UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,179
Published in 7 days
616
Critical in 30 days
389
Actively exploited
420

Latest vulnerabilities

38,179 vulnerabilities
  1. Medium 5.4

    CVE-2023-49273 · Umbraco CMS

    Privilege Escalation using Spoofing

    Published 12 Dec 2023 · Fixed in 8.18.10, 10.8.1, 12.3.4 · NVD, Project advisories (GitHub)
  2. Medium 6.1

    CVE-2023-48313 · Umbraco CMS

    DOM-based stored cross-site scripting

    Published 12 Dec 2023 · Fixed in 10.8.1, 12.3.4 · NVD, Project advisories (GitHub)
  3. Medium 5.3

    CVE-2023-49274 · Umbraco CMS

    SMTP misconfiguration leading to potential registered user email.

    Published 12 Dec 2023 · Fixed in 8.18.10, 10.8.1, 12.3.4 · NVD, Project advisories (GitHub)
  4. Medium 4.3

    CVE-2023-48227 · Umbraco CMS

    Backoffice User can bypass "Publish" restriction

    Published 12 Dec 2023 · Fixed in 8.18.10, 10.7.0, 12.3.0 · NVD, Project advisories (GitHub)
  5. Medium 6.5

    CVE-2023-49089 · Umbraco CMS

    Possible Path traversal when creating packages from backoffice

    Published 12 Dec 2023 · Fixed in 8.18.10, 10.8.1, 12.3.0 · NVD, Project advisories (GitHub)
  6. Medium 5.3

    CVE-2023-49278 · Umbraco CMS

    Brute force exploit can be used to collect valid usernames

    Published 12 Dec 2023 · Fixed in 8.18.10, 10.8.1, 12.3.4 · NVD, Project advisories (GitHub)
  7. Medium 5.4

    CVE-2023-49279 · Umbraco CMS

    Stored XSS via SVG File Upload

    Published 12 Dec 2023 · Fixed in 10.7.0, 11.5.0, 12.2.0 · NVD, Project advisories (GitHub)
  8. Medium 5.4

    CVE-2023-38694 · Umbraco CMS

    Possible injection of HTML in a unintended form

    Published 12 Dec 2023 · Fixed in 8.18.10, 10.7.0, 12.1.0 · NVD, Project advisories (GitHub)
  9. High 8.8

    CVE-2023-6709 · MLflow

    Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.

    Published 12 Dec 2023 · Fixed in 2.9.2 · NVD
  10. Medium 5.3

    CVE-2023-46219 · curl

    When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.

    Published 12 Dec 2023 · Fixed in 8.5.0 · NVD
  11. Medium

    CVE-2023-51769 · Frappe Framework

    Cross-Site Scripting (XSS) Attack on exceptions and Blog Page

    Published 11 Dec 2023 · Fixed in 14.49.0 · Project advisories (GitHub)
  12. Medium 6.5

    CVE-2023-50463 · Caddy

    The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism (trusted_proxy directive in reverse_proxy or IP address range restrictions).

    Published 10 Dec 2023 · NVD
  13. Medium 4.4

    CVE-2023-5870 · PostgreSQL

    A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to…

    Published 10 Dec 2023 · Fixed in 13.13, 14.10, 15.5 · NVD
  14. High 8.8

    CVE-2023-5869 · PostgreSQL

    A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing…

    Published 10 Dec 2023 · Fixed in 13.13, 14.10, 15.5 · NVD
  15. Medium 4.3

    CVE-2023-5868 · PostgreSQL

    A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output…

    Published 10 Dec 2023 · Fixed in 13.13, 14.10, 15.5 · NVD
  16. High 7.8

    CVE-2023-49804 · Uptime Kuma

    Changing Password does not close all logged in socket connections immediately

    Published 10 Dec 2023 · Fixed in 1.3.3, 1.23.9 · NVD, Project advisories (GitHub)
  17. High 8.8

    CVE-2023-49805 · Uptime Kuma

    Missing Origin Validation in WebSockets

    Published 10 Dec 2023 · Fixed in 1.3.3, 1.23.9 · NVD, Project advisories (GitHub)
  18. High 7.5

    CVE-2023-6337 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash. Fixed in Vault 1.15.4, 1.14.8, 1.13.12.

    Published 8 Dec 2023 · Fixed in 1.13.12, 1.14.8, 1.15.4 · NVD
  19. Medium 5.5

    CVE-2023-34320 · Xen

    Cortex-A77 cores (r0p0 and r1p0) are affected by erratum 1508412 where software, under certain circumstances, could deadlock a core due to the execution of either a load to device or non-cacheable memory, and either a store exclusive or register read of the Physical Address Register (PAR_EL1) in close proximity.

    Published 8 Dec 2023 · NVD
  20. Medium 4.9

    CVE-2023-6507 · Python

    An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the…

    Published 8 Dec 2023 · NVD
  21. Critical 9.8

    CVE-2023-50164 · Apache Struts

    An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

    Published 7 Dec 2023 · Fixed in 2.5.33, 6.3.0.2 · NVD
  22. Medium 6.1

    CVE-2023-43103 · Zimbra Collaboration

    An XSS issue was discovered in a web endpoint in Zimbra Collaboration (ZCS) before 10.0.4 via an unsanitized parameter. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch 36.

    Published 7 Dec 2023 · Fixed in 8.8.15, 10.0.4 · NVD
  23. Medium 6.1

    CVE-2023-43102 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4. An XSS issue can be exploited to access the mailbox of an authenticated user. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch 36.

    Published 7 Dec 2023 · Fixed in 8.8.15, 10.0.4 · NVD
  24. Medium 6.1

    CVE-2023-6568 · MLflow

    A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the user without adequate sanitization or escaping, leading to arbitrary JavaScript execution in the…

    Published 7 Dec 2023 · NVD
  25. High 7.5

    CVE-2023-41106 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.3. An attacker can gain access to a Zimbra account. This is also fixed in 9.0.0 Patch 35 and 8.8.15 Patch 42.

    Published 7 Dec 2023 · Fixed in 8.8.15, 10.0.3 · NVD
  26. Medium 6.5

    CVE-2023-46218 · curl

    This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List…

    Published 7 Dec 2023 · NVD
  27. High 8.8

    CVE-2023-48123 · pfSense

    An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php file.

    Published 6 Dec 2023 · NVD
  28. High 7.5

    CVE-2023-46751 · Ghostscript

    An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer.

    Published 6 Dec 2023 · NVD
  29. Medium 5.3

    CVE-2023-6459 · Mattermost

    Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint is revealing channelIDs.

    Published 6 Dec 2023 · Fixed in 7.8.14, 8.1.5 · NVD
  30. Critical 9.8

    CVE-2023-6458 · Mattermost

    Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal.

    Published 6 Dec 2023 · Fixed in 8.1.5, 9.0.3, 9.1.2 · NVD
  31. High 8.8

    CVE-2023-22522 · Confluence

    This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the…

    Published 6 Dec 2023 · Fixed in 8.4.5, 8.5.4, 8.6.2 · NVD
  32. Medium 5.0

    CVE-2023-40053 · SolarWinds Serv-U

    A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function feature of Serv-U, which could be used maliciously.

    Published 6 Dec 2023 · NVD
  33. High 7.5

    CVE-2023-5761 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): SQL Injection

    Published 6 Dec 2023 · Fixed in 1.5.0 · WPVulnerability
  34. High 8.8

    CVE-2023-48777 · Elementor

    Elementor Website Builder – more than just a page builder: Unrestricted Upload of File with Dangerous Type

    Published 6 Dec 2023 · Fixed in 3.18.2 · NVD, WPVulnerability
  35. High 7.8

    CVE-2023-46674 · Elasticsearch

    An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.

    Published 5 Dec 2023 · Fixed in 7.17.11, 8.9.0 · NVD
  36. High 7.5

    CVE-2023-41835 · Apache Struts

    When a Multipart request is performed but some of the fields exceed the maxStringLength  limit, the upload files will remain in struts.multipart.saveDir  even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.

    Published 5 Dec 2023 · Fixed in 2.5.32, 6.3.0.1 · NVD
  37. Low

    GHSA-x9qq-236j-gj97 · LXD

    Improve documentation to make clear restricted.devices.disk=allow without restricted.devices.disk.paths also allows shift=true

    Published 5 Dec 2023 · Project advisories (GitHub)
  38. Critical 9.8

    CVE-2023-49070 · Apache OFBiz

    Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10.  Users are recommended to upgrade to version 18.12.10

    Published 5 Dec 2023 · Fixed in 18.12.10 · NVD
  39. High 7.5

    CVE-2023-43472 · MLflow

    An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API.

    Published 5 Dec 2023 · NVD
  40. Medium 5.9

    CVE-2023-47124 · Traefik

    Potential DDoS whith ACME HTTPChallenge

    Published 4 Dec 2023 · Fixed in 2.10.6, 3.0.0-beta5 · NVD, Project advisories (GitHub)
  41. High 7.5

    CVE-2023-47633 · Traefik

    Uses 100% CPU after request to with host `traefik-service`

    Published 4 Dec 2023 · Fixed in 2.10.6, 3.0.0-beta5 · NVD, Project advisories (GitHub)
  42. Medium 6.5

    CVE-2023-47106 · Traefik

    Incorrect processing of fragment in the URL leads to Authorization Bypass

    Published 4 Dec 2023 · Fixed in 2.10.6, 3.0.0-beta5 · NVD, Project advisories (GitHub)
  43. High 8.1

    CVE-2023-5332 · GitLab

    Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.

    Published 4 Dec 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  44. Medium 5.3

    CVE-2023-49948 · Forgejo

    Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL.

    Published 3 Dec 2023 · Fixed in 1.20.5-1 · NVD
  45. High 7.5

    CVE-2023-49947 · Forgejo

    Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.

    Published 3 Dec 2023 · Fixed in 1.20.5-1 · NVD
  46. Critical 9.1

    CVE-2023-49946 · Forgejo

    In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions.

    Published 3 Dec 2023 · Fixed in 1.20.5-1 · NVD
  47. High 7.5

    CVE-2023-49288 · Squid

    SQUID-2023:9 Denial of Service in HTTP Collapsed Forwarding

    Published 2 Dec 2023 · Fixed in 6.0.1 · NVD, Project advisories (GitHub)
  48. High 7.5

    CVE-2023-49286 · Squid

    SQUID-2023:8 Denial of Service in Helper Process management

    Published 2 Dec 2023 · Fixed in 6.5 · NVD, Project advisories (GitHub)
  49. High 7.5

    CVE-2023-49285 · Squid

    SQUID-2023:7 Denial of Service in HTTP Message Processing

    Published 2 Dec 2023 · Fixed in 6.5 · NVD, Project advisories (GitHub)
  50. Medium 6.1

    CVE-2023-49276 · Uptime Kuma

    Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting (XSS). Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. This…

    Published 1 Dec 2023 · Fixed in 1.23.7 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.