Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 38,777
- Published in 7 days
- 591
- Critical in 30 days
- 387
- Actively exploited
- 420
Latest vulnerabilities
38,777 vulnerabilities- Medium 4.7
CVE-2023-46836 · Xen
The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one unconditionally, and one conditionally on whether XPTI was active. As BTC/SRSO and…
Published 5 Jan 2024 · NVD - Medium 5.5
CVE-2023-46835 · Xen
The current setup of the quarantine page tables assumes that the quarantine domain (dom_io) has been initialized with an address width of DEFAULT_DOMAIN_ADDRESS_WIDTH (48) and hence 4 page table levels. However dom_io being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum (hot pluggable) RAM address, and hence on systems with no RAM above the 512GB mark only 3 page-table…
Published 5 Jan 2024 · NVD - Medium 5.5
CVE-2023-34328 · Xen
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of the guest state, leading to denials of service. 1) CVE-2023-34327 - An HVM vCPU can end up…
Published 5 Jan 2024 · Fixed in 4.14.0 · NVD - Medium 5.5
CVE-2023-34327 · Xen
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of the guest state, leading to denials of service. 1) CVE-2023-34327 - An HVM vCPU can end up…
Published 5 Jan 2024 · NVD - High 7.8
CVE-2023-34326 · Xen
The caching invalidation guidelines from the AMD-Vi specification (48882—Rev 3.07-PUB—Oct 2022) is incorrect on some hardware, as devices will malfunction (see stale DMA mappings) if some fields of the DTE are updated but the IOMMU TLB is not flushed. Such stale DMA mappings can point to memory ranges not owned by the guest, thus allowing access to unindented memory regions.
Published 5 Jan 2024 · NVD - High 7.8
CVE-2023-34325 · Xen
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] libfsimage contains parsing code for several filesystems, most of them based on grub-legacy code. libfsimage is used by pygrub to inspect guest disks. Pygrub runs as the same user as the toolstack (root in a priviledged domain). At least one issue has been reported to…
Published 5 Jan 2024 · NVD - Medium 5.5
CVE-2023-34323 · Xen
When a transaction is committed, C Xenstored will first check the quota is correct before attempting to commit any nodes. It would be possible that accounting is temporarily negative if a node has been removed outside of the transaction. Unfortunately, some versions of C Xenstored are assuming that the quota cannot be negative and are using assert() to confirm it. This will lead to C Xenstored…
Published 5 Jan 2024 · Fixed in 4.17.0 · NVD - High 7.8
CVE-2023-34322 · Xen
For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV guests run directly the respective shadow page tables. For 64-bit PV guests this means running on the shadow of the guest root page table. In the course of dealing with shortage of memory in the…
Published 5 Jan 2024 · Fixed in 4.15.0 · NVD - Low 3.3
CVE-2023-34321 · Xen
Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest. Unfortunately, the arithmetics in the helpers can overflow and would then result to skip the cache cleaning/invalidation. Therefore there is…
Published 5 Jan 2024 · NVD - High 8.8
CVE-2023-52222 · WooCommerce
WooCommerce: Cross-Site Request Forgery (CSRF)
Published 5 Jan 2024 · Fixed in 8.3.0 · NVD, WPVulnerability - Medium 6.1
CVE-2023-52322 · SPIP
ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as alphanumerics.
Published 4 Jan 2024 · Fixed in 4.1.13, 4.2.7 · NVD - High 7.5
CVE-2023-50256 · Froxlor
Froxlor username/surname AND company field Bypass
Published 3 Jan 2024 · Fixed in 2.1.2 · NVD, Project advisories (GitHub) - High 8.8
CVE-2024-21622 · Craft CMS
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.
Published 3 Jan 2024 · Fixed in 3.9.6 · NVD - Medium 4.3
CVE-2023-50333 · Mattermost
Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names.
Published 2 Jan 2024 · Fixed in 8.1.7 · NVD - Medium 4.3
CVE-2023-48732 · Mattermost
Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.
Published 2 Jan 2024 · Fixed in 8.1.7 · NVD - Medium 4.3
CVE-2023-47858 · Mattermost
Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams/<team-id>/channels/deleted endpoint.
Published 2 Jan 2024 · Fixed in 9.0.5, 9.1.4, 9.2.3 · NVD - Medium 6.1
CVE-2024-21628 · PrestaShop
XSS can be stored in DB from "add a message form" in order detail page (FO)
Published 2 Jan 2024 · Fixed in 8.1.3 · NVD, Project advisories (GitHub) - Medium 6.1
CVE-2024-21627 · PrestaShop
Some attribute not escaped in Validate::isCleanHTML method
Published 2 Jan 2024 · Fixed in 1.7.8.11, 8.1.3 · NVD, Project advisories (GitHub) - High 8.8
CVE-2023-7114 · Mattermost
Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server.
Published 29 Dec 2023 · Fixed in 2.10.1 · NVD - Medium 6.1
CVE-2023-7113 · Mattermost
Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.
Published 29 Dec 2023 · Fixed in 8.1.7 · NVD - High 7.3
CVE-2023-7104 · SQLite
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.
Published 29 Dec 2023 · NVD - Critical 9.8
CVE-2023-51467 · Apache OFBiz
The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code
Published 26 Dec 2023 · Fixed in 18.12.11 · NVD - High 7.5
CVE-2023-50968 · Apache OFBiz
Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.
Published 26 Dec 2023 · Fixed in 18.12.11 · NVD - Medium 4.8
CVE-2023-6290 · WP Seopress (WordPress plugin)
SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting
Published 26 Dec 2023 · Fixed in 7.3 · WPVulnerability - Medium 4.3
CVE-2023-48652 · Concrete CMS
Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker can force an admin user to delete server report logs on a web application to which they are currently authenticated.
Published 25 Dec 2023 · Fixed in 9.2.3 · NVD - Medium 4.9
CVE-2023-30451 · TYPO3
Path Traversal in TYPO3 File Abstraction Layer Storages
Published 25 Dec 2023 · NVD, Project advisories (GitHub) - High 7.0
CVE-2023-51767 · OpenSSH
OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who…
Published 24 Dec 2023 · NVD - Medium 5.3
CVE-2023-51766 · Exim
Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not.
Published 24 Dec 2023 · Fixed in 4.97.1 · NVD - Medium 5.3
CVE-2023-51764 · Postfix
Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs…
Published 24 Dec 2023 · Fixed in 3.6.13, 3.7.9, 3.8.4 · NVD - High 8.8
CVE-2023-7090 · sudo
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
Published 23 Dec 2023 · Fixed in 1.8.28 · NVD - Critical 9.8
CVE-2023-49792 · Nextcloud
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a (reverse) proxy is configured as trusted proxy the server could be tricked into reading a wrong remote address for an attacker, allowing…
Published 22 Dec 2023 · Fixed in 25.0.13.4, 26.0.9, 27.1.4 · NVD - Medium 5.4
CVE-2023-49791 · Nextcloud
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an active session of another user via another way, they could delete and modify workflows by sending…
Published 22 Dec 2023 · Fixed in 25.0.13.4, 26.0.9, 27.1.4 · NVD - High 7.0
CVE-2023-42465 · sudo
Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.
Published 22 Dec 2023 · Fixed in 1.9.15 · NVD - High 7.5
CVE-2023-51713 · ProFTPD
make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics.
Published 22 Dec 2023 · Fixed in 1.3.8a · NVD - Medium 6.1
CVE-2023-51704 · MediaWiki
An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group-*-member messages can result in XSS on Special:log/rights.
Published 22 Dec 2023 · Fixed in 1.35.14, 1.39.6, 1.40.2 · NVD - Medium 5.4
CVE-2023-48116 · SmarterMail
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment.
Published 21 Dec 2023 · Fixed in 16.0.8747 · NVD - Medium 5.4
CVE-2023-48115 · SmarterMail
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainText are set in the same request.
Published 21 Dec 2023 · Fixed in 16.0.8747 · NVD - Medium 5.4
CVE-2023-48114 · SmarterMail
SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This occurs because the application tries to allow youtube.com URLs, but actually allows youtube.com followed by an @ character and an attacker-controlled domain name.
Published 21 Dec 2023 · Fixed in 16.0.8747 · NVD - Medium 6.5
CVE-2023-50783 · Apache Airflow
Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification. Users are recommended to upgrade to 2.8.0, which fixes this issue
Published 21 Dec 2023 · Fixed in 2.8.0 · NVD - Medium 6.5
CVE-2023-49920 · Apache Airflow
Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent. Users are advised to upgrade to version 2.8.0 or later which…
Published 21 Dec 2023 · NVD - Medium 4.3
CVE-2023-48291 · Apache Airflow
Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 Users of…
Published 21 Dec 2023 · Fixed in 2.8.0 · NVD - Medium 5.4
CVE-2023-47265 · Apache Airflow
Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exit the browser sandbox or manipulation of the…
Published 21 Dec 2023 · NVD - Medium 5.4
CVE-2023-51462 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 20 Dec 2023 · Fixed in 2023.11.0 · NVD - Medium 5.4
CVE-2023-51461 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 20 Dec 2023 · Fixed in 2023.11.0 · NVD - Medium 5.4
CVE-2023-51460 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 20 Dec 2023 · Fixed in 2023.11.0 · NVD - Medium 5.4
CVE-2023-51459 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 20 Dec 2023 · Fixed in 2023.11.0 · NVD - Medium 5.4
CVE-2023-51458 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 20 Dec 2023 · Fixed in 2023.11.0 · NVD - Medium 5.4
CVE-2023-51457 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 20 Dec 2023 · Fixed in 2023.11.0 · NVD - High 7.5
CVE-2023-6977 · MLflow
This vulnerability enables malicious users to read sensitive files on the server.
Published 20 Dec 2023 · Fixed in 2.9.2 · NVD - High 8.8
CVE-2023-6976 · MLflow
This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.
Published 20 Dec 2023 · Fixed in 2.9.2 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.