UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
250
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Medium 6.5

    CVE-2024-21726 · Joomla!

    Inadequate content filtering leads to XSS vulnerabilities in various components.

    Published 29 Feb 2024 · Fixed in 4.4.3, 5.0.3 · NVD
  2. Medium 6.1

    CVE-2024-21725 · Joomla!

    Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.

    Published 29 Feb 2024 · Fixed in 4.4.3, 5.0.3 · NVD
  3. Medium 6.1

    CVE-2024-21724 · Joomla!

    Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.

    Published 29 Feb 2024 · Fixed in 3.10.15, 4.4.3, 5.0.3 · NVD
  4. Medium 4.3

    CVE-2024-21723 · Joomla!

    Inadequate parsing of URLs could result into an open redirect.

    Published 29 Feb 2024 · Fixed in 3.10.15, 4.4.3, 5.0.3 · NVD
  5. Medium 6.3

    CVE-2024-21722 · Joomla!

    The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.

    Published 29 Feb 2024 · Fixed in 3.10.15, 4.4.3, 5.0.3 · NVD
  6. Medium 6.1

    CVE-2023-6923 · Matomo

    The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a…

    Published 29 Feb 2024 · Fixed in 5.0.1 · NVD
  7. Medium 5.3

    CVE-2023-45000 · LiteSpeed Cache

    LiteSpeed Cache: Missing Authorization

    Published 27 Feb 2024 · Fixed in 5.7.0.1 · NVD, WPVulnerability
  8. Medium 6.1

    CVE-2023-40000 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 27 Feb 2024 · Fixed in 5.7.0.1 · NVD, WPVulnerability
  9. Medium 5.5

    CVE-2024-25629 · c-ares

    c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to…

    Published 23 Feb 2024 · Fixed in 1.27.0 · NVD
  10. Medium 4.3

    CVE-2023-4895 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.0 to 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. This vulnerability allows for bypassing the 'group ip restriction' settings to access environment details of projects

    Published 22 Feb 2024 · Fixed in 16.8.3 · NVD
  11. Medium 5.3

    CVE-2024-1525 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Under some specialized conditions, an LDAP user may be able to reset their password using their verified secondary email address and sign-in using direct authentication with the reset password,…

    Published 22 Feb 2024 · Fixed in 16.7.6, 16.8.3 · NVD
  12. High 8.7

    CVE-2024-1451 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload added to the user profile page could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of victims."

    Published 22 Feb 2024 · NVD
  13. Medium 4.3

    CVE-2024-0861 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the `Guest` role can change `Custom dashboard projects` settings contrary to permissions.

    Published 22 Feb 2024 · Fixed in 16.7.6, 16.8.3 · NVD
  14. High 7.7

    CVE-2024-0410 · GitLab

    An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.

    Published 22 Feb 2024 · Fixed in 16.7.6, 16.8.3 · NVD
  15. Medium 6.7

    CVE-2023-6477 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. When a user is assigned a custom role with admin_group_member permission, they may be able to make a group, other members or themselves Owners of that group, which may lead to privilege escalation.

    Published 22 Feb 2024 · Fixed in 16.7.6 · NVD
  16. Medium 5.4

    CVE-2023-3509 · GitLab

    An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for group members with sub-maintainer role to change the title of privately accessible deploy keys associated with projects in the group.

    Published 21 Feb 2024 · NVD
  17. High 8.5

    CVE-2024-21678 · Confluence

    This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to confidentiality, low impact to integrity, no impact to availability, and requires no user interaction. Data Center…

    Published 20 Feb 2024 · Fixed in 7.19.19, 8.5.5, 8.7.2 · NVD
  18. High 7.5

    CVE-2024-22019 · Node.js

    A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard…

    Published 20 Feb 2024 · Fixed in 18.19.1, 20.11.1, 21.6.2 · NVD
  19. Critical 9.8

    CVE-2024-21896 · Node.js

    The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which…

    Published 20 Feb 2024 · Fixed in 20.11.1, 21.6.2 · NVD
  20. High 7.8

    CVE-2024-21892 · Node.js

    On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to…

    Published 20 Feb 2024 · Fixed in 18.19.1, 20.11.1, 21.6.2 · NVD
  21. High 8.8

    CVE-2024-21891 · Node.js

    Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued,…

    Published 20 Feb 2024 · Fixed in 20.11.1, 21.6.2 · NVD
  22. Medium 6.5

    CVE-2024-21890 · Node.js

    The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that…

    Published 20 Feb 2024 · Fixed in 20.11.1, 21.6.2 · NVD
  23. Medium 4.4

    CVE-2024-20984 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server : Security : Firewall). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 17 Feb 2024 · NVD
  24. Medium 4.9

    CVE-2024-20982 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Feb 2024 · NVD
  25. Medium 4.9

    CVE-2024-20978 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Feb 2024 · NVD
  26. Medium 4.9

    CVE-2024-20976 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Feb 2024 · NVD
  27. Medium 4.9

    CVE-2024-20974 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Feb 2024 · NVD
  28. Medium 4.9

    CVE-2024-20972 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Feb 2024 · NVD
  29. Medium 4.9

    CVE-2024-20970 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Feb 2024 · NVD
  30. Medium 4.4

    CVE-2024-20968 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Feb 2024 · NVD
  31. Medium 4.9

    CVE-2024-20966 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Feb 2024 · NVD
  32. Medium 5.3

    CVE-2024-20964 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 17 Feb 2024 · NVD
  33. Medium 6.5

    CVE-2024-20962 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Feb 2024 · NVD
  34. Medium 6.5

    CVE-2024-20960 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: RAPID). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Feb 2024 · NVD
  35. Medium 4.7

    CVE-2024-20945 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows low…

    Published 17 Feb 2024 · NVD
  36. Low 3.1

    CVE-2024-20925 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM…

    Published 17 Feb 2024 · NVD
  37. Low 3.1

    CVE-2024-20923 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM…

    Published 17 Feb 2024 · NVD
  38. Medium 5.9

    CVE-2024-20921 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows…

    Published 17 Feb 2024 · NVD
  39. Medium 5.9

    CVE-2024-20919 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows…

    Published 17 Feb 2024 · NVD
  40. Critical 9.1

    CVE-2024-20720 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.

    Published 15 Feb 2024 · NVD
  41. Critical 9.1

    CVE-2024-20719 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, that could be leveraged to gain admin access.

    Published 15 Feb 2024 · NVD
  42. Medium 6.5

    CVE-2024-20718 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing actions they did not intend to do, which could be used to bypass security measures and gain unauthorized access. Exploitation of this issue…

    Published 15 Feb 2024 · NVD
  43. Medium 5.4

    CVE-2024-20717 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 15 Feb 2024 · NVD
  44. Medium 4.9

    CVE-2024-20716 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to an application denial-of-service. A high-privileged attacker could leverage this vulnerability to exhaust system resources, causing the application to slow down or crash. Exploitation of this issue does not require user interaction.

    Published 15 Feb 2024 · NVD
  45. High 7.5

    CVE-2024-24990 · nginx

    When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support…

    Published 14 Feb 2024 · Fixed in 1.25.4 · NVD
  46. High 7.5

    CVE-2024-24989 · nginx

    When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . NOTE: Software versions which have reached End of Technical Support…

    Published 14 Feb 2024 · NVD
  47. High 7.5

    CVE-2024-21404 · .NET

    .NET Denial of Service Vulnerability

    Published 13 Feb 2024 · Fixed in 6.0.27, 7.0.16, 8.0.2 · NVD
  48. High 7.5

    CVE-2024-21386 · .NET

    .NET Denial of Service Vulnerability

    Published 13 Feb 2024 · Fixed in 6.0.27, 7.0.16, 8.0.2 · NVD
  49. Medium 6.5

    CVE-2024-1250 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.8 before 16.8.2. When a user is assigned a custom role with manage_group_access_tokens permission, they may be able to create group access tokens with Owner privileges, which may lead to privilege escalation.

    Published 12 Feb 2024 · Fixed in 16.8.2 · NVD
  50. High 8.0

    CVE-2024-0985 · PostgreSQL

    Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the…

    Published 8 Feb 2024 · Fixed in 13.14, 14.11, 15.6 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.