE-2023-49599 · AVideo

    An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and brute force the salt offline, leading to forging a legitimate password recovery code for the admin user.

    Published 10 Jan 2024 · NVD
  36. High 8.8

    CVE-2023-49589 · AVideo

    An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to an arbitrary user password recovery. An attacker can send an HTTP request to trigger this vulnerability.

    Published 10 Jan 2024 · NVD
  37. Medium 5.4

    CVE-2023-48730 · AVideo

    A cross-site scripting (xss) vulnerability exists in the navbarMenuAndLogo.php user name functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

    Published 10 Jan 2024 · NVD
  38. Medium 6.1

    CVE-2023-48728 · AVideo

    A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

    Published 10 Jan 2024 · NVD
  39. Critical 9.8

    CVE-2023-47862 · AVideo

    A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send a series of HTTP requests to trigger this vulnerability.

    Published 10 Jan 2024 · NVD
  40. Medium 5.4

    CVE-2023-47861 · AVideo

    A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

    Published 10 Jan 2024 · NVD
  41. Medium 6.5

    CVE-2023-47171 · AVideo

    An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.

    Published 10 Jan 2024 · NVD
  42. Medium 6.8

    CVE-2024-21319 · .NET

    Microsoft Identity Denial of service vulnerability

    Published 9 Jan 2024 · Fixed in 6.0.26, 7.0.15, 8.0.1 · NVD
  43. High 7.5

    CVE-2024-20672 · .NET

    .NET Denial of Service Vulnerability

    Published 9 Jan 2024 · Fixed in 6.0.26, 7.0.15 · NVD
  44. Critical 9.8

    CVE-2024-0057 · .NET

    NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

    Published 9 Jan 2024 · Fixed in 6.0.26, 7.0.15 · NVD
  45. High 8.7

    CVE-2024-0056 · .NET

    Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

    Published 9 Jan 2024 · Fixed in 6.0.26, 7.0.15 · NVD
  46. Medium 6.5

    CVE-2023-6129 · OpenSSL

    Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent…

    Published 9 Jan 2024 · NVD
  47. Medium 5.4

    CVE-2024-21637 · authentik

    XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode

    Published 9 Jan 2024 · Fixed in 2023.8.6, 2023.10.6 · NVD, Project advisories (GitHub)
  48. High 8.1

    CVE-2023-41056 · Redis

    Certain sequence of payloads may lead to remote code execution

    Published 9 Jan 2024 · Fixed in 7.0.15, 7.2.4 · NVD, Project advisories (GitHub)
  49. Low 3.3

    CVE-2023-46837 · Xen

    Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest. Unfortunately, the arithmetics in the helpers can overflow and would then result to skip the cache cleaning/invalidation. Therefore there is…

    Published 5 Jan 2024 · NVD
  50. Medium 4.7

    CVE-2023-46836 · Xen

    The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one unconditionally, and one conditionally on whether XPTI was active. As BTC/SRSO and…

    Published 5 Jan 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.