UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,187
Published in 7 days
616
Critical in 30 days
389
Actively exploited
420

Latest vulnerabilities

38,187 vulnerabilities
  1. High 8.1

    CVE-2023-5332 · GitLab

    Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.

    Published 4 Dec 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  2. Medium 5.3

    CVE-2023-49948 · Forgejo

    Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL.

    Published 3 Dec 2023 · Fixed in 1.20.5-1 · NVD
  3. High 7.5

    CVE-2023-49947 · Forgejo

    Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.

    Published 3 Dec 2023 · Fixed in 1.20.5-1 · NVD
  4. Critical 9.1

    CVE-2023-49946 · Forgejo

    In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions.

    Published 3 Dec 2023 · Fixed in 1.20.5-1 · NVD
  5. High 7.5

    CVE-2023-49288 · Squid

    SQUID-2023:9 Denial of Service in HTTP Collapsed Forwarding

    Published 2 Dec 2023 · Fixed in 6.0.1 · NVD, Project advisories (GitHub)
  6. High 7.5

    CVE-2023-49286 · Squid

    SQUID-2023:8 Denial of Service in Helper Process management

    Published 2 Dec 2023 · Fixed in 6.5 · NVD, Project advisories (GitHub)
  7. High 7.5

    CVE-2023-49285 · Squid

    SQUID-2023:7 Denial of Service in HTTP Message Processing

    Published 2 Dec 2023 · Fixed in 6.5 · NVD, Project advisories (GitHub)
  8. Medium 6.1

    CVE-2023-49276 · Uptime Kuma

    Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting (XSS). Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. This…

    Published 1 Dec 2023 · Fixed in 1.23.7 · NVD
  9. Medium 5.4

    CVE-2023-6033 · GitLab

    Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3, 16.6.1 · NVD
  10. High 7.5

    CVE-2023-5995 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the policy bot to gain access to internal projects.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD
  11. High 7.5

    CVE-2023-5226 · GitLab

    An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted branch name to manipulate repository content in the UI.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD
  12. Medium 6.5

    CVE-2023-4912 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted mermaid diagram input.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD
  13. Low 3.1

    CVE-2023-4658 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest user, when granted the permission through a group.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD
  14. Medium 4.3

    CVE-2023-4317 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an unprotected branch to a protected branch.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD
  15. Medium 4.3

    CVE-2023-3964 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled in the project settings.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD
  16. Medium 5.3

    CVE-2023-3949 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a public projects' release descriptions via an atom endpoint when release access on the public was set to only project members.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD
  17. Medium 4.3

    CVE-2023-3443 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD
  18. Medium 6.5

    CVE-2023-49076 · Pimcore

    Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5.

    Published 30 Nov 2023 · Fixed in 4.0.5 · NVD
  19. High 8.8

    CVE-2023-6528 · Slider Revolution

    Slider Revolution: Code Injection

    Published 30 Nov 2023 · Fixed in 6.6.19 · NVD, WPVulnerability
  20. High 7.2

    CVE-2023-6449 · Contact Form 7

    Contact Form 7: Unrestricted Upload of File with Dangerous Type

    Published 30 Nov 2023 · Fixed in 5.8.4 · NVD, WPVulnerability
  21. High 7.2

    CVE-2023-6218 · MOVEit Transfer

    In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified.  It is possible for a group administrator to elevate a group members permissions to the role of an organization administrator.

    Published 29 Nov 2023 · Fixed in 2022.1.10, 2023.0.7, 2023.1.2 · NVD
  22. Medium 6.1

    CVE-2023-6217 · MOVEit Transfer

    In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer.  An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user…

    Published 29 Nov 2023 · Fixed in 2022.1.10, 2023.0.7, 2023.1.2 · NVD
  23. High 7.5

    CVE-2023-40626 · Joomla!

    The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.

    Published 29 Nov 2023 · Fixed in 3.10.14, 4.4.1 · NVD
  24. High 8.8

    CVE-2023-49097 · ZITADEL

    Account Takeover via Malicious Host Header Injection

    Published 29 Nov 2023 · Fixed in 2.39.9, 2.40.10, 2.41.6 · NVD, Project advisories (GitHub)
  25. Low

    CVE-2022-2232 · Keycloak

    LDAP Injection on UsernameForm Login

    Published 29 Nov 2023 · Fixed in 23.0.1 · Project advisories (GitHub)
  26. Medium 5.4

    CVE-2023-44383 · October CMS

    Stored XSS by authenticated backend user with improper configuration

    Published 29 Nov 2023 · Fixed in 3.5.2 · NVD, Project advisories (GitHub)
  27. Medium 4.9

    CVE-2023-44381 · October CMS

    Safe mode bypass using Page template injection

    Published 29 Nov 2023 · Fixed in 3.4.15 · NVD, Project advisories (GitHub)
  28. Critical 9.1

    CVE-2023-44382 · October CMS

    Safe mode bypass using Twig sandbox escape

    Published 29 Nov 2023 · Fixed in 3.4.15 · NVD, Project advisories (GitHub)
  29. High 8.2

    CVE-2023-45539 · HAProxy

    HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

    Published 28 Nov 2023 · Fixed in 2.8.2 · NVD
  30. High 7.5

    CVE-2023-30590 · Node.js

    The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The…

    Published 28 Nov 2023 · Fixed in 16.20.1, 18.16.1, 20.3.1 · NVD
  31. Medium 5.3

    CVE-2023-30588 · Node.js

    When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that…

    Published 28 Nov 2023 · Fixed in 16.20.1, 18.16.1, 20.3.1 · NVD
  32. Medium 6.5

    CVE-2023-42504 · Apache Superset

    An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0

    Published 28 Nov 2023 · Fixed in 3.0.0 · NVD
  33. Medium 4.3

    CVE-2023-42505 · Apache Superset

    An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0.

    Published 28 Nov 2023 · Fixed in 3.0.0 · NVD
  34. Medium 5.4

    CVE-2023-42502 · Apache Superset

    An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

    Published 28 Nov 2023 · Fixed in 3.0.0 · NVD
  35. High 7.5

    CVE-2023-46589 · Apache Tomcat

    Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request…

    Published 28 Nov 2023 · Fixed in 8.5.96, 9.0.83, 10.1.16 · NVD
  36. High 8.8

    CVE-2022-41678 · Apache ActiveMQ

    Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper…

    Published 28 Nov 2023 · Fixed in 5.16.6, 5.17.4 · NVD
  37. High 8.8

    CVE-2023-4226 · Chamilo LMS

    Unrestricted file upload in `/main/inc/ajax/work.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.

    Published 28 Nov 2023 · NVD
  38. High 8.8

    CVE-2023-4225 · Chamilo LMS

    Unrestricted file upload in `/main/inc/ajax/exercise.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.

    Published 28 Nov 2023 · NVD
  39. High 8.8

    CVE-2023-4224 · Chamilo LMS

    Unrestricted file upload in `/main/inc/ajax/dropbox.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.

    Published 28 Nov 2023 · NVD
  40. High 8.8

    CVE-2023-4223 · Chamilo LMS

    Unrestricted file upload in `/main/inc/ajax/document.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.

    Published 28 Nov 2023 · NVD
  41. High 8.8

    CVE-2023-4222 · Chamilo LMS

    Command injection in `main/lp/openoffice_text_document.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.

    Published 28 Nov 2023 · NVD
  42. High 8.8

    CVE-2023-4221 · Chamilo LMS

    Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.

    Published 28 Nov 2023 · NVD
  43. Medium 6.1

    CVE-2023-4220 · Chamilo LMS

    Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.

    Published 28 Nov 2023 · NVD
  44. High 7.5

    CVE-2023-30585 · Node.js

    A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the "msiexec.exe" process, running under the NT AUTHORITY\SYSTEM context, attempts to read the %USERPROFILE% environment variable from the current user's registry.…

    Published 28 Nov 2023 · Fixed in 16.20.1, 18.16.1, 20.3.1 · NVD
  45. High 7.8

    CVE-2023-4931 · Plesk

    Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll, propsys.dll and profapi.dll files.

    Published 27 Nov 2023 · NVD
  46. Medium 5.4

    CVE-2023-43701 · Apache Superset

    Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2.  Users are recommended to upgrade to version 2.1.2, which fixes this…

    Published 27 Nov 2023 · Fixed in 2.1.2 · NVD
  47. Medium 4.3

    CVE-2023-42501 · Apache Superset

    Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache Superset: before 2.1.2. Users should upgrade to version or above 2.1.2 and run `superset init` to reconstruct the Gamma role or remove `can_read` permission from the mentioned resources.

    Published 27 Nov 2023 · Fixed in 2.1.1 · NVD
  48. High 8.8

    CVE-2023-40610 · Apache Superset

    Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the…

    Published 27 Nov 2023 · Fixed in 2.1.2 · NVD
  49. Medium 4.3

    CVE-2023-6202 · Mattermost

    Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.

    Published 27 Nov 2023 · NVD
  50. Medium 5.3

    CVE-2023-48369 · Mattermost

    Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log.

    Published 27 Nov 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.