Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 38,777
- Published in 7 days
- 589
- Critical in 30 days
- 387
- Actively exploited
- 420
Latest vulnerabilities
38,777 vulnerabilities- Critical 9.8
CVE-2023-6975 · MLflow
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.
Published 20 Dec 2023 · Fixed in 2.9.2 · NVD - Critical 9.8
CVE-2023-6974 · MLflow
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execution on the victim machine.
Published 20 Dec 2023 · Fixed in 2.9.2 · NVD - High 7.1
CVE-2023-6291 · Keycloak
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
Published 19 Dec 2023 · Fixed in 23.0.3 · Project advisories (GitHub) - Medium
GHSA-7ww5-4wqc-m92c · containerd
RAPL accessible to a container
Published 19 Dec 2023 · Fixed in 1.7.11 · Project advisories (GitHub) - High 8.8
CVE-2023-49736 · Apache Superset
A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue.
Published 19 Dec 2023 · Fixed in 2.1.2, 3.0.2 · NVD - Medium 6.5
CVE-2023-49734 · Apache Superset
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue.
Published 19 Dec 2023 · Fixed in 2.1.2, 3.0.2 · NVD - Medium 6.5
CVE-2023-46104 · Apache Superset
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
Published 19 Dec 2023 · Fixed in 2.1.3, 3.0.1 · NVD - High 8.8
CVE-2023-6940 · MLflow
with only one user interaction(download a malicious config), attackers can gain full command execution on the victim system.
Published 19 Dec 2023 · Fixed in 2.9.2 · NVD - Medium 6.5
CVE-2023-51385 · OpenSSH
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.
Published 18 Dec 2023 · Fixed in 9.6 · NVD - Medium 5.5
CVE-2023-51384 · OpenSSH
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.
Published 18 Dec 2023 · Fixed in 9.6 · NVD - Critical 9.8
CVE-2023-47118 · ClickHouse
Heap buffer overflow in T64 codec decompression
Published 18 Dec 2023 · Fixed in 23.9.2.47475, 23.9.4.11, 23.10.2.13 · NVD, Project advisories (GitHub) - High 7.5
CVE-2023-48298 · ClickHouse
Unauthenticated Integer underflow leading to stack overflow in FPC codec decompression
Published 18 Dec 2023 · Fixed in 23.9.2.47475, 23.9.5.29, 23.10.4.25 · NVD, Project advisories (GitHub) - High 7.5
CVE-2023-48704 · ClickHouse
Unauthenticated heap buffer overflow in Gorrila codec decompression
Published 18 Dec 2023 · Fixed in 23.9.2.47551, 23.9.6.20, 23.10.5.20 · NVD, Project advisories (GitHub) - Medium 5.9
CVE-2023-48795 · CrushFTP, Erlang/OTP, pfSense and 2 more
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This…
Published 18 Dec 2023 · Fixed in 24.3.4.15, 25.3.2.8, 26.2.1 · NVD - Medium
CVE-2023-6134 · Keycloak
Reflected XSS via wildcard in OIDC redirect_uri
Published 18 Dec 2023 · Fixed in 23.0.3 · Project advisories (GitHub) - Medium 4.9
GHSA-v3vh-7qx4-f582 · Frappe Framework
frappe.flags.in_safe_exec can become False while executing a Server Script
Published 18 Dec 2023 · Fixed in 14.59.0, 15.5.0 · Project advisories (GitHub) - High 7.5
CVE-2023-6909 · MLflow
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.
Published 18 Dec 2023 · Fixed in 2.9.2 · NVD - High 8.8
CVE-2023-3907 · GitLab
A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner
Published 17 Dec 2023 · Fixed in 16.4.4, 16.5.4, 16.6.2 · NVD - High 7.5
CVE-2023-39340 · Ivanti Connect Secure
A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service (DoS) of the appliance.
Published 16 Dec 2023 · NVD - High 8.1
CVE-2023-6680 · GitLab
An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication. Smartcard authentication is an experimental feature and has to be manually enabled by an administrator.
Published 15 Dec 2023 · Fixed in 16.4.4, 16.5.4, 16.6.2 · NVD - Medium 6.5
CVE-2023-6051 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pulled from a specific tag.
Published 15 Dec 2023 · Fixed in 16.4.4, 16.5.4, 16.6.2 · NVD - Medium 5.7
CVE-2023-5512 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when specific HTML encoding is used for file names leading for incorrect representation in the UI.
Published 15 Dec 2023 · Fixed in 16.4.4, 16.5.4, 16.6.2 · NVD - Medium 4.3
CVE-2023-5061 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may have been possible for developers to override predefined CI variables via the REST API.
Published 15 Dec 2023 · Fixed in 16.4.4, 16.5.4, 16.6.2 · NVD - High 7.5
CVE-2023-3904 · GitLab
An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issue boards.
Published 15 Dec 2023 · Fixed in 16.4.4, 16.5.4, 16.6.2 · NVD - Low 3.5
CVE-2023-3511 · GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 8.17 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible for auditor users to fork and submit merge requests to private projects they're not a member of.
Published 15 Dec 2023 · Fixed in 16.4.4, 16.5.4, 16.6.2 · NVD - High 8.8
CVE-2023-50870 · TeamCity
In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible
Published 15 Dec 2023 · Fixed in 2023.11.1 · NVD - Medium 5.4
CVE-2023-48624 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48623 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48622 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48621 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48620 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48619 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48618 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48617 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48616 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48615 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48614 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48613 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48612 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48611 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48610 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48609 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Low 3.5
CVE-2023-48608 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by an Improper Input Validation vulnerability. A low-privileged attacker could leverage this vulnerability to achieve a low-integrity impact within the application. Exploitation of this issue requires user interaction.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48607 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48606 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48605 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48604 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48603 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48602 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48601 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.