UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,681
Published in 7 days
616
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,681 vulnerabilities
  1. High 7.5

    CVE-2024-21674 · Confluence

    This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.6 and a CVSS Vector of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N allows an unauthenticated attacker to expose assets in your environment susceptible to exploitation which has high impact to…

    Published 16 Jan 2024 · Fixed in 7.19.18, 8.5.5, 8.7.2 · NVD
  2. High 8.8

    CVE-2024-21673 · Confluence

    This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.0 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H allows an authenticated attacker to expose assets in your environment susceptible to exploitation which has high impact to…

    Published 16 Jan 2024 · Fixed in 7.19.18, 8.5.5, 8.7.2 · NVD
  3. High 8.8

    CVE-2024-21672 · Confluence

    This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H allows an unauthenticated attacker to remotely expose assets in your environment susceptible to exploitation which has high impact to…

    Published 16 Jan 2024 · Fixed in 7.19.18, 8.5.5, 8.7.2 · NVD
  4. Critical 9.8Actively exploited

    CVE-2023-22527 · Confluence

    A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates.…

    Published 16 Jan 2024 · Fixed in 8.5.4 · NVD
  5. High 8.8

    CVE-2023-22526 · Confluence

    This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian…

    Published 16 Jan 2024 · Fixed in 7.19.17, 8.5.5, 8.7.2 · NVD
  6. High 7.5

    CVE-2024-22362 · Drupal

    Drupal contains a vulnerability with improper handling of structural elements. If this vulnerability is exploited, an attacker may be able to cause a denial-of-service (DoS) condition.

    Published 16 Jan 2024 · NVD
  7. Unrated

    WPV-536b163abc4b · Advanced Custom Fields Pro (WordPress plugin)

    Vulnerability in Advanced Custom Field Pro

    Published 16 Jan 2024 · Fixed in 6.2.5 · WPVulnerability
  8. Unrated

    WPV-364a4a1f8e18 · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Published 16 Jan 2024 · Fixed in 6.2.5 · WPVulnerability
  9. Medium 6.5

    CVE-2024-0405 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): SQL Injection

    Published 16 Jan 2024 · Fixed in 1.5.4 · WPVulnerability
  10. Medium 6.5

    CVE-2023-50290 · Apache Solr

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined…

    Published 15 Jan 2024 · Fixed in 9.3.0 · NVD
  11. Medium 4.3

    CVE-2024-21655 · Discourse

    Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4.

    Published 12 Jan 2024 · Fixed in 3.1.4 · NVD
  12. Medium 4.3

    CVE-2023-49099 · Discourse

    Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.

    Published 12 Jan 2024 · Fixed in 3.1.4 · NVD
  13. High 7.5

    CVE-2023-48297 · Discourse

    Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.

    Published 12 Jan 2024 · Fixed in 3.1.4 · NVD
  14. Critical 9.0

    CVE-2024-22206 · @clerk/nextjs

    @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

    Published 12 Jan 2024 · Fixed in 4.29.3 · OSV.dev and GitHub
  15. Critical 9.1Actively exploited

    CVE-2024-21887 · Ivanti Connect Secure

    A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

    Published 12 Jan 2024 · NVD
  16. High 8.2Actively exploited

    CVE-2023-46805 · Ivanti Connect Secure

    An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

    Published 12 Jan 2024 · NVD
  17. Critical 9.8Actively exploited

    CVE-2023-7028 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

    Published 12 Jan 2024 · Fixed in 16.5.6, 16.6.4, 16.7.2 · NVD
  18. Medium 5.3

    CVE-2023-6955 · GitLab

    A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.

    Published 12 Jan 2024 · Fixed in 16.5.6, 16.6.4 · NVD
  19. High 8.8

    CVE-2023-5356 · GitLab

    Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user.

    Published 12 Jan 2024 · Fixed in 16.5.6, 16.6.4 · NVD
  20. Medium 5.3

    CVE-2023-4812 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding changes to a previously approved merge request.

    Published 12 Jan 2024 · Fixed in 16.5.5, 16.6.4 · NVD
  21. Medium 5.3

    CVE-2023-2030 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits.

    Published 12 Jan 2024 · Fixed in 16.5.6, 16.6.4 · NVD
  22. Medium 6.1

    CVE-2024-23179 · MediaWiki

    An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special:GlobalBlock?uselang=x-xss URI, i18n-based XSS can occur via the parentheses message. This affects subtitle links in buildSubtitleLinks.

    Published 12 Jan 2024 · Fixed in 1.40.2 · NVD
  23. Medium 5.4

    CVE-2024-23178 · MediaWiki

    An issue was discovered in the Phonos extension in MediaWiki before 1.40.2. PhonosButton.js allows i18n-based XSS via the phonos-purge-needed-error message.

    Published 12 Jan 2024 · Fixed in 1.40.2 · NVD
  24. Medium 6.1

    CVE-2024-23177 · MediaWiki

    An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2. XSS can occur via the Special:PageStatistics page parameter.

    Published 12 Jan 2024 · Fixed in 1.40.2 · NVD
  25. Medium 5.4

    CVE-2024-23174 · MediaWiki

    An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via the rev-deleted-user, pagetriage-tags-quickfilter-label, pagetriage-triage, pagetriage-filter-date-range-format-placeholder, pagetriage-filter-date-range-to, pagetriage-filter-date-range-from, pagetriage-filter-date-range-heading,…

    Published 12 Jan 2024 · Fixed in 1.35.14, 1.39.6, 1.40.2 · NVD
  26. Medium 6.1

    CVE-2024-23173 · MediaWiki

    An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php.

    Published 12 Jan 2024 · Fixed in 1.35.14, 1.39.6, 1.40.2 · NVD
  27. Medium 5.4

    CVE-2024-23172 · MediaWiki

    An issue was discovered in the CheckUser extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via message definitions. e.g., in SpecialCheckUserLog.

    Published 12 Jan 2024 · Fixed in 1.35.14, 1.39.6, 1.40.2 · NVD
  28. Medium 5.4

    CVE-2024-23171 · MediaWiki

    An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:EventDetails page allows XSS via the x-xss language setting for internationalization (i18n).

    Published 12 Jan 2024 · Fixed in 1.35.14, 1.39.6, 1.40.2 · NVD
  29. Unrated

    WPV-95e6a6f56398 · WooCommerce

    Vulnerability in WooCommerce

    Published 12 Jan 2024 · Fixed in 8.4.0 · WPVulnerability
  30. High 8.8

    CVE-2024-22198 · Nginx UI

    Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

    Published 11 Jan 2024 · Fixed in 2.0.0.beta.8, 2.0.0 · NVD, Project advisories (GitHub)
  31. High 8.8

    CVE-2024-22197 · Nginx UI

    Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

    Published 11 Jan 2024 · Fixed in 2.0.0.beta.8, 2.0.0 · NVD, Project advisories (GitHub)
  32. Medium 6.5

    CVE-2024-22196 · Nginx UI

    Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

    Published 11 Jan 2024 · Fixed in 2.0.0.beta.8, 2.0.0 · NVD, Project advisories (GitHub)
  33. Medium 4.3

    CVE-2023-6630 · Contact Form 7

    The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any…

    Published 11 Jan 2024 · NVD
  34. High 8.8

    CVE-2023-44250 · Fortinet FortiProxy, Fortinet FortiOS

    An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests.

    Published 10 Jan 2024 · NVD
  35. Medium 5.3

    CVE-2023-50172 · AVideo

    A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pass code for any user.

    Published 10 Jan 2024 · NVD
  36. Medium 6.5

    CVE-2023-49864 · AVideo

    An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the `downloadURL_image` parameter.

    Published 10 Jan 2024 · NVD
  37. Medium 6.5

    CVE-2023-49810 · AVideo

    A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacker can send a series of HTTP requests to trigger this vulnerability.

    Published 10 Jan 2024 · NVD
  38. High 7.5

    CVE-2023-49738 · AVideo

    An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.

    Published 10 Jan 2024 · NVD
  39. High 8.8

    CVE-2023-49715 · AVideo

    A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution when chained with an LFI vulnerability. An attacker can send a series of HTTP requests to trigger this vulnerability.

    Published 10 Jan 2024 · NVD
  40. Critical 9.8

    CVE-2023-49599 · AVideo

    An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and brute force the salt offline, leading to forging a legitimate password recovery code for the admin user.

    Published 10 Jan 2024 · NVD
  41. High 8.8

    CVE-2023-49589 · AVideo

    An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to an arbitrary user password recovery. An attacker can send an HTTP request to trigger this vulnerability.

    Published 10 Jan 2024 · NVD
  42. Medium 5.4

    CVE-2023-48730 · AVideo

    A cross-site scripting (xss) vulnerability exists in the navbarMenuAndLogo.php user name functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

    Published 10 Jan 2024 · NVD
  43. Medium 6.1

    CVE-2023-48728 · AVideo

    A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

    Published 10 Jan 2024 · NVD
  44. Critical 9.8

    CVE-2023-47862 · AVideo

    A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send a series of HTTP requests to trigger this vulnerability.

    Published 10 Jan 2024 · NVD
  45. Medium 5.4

    CVE-2023-47861 · AVideo

    A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

    Published 10 Jan 2024 · NVD
  46. Medium 6.5

    CVE-2023-47171 · AVideo

    An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.

    Published 10 Jan 2024 · NVD
  47. Medium 6.8

    CVE-2024-21319 · .NET

    Microsoft Identity Denial of service vulnerability

    Published 9 Jan 2024 · Fixed in 6.0.26, 7.0.15, 8.0.1 · NVD
  48. High 7.5

    CVE-2024-20672 · .NET

    .NET Denial of Service Vulnerability

    Published 9 Jan 2024 · Fixed in 6.0.26, 7.0.15 · NVD
  49. Critical 9.8

    CVE-2024-0057 · .NET

    NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

    Published 9 Jan 2024 · Fixed in 6.0.26, 7.0.15 · NVD
  50. High 8.7

    CVE-2024-0056 · .NET

    Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

    Published 9 Jan 2024 · Fixed in 6.0.26, 7.0.15 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.