UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
250
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Medium 6.5

    CVE-2023-6564 · GitLab

    An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push and/or merge to protected branches, there may have been instances in which subgroup members with the Developer role were able to push or merge to protected branches.

    Published 8 Feb 2024 · NVD
  2. Medium 6.5

    CVE-2024-1066 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 13.3.0 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows an attacker to do a resource exhaustion using GraphQL `vulnerabilitiesCountByDay`

    Published 7 Feb 2024 · Fixed in 16.6.7, 16.7.5, 16.8.2 · NVD
  3. Medium 6.7

    CVE-2023-6840 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maintainer to change the name of a protected branch that bypasses the security policy added to block MR.

    Published 7 Feb 2024 · Fixed in 16.6.7, 16.7.5, 16.8.2 · NVD
  4. Medium 6.5

    CVE-2023-6736 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 11.3 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted content in the CODEOWNERS file.

    Published 7 Feb 2024 · Fixed in 16.7.6, 16.8.3 · NVD
  5. High 8.1

    CVE-2024-24934 · Elementor

    Elementor Website Builder – more than just a page builder: Path Traversal

    Published 7 Feb 2024 · Fixed in 3.19.1 · NVD, WPVulnerability
  6. Medium 5.4

    CVE-2024-0506 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 7 Feb 2024 · Fixed in 3.19.0 · NVD, WPVulnerability
  7. Medium 5.3

    CVE-2024-0853 · curl

    curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.

    Published 3 Feb 2024 · NVD
  8. High 7.8

    CVE-2024-24557 · Docker Engine

    Classic builder cache poisoning

    Published 1 Feb 2024 · Fixed in 23.0.10, 24.0.9, 25.0.2 · NVD, Project advisories (GitHub)
  9. Medium 6.1

    CVE-2024-23834 · Discourse

    Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. The vulnerability is patched in 3.1.5 and 3.2.0.beta5. As a workaround, ensure Content Security Policy is enabled and does not include `unsafe-inline`.

    Published 30 Jan 2024 · Fixed in 3.1.5, 3.2.0 · NVD
  10. Medium 5.5

    CVE-2024-0727 · OpenSSL

    Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be…

    Published 26 Jan 2024 · Fixed in 1.1.1x, 3.0.13, 3.1.5 · NVD
  11. Medium 6.5

    CVE-2023-6159 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a `Cargo.toml` containing maliciously crafted input.

    Published 26 Jan 2024 · Fixed in 16.6.6, 16.7.4 · NVD
  12. Medium 5.3

    CVE-2023-5612 · GitLab

    An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.

    Published 26 Jan 2024 · Fixed in 16.6.6, 16.7.4 · NVD
  13. Medium 4.3

    CVE-2024-0456 · GitLab

    An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project

    Published 26 Jan 2024 · Fixed in 16.6.6, 16.7.4 · NVD
  14. Critical 9.9

    CVE-2024-0402 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace.

    Published 26 Jan 2024 · Fixed in 16.5.8, 16.6.6, 16.7.4 · NVD
  15. Medium 5.4

    CVE-2023-5933 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests.

    Published 26 Jan 2024 · Fixed in 16.6.6, 16.7.4 · NVD
  16. Critical 9.8

    CVE-2023-6933 · Better Search Replace (WordPress plugin)

    Better Search Replace: Deserialization of Untrusted Data

    Published 24 Jan 2024 · Fixed in 1.4.5 · WPVulnerability
  17. Medium 5.3

    CVE-2024-21733 · Apache Tomcat

    Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.

    Published 19 Jan 2024 · Fixed in 8.5.64, 9.0.44 · NVD
  18. Unrated

    CVE-2026-10818 · WPForms

    Vulnerability in WPForms Pro

    Published 19 Jan 2024 · Fixed in 2.0.0 · WPVulnerability
  19. Medium 6.1

    CVE-2023-7063 · WPForms

    WPForms Pro: Cross-site Scripting

    Published 19 Jan 2024 · Fixed in 1.8.5.4 · NVD, WPVulnerability
  20. Low 3.7

    CVE-2024-22403 · Nextcloud

    Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth…

    Published 18 Jan 2024 · Fixed in 28.0.0 · NVD
  21. Medium 5.4

    CVE-2023-6701 · Advanced Custom Fields

    Advanced Custom Fields (ACF®): Cross-site Scripting

    Published 17 Jan 2024 · Fixed in 6.2.5 · NVD, WPVulnerability
  22. Medium 6.5

    CVE-2024-20985 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jan 2024 · NVD
  23. Medium 4.9

    CVE-2024-20983 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 16 Jan 2024 · NVD
  24. Medium 4.9

    CVE-2024-20981 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jan 2024 · NVD
  25. Medium 6.5

    CVE-2024-20977 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jan 2024 · NVD
  26. Medium 6.5

    CVE-2024-20975 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 16 Jan 2024 · NVD
  27. Medium 6.5

    CVE-2024-20973 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jan 2024 · NVD
  28. Medium 4.9

    CVE-2024-20971 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 16 Jan 2024 · NVD
  29. Medium 5.5

    CVE-2024-20969 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jan 2024 · NVD
  30. Medium 5.5

    CVE-2024-20967 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 16 Jan 2024 · NVD
  31. Medium 4.9

    CVE-2024-20965 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 16 Jan 2024 · NVD
  32. Medium 6.5

    CVE-2024-20963 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 16 Jan 2024 · NVD
  33. Medium 6.5

    CVE-2024-20961 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jan 2024 · NVD
  34. High 7.4

    CVE-2024-20952 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows…

    Published 16 Jan 2024 · Fixed in 11.0.24, 17.0.10, 21.0.2 · NVD
  35. High 7.5

    CVE-2024-20932 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 17.0.9; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 21.3.8 and 22.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple…

    Published 16 Jan 2024 · NVD
  36. Medium 5.9

    CVE-2024-20926 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with…

    Published 16 Jan 2024 · NVD
  37. Low 2.5

    CVE-2024-20922 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition…

    Published 16 Jan 2024 · NVD
  38. High 7.4

    CVE-2024-20918 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows…

    Published 16 Jan 2024 · NVD
  39. High 7.5

    CVE-2023-22512 · Confluence

    This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS Score of 7.5, this vulnerability allows an unauthenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a vulnerable host (Confluence instance) connected to a network, which has no…

    Published 16 Jan 2024 · Fixed in 7.19.14, 8.5.1 · NVD
  40. High 7.5

    CVE-2024-21674 · Confluence

    This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.6 and a CVSS Vector of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N allows an unauthenticated attacker to expose assets in your environment susceptible to exploitation which has high impact to…

    Published 16 Jan 2024 · Fixed in 7.19.18, 8.5.5, 8.7.2 · NVD
  41. High 8.8

    CVE-2024-21673 · Confluence

    This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.0 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H allows an authenticated attacker to expose assets in your environment susceptible to exploitation which has high impact to…

    Published 16 Jan 2024 · Fixed in 7.19.18, 8.5.5, 8.7.2 · NVD
  42. High 8.8

    CVE-2024-21672 · Confluence

    This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server. Remote Code Execution (RCE) vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H allows an unauthenticated attacker to remotely expose assets in your environment susceptible to exploitation which has high impact to…

    Published 16 Jan 2024 · Fixed in 7.19.18, 8.5.5, 8.7.2 · NVD
  43. Critical 9.8Actively exploited

    CVE-2023-22527 · Confluence

    A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates.…

    Published 16 Jan 2024 · Fixed in 8.5.4 · NVD
  44. High 8.8

    CVE-2023-22526 · Confluence

    This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian…

    Published 16 Jan 2024 · Fixed in 7.19.17, 8.5.5, 8.7.2 · NVD
  45. Unrated

    WPV-536b163abc4b · Advanced Custom Fields Pro (WordPress plugin)

    Vulnerability in Advanced Custom Field Pro

    Published 16 Jan 2024 · Fixed in 6.2.5 · WPVulnerability
  46. Unrated

    WPV-364a4a1f8e18 · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Published 16 Jan 2024 · Fixed in 6.2.5 · WPVulnerability
  47. Medium 6.5

    CVE-2024-0405 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): SQL Injection

    Published 16 Jan 2024 · Fixed in 1.5.4 · WPVulnerability
  48. Medium 4.3

    CVE-2024-21655 · Discourse

    Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4.

    Published 12 Jan 2024 · Fixed in 3.1.4 · NVD
  49. Medium 4.3

    CVE-2023-49099 · Discourse

    Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4.

    Published 12 Jan 2024 · Fixed in 3.1.4 · NVD
  50. High 7.5

    CVE-2023-48297 · Discourse

    Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions (@all and @here) which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5.

    Published 12 Jan 2024 · Fixed in 3.1.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.