UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,126
Published in 7 days
620
Critical in 30 days
389
Actively exploited
420

Latest vulnerabilities

38,126 vulnerabilities
  1. Medium 5.5

    CVE-2023-46835 · Xen

    The current setup of the quarantine page tables assumes that the quarantine domain (dom_io) has been initialized with an address width of DEFAULT_DOMAIN_ADDRESS_WIDTH (48) and hence 4 page table levels. However dom_io being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum (hot pluggable) RAM address, and hence on systems with no RAM above the 512GB mark only 3 page-table…

    Published 5 Jan 2024 · NVD
  2. Medium 5.5

    CVE-2023-34328 · Xen

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of the guest state, leading to denials of service. 1) CVE-2023-34327 - An HVM vCPU can end up…

    Published 5 Jan 2024 · Fixed in 4.14.0 · NVD
  3. Medium 5.5

    CVE-2023-34327 · Xen

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of the guest state, leading to denials of service. 1) CVE-2023-34327 - An HVM vCPU can end up…

    Published 5 Jan 2024 · NVD
  4. High 7.8

    CVE-2023-34326 · Xen

    The caching invalidation guidelines from the AMD-Vi specification (48882—Rev 3.07-PUB—Oct 2022) is incorrect on some hardware, as devices will malfunction (see stale DMA mappings) if some fields of the DTE are updated but the IOMMU TLB is not flushed. Such stale DMA mappings can point to memory ranges not owned by the guest, thus allowing access to unindented memory regions.

    Published 5 Jan 2024 · NVD
  5. High 7.8

    CVE-2023-34325 · Xen

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] libfsimage contains parsing code for several filesystems, most of them based on grub-legacy code. libfsimage is used by pygrub to inspect guest disks. Pygrub runs as the same user as the toolstack (root in a priviledged domain). At least one issue has been reported to…

    Published 5 Jan 2024 · NVD
  6. Medium 5.5

    CVE-2023-34323 · Xen

    When a transaction is committed, C Xenstored will first check the quota is correct before attempting to commit any nodes. It would be possible that accounting is temporarily negative if a node has been removed outside of the transaction. Unfortunately, some versions of C Xenstored are assuming that the quota cannot be negative and are using assert() to confirm it. This will lead to C Xenstored…

    Published 5 Jan 2024 · Fixed in 4.17.0 · NVD
  7. High 7.8

    CVE-2023-34322 · Xen

    For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV guests run directly the respective shadow page tables. For 64-bit PV guests this means running on the shadow of the guest root page table. In the course of dealing with shortage of memory in the…

    Published 5 Jan 2024 · Fixed in 4.15.0 · NVD
  8. Low 3.3

    CVE-2023-34321 · Xen

    Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest. Unfortunately, the arithmetics in the helpers can overflow and would then result to skip the cache cleaning/invalidation. Therefore there is…

    Published 5 Jan 2024 · NVD
  9. High 8.8

    CVE-2023-52222 · WooCommerce

    WooCommerce: Cross-Site Request Forgery (CSRF)

    Published 5 Jan 2024 · Fixed in 8.3.0 · NVD, WPVulnerability
  10. Medium 6.1

    CVE-2023-52322 · SPIP

    ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as alphanumerics.

    Published 4 Jan 2024 · Fixed in 4.1.13, 4.2.7 · NVD
  11. High 7.5

    CVE-2023-50256 · Froxlor

    Froxlor username/surname AND company field Bypass

    Published 3 Jan 2024 · Fixed in 2.1.2 · NVD, Project advisories (GitHub)
  12. High 8.8

    CVE-2024-21622 · Craft CMS

    Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

    Published 3 Jan 2024 · Fixed in 3.9.6 · NVD
  13. Medium 4.3

    CVE-2023-50333 · Mattermost

    Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names.

    Published 2 Jan 2024 · Fixed in 8.1.7 · NVD
  14. Medium 4.3

    CVE-2023-48732 · Mattermost

    Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.

    Published 2 Jan 2024 · Fixed in 8.1.7 · NVD
  15. Medium 4.3

    CVE-2023-47858 · Mattermost

    Mattermost fails to properly verify the permissions needed for viewing archived public channels,  allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams/<team-id>/channels/deleted endpoint.

    Published 2 Jan 2024 · Fixed in 9.0.5, 9.1.4, 9.2.3 · NVD
  16. Medium 6.1

    CVE-2024-21628 · PrestaShop

    XSS can be stored in DB from "add a message form" in order detail page (FO)

    Published 2 Jan 2024 · Fixed in 8.1.3 · NVD, Project advisories (GitHub)
  17. Medium 6.1

    CVE-2024-21627 · PrestaShop

    Some attribute not escaped in Validate::isCleanHTML method

    Published 2 Jan 2024 · Fixed in 1.7.8.11, 8.1.3 · NVD, Project advisories (GitHub)
  18. High 8.8

    CVE-2023-7114 · Mattermost

    Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server.

    Published 29 Dec 2023 · Fixed in 2.10.1 · NVD
  19. Medium 6.1

    CVE-2023-7113 · Mattermost

    Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.

    Published 29 Dec 2023 · Fixed in 8.1.7 · NVD
  20. High 7.3

    CVE-2023-7104 · SQLite

    A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.

    Published 29 Dec 2023 · NVD
  21. Critical 9.8

    CVE-2023-51467 · Apache OFBiz

    The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code

    Published 26 Dec 2023 · Fixed in 18.12.11 · NVD
  22. High 7.5

    CVE-2023-50968 · Apache OFBiz

    Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.

    Published 26 Dec 2023 · Fixed in 18.12.11 · NVD
  23. Medium 4.8

    CVE-2023-6290 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 26 Dec 2023 · Fixed in 7.3 · WPVulnerability
  24. Medium 4.3

    CVE-2023-48652 · Concrete CMS

    Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker can force an admin user to delete server report logs on a web application to which they are currently authenticated.

    Published 25 Dec 2023 · Fixed in 9.2.3 · NVD
  25. Medium 4.9

    CVE-2023-30451 · TYPO3

    Path Traversal in TYPO3 File Abstraction Layer Storages

    Published 25 Dec 2023 · NVD, Project advisories (GitHub)
  26. High 7.0

    CVE-2023-51767 · OpenSSH

    OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who…

    Published 24 Dec 2023 · NVD
  27. Medium 5.3

    CVE-2023-51766 · Exim

    Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not.

    Published 24 Dec 2023 · Fixed in 4.97.1 · NVD
  28. Medium 5.3

    CVE-2023-51764 · Postfix

    Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs…

    Published 24 Dec 2023 · Fixed in 3.6.13, 3.7.9, 3.8.4 · NVD
  29. High 8.8

    CVE-2023-7090 · sudo

    A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.

    Published 23 Dec 2023 · Fixed in 1.8.28 · NVD
  30. Critical 9.8

    CVE-2023-49792 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a (reverse) proxy is configured as trusted proxy the server could be tricked into reading a wrong remote address for an attacker, allowing…

    Published 22 Dec 2023 · Fixed in 25.0.13.4, 26.0.9, 27.1.4 · NVD
  31. Medium 5.4

    CVE-2023-49791 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an active session of another user via another way, they could delete and modify workflows by sending…

    Published 22 Dec 2023 · Fixed in 25.0.13.4, 26.0.9, 27.1.4 · NVD
  32. High 7.0

    CVE-2023-42465 · sudo

    Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.

    Published 22 Dec 2023 · Fixed in 1.9.15 · NVD
  33. High 7.5

    CVE-2023-51713 · ProFTPD

    make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics.

    Published 22 Dec 2023 · Fixed in 1.3.8a · NVD
  34. Medium 6.1

    CVE-2023-51704 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group-*-member messages can result in XSS on Special:log/rights.

    Published 22 Dec 2023 · Fixed in 1.35.14, 1.39.6, 1.40.2 · NVD
  35. Medium 5.4

    CVE-2023-48116 · SmarterMail

    SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment.

    Published 21 Dec 2023 · Fixed in 16.0.8747 · NVD
  36. Medium 5.4

    CVE-2023-48115 · SmarterMail

    SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainText are set in the same request.

    Published 21 Dec 2023 · Fixed in 16.0.8747 · NVD
  37. Medium 5.4

    CVE-2023-48114 · SmarterMail

    SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This occurs because the application tries to allow youtube.com URLs, but actually allows youtube.com followed by an @ character and an attacker-controlled domain name.

    Published 21 Dec 2023 · Fixed in 16.0.8747 · NVD
  38. Medium 6.5

    CVE-2023-50783 · Apache Airflow

    Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification. Users are recommended to upgrade to 2.8.0, which fixes this issue

    Published 21 Dec 2023 · Fixed in 2.8.0 · NVD
  39. Medium 6.5

    CVE-2023-49920 · Apache Airflow

    Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent. Users are advised to upgrade to version 2.8.0 or later which…

    Published 21 Dec 2023 · NVD
  40. Medium 4.3

    CVE-2023-48291 · Apache Airflow

    Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2  Users of…

    Published 21 Dec 2023 · Fixed in 2.8.0 · NVD
  41. Medium 5.4

    CVE-2023-47265 · Apache Airflow

    Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exit the browser sandbox or manipulation of the…

    Published 21 Dec 2023 · NVD
  42. Medium 5.4

    CVE-2023-51462 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 20 Dec 2023 · Fixed in 2023.11.0 · NVD
  43. Medium 5.4

    CVE-2023-51461 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 20 Dec 2023 · Fixed in 2023.11.0 · NVD
  44. Medium 5.4

    CVE-2023-51460 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 20 Dec 2023 · Fixed in 2023.11.0 · NVD
  45. Medium 5.4

    CVE-2023-51459 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 20 Dec 2023 · Fixed in 2023.11.0 · NVD
  46. Medium 5.4

    CVE-2023-51458 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 20 Dec 2023 · Fixed in 2023.11.0 · NVD
  47. Medium 5.4

    CVE-2023-51457 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 20 Dec 2023 · Fixed in 2023.11.0 · NVD
  48. High 7.5

    CVE-2023-6977 · MLflow

    This vulnerability enables malicious users to read sensitive files on the server.

    Published 20 Dec 2023 · Fixed in 2.9.2 · NVD
  49. High 8.8

    CVE-2023-6976 · MLflow

    This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.

    Published 20 Dec 2023 · Fixed in 2.9.2 · NVD
  50. Critical 9.8

    CVE-2023-6975 · MLflow

    A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.

    Published 20 Dec 2023 · Fixed in 2.9.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.