UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
251
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Medium 5.4

    CVE-2024-2279 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 to 16.8.6 all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. Using the autocomplete for issues references feature a crafted payload may lead to a stored XSS, allowing attackers to perform arbitrary actions on behalf of victims.

    Published 12 Apr 2024 · Fixed in 16.8.6, 16.9.4, 16.10.2 · NVD
  2. Medium 6.5

    CVE-2023-6678 · GitLab

    An issue has been discovered in GitLab EE affecting all versions before 16.8.6, all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. It was possible for an attacker to cause a denial of service using malicious crafted content in a junit test report file.

    Published 12 Apr 2024 · Fixed in 16.8.6, 16.9.4, 16.10.2 · NVD
  3. Medium 6.5

    CVE-2023-6489 · GitLab

    A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature.

    Published 12 Apr 2024 · Fixed in 16.8.6, 16.9.4, 16.10.2 · NVD
  4. Critical 9.8

    CVE-2024-3566 · Node.js, PHP, Rust

    A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

    Published 10 Apr 2024 · Fixed in 18.20.2, 20.12.2, 21.7.3 · NVD
  5. High 8.1

    CVE-2024-20759 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality and…

    Published 10 Apr 2024 · NVD
  6. Critical 9.0

    CVE-2024-20758 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution on the underlying filesystem. Exploitation of this issue does not require user interaction, but the attack complexity is high.

    Published 10 Apr 2024 · NVD
  7. High 7.3

    CVE-2024-21409 · .NET

    .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

    Published 9 Apr 2024 · Fixed in 6.0.29, 7.0.18, 8.0.4 · NVD
  8. Critical 10.0

    CVE-2024-24576 · Rust

    `std::process::Command` did not properly escape arguments of batch files on Windows

    Published 9 Apr 2024 · Fixed in 1.77.2 · NVD, Project advisories (GitHub)
  9. Medium 6.4

    CVE-2024-2306 · Slider Revolution

    Slider Revolution: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

    Published 8 Apr 2024 · Fixed in 6.7.0 · WPVulnerability
  10. Medium 4.3

    CVE-2024-22155 · WooCommerce

    WooCommerce: Cross-Site Request Forgery (CSRF)

    Published 5 Apr 2024 · Fixed in 8.6.0 · WPVulnerability
  11. High 7.5

    CVE-2024-27316 · Apache HTTP Server

    HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

    Published 4 Apr 2024 · Fixed in 2.4.59 · NVD
  12. Medium 6.3

    CVE-2024-24795 · Apache HTTP Server

    HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.

    Published 4 Apr 2024 · Fixed in 2.4.59 · NVD
  13. High 7.3

    CVE-2023-38709 · Apache HTTP Server

    Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.

    Published 4 Apr 2024 · Fixed in 2.4.59 · NVD
  14. Medium 5.4

    CVE-2024-2946 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 4 Apr 2024 · Fixed in 2.8.5 · WPVulnerability
  15. Critical 9.8

    CVE-2024-31211 · WordPress

    Remote Code Execution in `WP_HTML_Token`

    Published 3 Apr 2024 · Fixed in 6.4.2 · NVD, WordPress
  16. High 8.8

    CVE-2024-31210 · WordPress

    PHP file upload bypass via Plugin installer

    Published 3 Apr 2024 · Fixed in 6.2.4, 6.3.3, 6.4.3 · NVD, WordPress
  17. Medium 6.4

    CVE-2024-2868 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 3 Apr 2024 · Fixed in 2.8.4 · WPVulnerability
  18. Medium 5.3

    CVE-2024-23449 · Elasticsearch

    An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

    Published 29 Mar 2024 · Fixed in 8.11.1 · NVD
  19. Medium 6.5

    CVE-2024-2818 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. It was possible for an attacker to cause a denial of service using malicious crafted description parameter for labels.

    Published 28 Mar 2024 · Fixed in 16.8.5, 16.9.3 · NVD
  20. Medium 5.4

    CVE-2023-6371 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. A wiki page with a crafted payload may lead to a Stored XSS, allowing attackers to perform arbitrary actions on behalf of victims.

    Published 28 Mar 2024 · Fixed in 16.8.5, 16.9.3 · NVD
  21. Medium 6.5

    CVE-2024-23451 · Elasticsearch

    Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0. This allows a malicious user with a valid API key for a remote cluster configured to use the new Remote Cluster Security to read arbitrary documents from any index on the remote cluster, and only if they use the Elasticsearch…

    Published 27 Mar 2024 · Fixed in 8.13.0 · NVD
  22. High 7.5

    CVE-2024-23450 · Elasticsearch

    A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

    Published 27 Mar 2024 · Fixed in 7.17.19, 8.13.0 · NVD
  23. Medium 6.5

    CVE-2024-2466 · curl

    libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).

    Published 27 Mar 2024 · Fixed in 8.7.0 · NVD
  24. High 8.6

    CVE-2024-2398 · curl

    When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by…

    Published 27 Mar 2024 · Fixed in 8.7.0 · NVD
  25. Medium 6.3

    CVE-2024-2379 · curl

    libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.

    Published 27 Mar 2024 · NVD
  26. Low 3.5

    CVE-2024-2004 · curl

    When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of…

    Published 27 Mar 2024 · Fixed in 8.7.0 · NVD
  27. Medium 5.4

    CVE-2024-2120 · Elementor

    The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Navigation widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web…

    Published 27 Mar 2024 · Fixed in 3.20.2 · NVD
  28. Medium 5.4

    CVE-2024-2117 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 26 Mar 2024 · Fixed in 3.20.3 · NVD, WPVulnerability
  29. Medium 4.9

    CVE-2024-1310 · WooCommerce

    WooCommerce: Improper Access Control

    Published 25 Mar 2024 · Fixed in 8.6 · WPVulnerability
  30. Medium 5.4

    CVE-2024-2165 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Improper Input Validation

    Published 22 Mar 2024 · Fixed in 7.6 · WPVulnerability
  31. Medium 5.4

    CVE-2024-2536 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Improper Input Validation

    Published 21 Mar 2024 · Fixed in 1.0.215 · WPVulnerability
  32. High 7.5

    CVE-2024-29018 · Docker Engine

    External DNS requests from 'internal' networks could lead to data exfiltration

    Published 19 Mar 2024 · Fixed in 23.0.11, 25.0.5, 26.0.0-rc3 · NVD, Project advisories (GitHub)
  33. High 8.8

    CVE-2024-21677 · Confluence

    This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Score of 8.3, allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that…

    Published 19 Mar 2024 · Fixed in 7.19.20, 8.5.7, 8.8.1 · NVD
  34. High 7.5

    CVE-2024-28242 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can learn that secret categories exist when they have backgrounds set. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable to upgrade should temporarily remove category backgrounds.

    Published 15 Mar 2024 · Fixed in 3.2.0, 3.3.0 · NVD
  35. Medium 6.5

    CVE-2024-27100 · Discourse

    Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files weren't enforcing limits on the sizes of the parameters that they accept. This could lead to excessive resource consumption which could render an instance inoperable. A site could be disrupted by either a malicious moderator on the same…

    Published 15 Mar 2024 · Fixed in 3.2.1, 3.3.0 · NVD
  36. Medium 6.5

    CVE-2024-27085 · Discourse

    Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable invites or restrict access to them using the `invite allowed…

    Published 15 Mar 2024 · Fixed in 3.2.0, 3.3.0 · NVD
  37. High 7.5

    CVE-2024-24827 · Discourse

    Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to site as various site settings like `max_image_size_kb`, `max_attachment_size_kb` and…

    Published 15 Mar 2024 · Fixed in 3.2.0, 3.3.0 · NVD
  38. Medium 5.3

    CVE-2024-24748 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public category which has no public subcategories. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 15 Mar 2024 · NVD
  39. Medium 5.4

    CVE-2024-1960 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 14 Mar 2024 · Fixed in 2.8.2 · WPVulnerability
  40. High 7.5

    CVE-2024-24549 · Apache Tomcat

    Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18,…

    Published 13 Mar 2024 · Fixed in 8.5.99, 9.0.86, 10.1.19 · NVD
  41. Medium 6.3

    CVE-2024-23672 · Apache Tomcat

    Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Older, EOL versions may also be affected. Users are…

    Published 13 Mar 2024 · Fixed in 8.5.99, 9.0.86, 10.1.19 · NVD
  42. Medium 6.1

    CVE-2024-2242 · Contact Form 7

    Contact Form 7: Cross-site Scripting

    Published 13 Mar 2024 · Fixed in 5.9.2 · NVD, WPVulnerability
  43. High 7.5

    CVE-2024-26190 · .NET

    Microsoft QUIC Denial of Service Vulnerability

    Published 12 Mar 2024 · Fixed in 7.0.17, 8.0.3 · NVD
  44. High 7.5

    CVE-2024-21392 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 12 Mar 2024 · Fixed in 7.0.17, 8.0.3 · NVD
  45. Medium 4.3

    CVE-2024-2395 · Bulgarisation For Woocommerce (WordPress plugin)

    Bulgarisation for WooCommerce: Cross-Site Request Forgery (CSRF)

    Published 12 Mar 2024 · Fixed in 3.0.15 · WPVulnerability
  46. Medium 5.4

    CVE-2024-1894 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Cross-site Scripting

    Published 12 Mar 2024 · Fixed in 1.5.7 · WPVulnerability
  47. High 7.5

    CVE-2024-0683 · Bulgarisation For Woocommerce (WordPress plugin)

    Bulgarisation for WooCommerce: Missing Authorization

    Published 12 Mar 2024 · Fixed in 3.0.15 · WPVulnerability
  48. Critical 9.8

    CVE-2024-1351 · MongoDB

    Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including…

    Published 7 Mar 2024 · Fixed in 5.0.25, 6.0.14, 7.0.6 · NVD
  49. High 8.1

    CVE-2024-1299 · GitLab

    A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of `manage_group_access_tokens` to rotate group access tokens with owner privileges.

    Published 7 Mar 2024 · Fixed in 16.8.4, 16.9.2 · NVD
  50. High 8.0

    CVE-2024-0199 · GitLab

    An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An attacker could bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions.

    Published 7 Mar 2024 · Fixed in 16.7.7, 16.8.4, 16.9.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.