Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 38,784
- Published in 7 days
- 554
- Critical in 30 days
- 387
- Actively exploited
- 420
Latest vulnerabilities
38,784 vulnerabilities- Medium 5.4
CVE-2023-48457 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48456 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48455 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48454 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48453 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48452 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48451 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48450 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48449 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48448 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48447 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48446 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48445 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48444 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48443 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48442 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 15 Dec 2023 · NVD - Medium 5.3
CVE-2023-48441 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by an Improper Access Control vulnerability. An attacker could leverage this vulnerability to achieve a low-confidentiality impact within the application. Exploitation of this issue does not require user interaction.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-48440 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-47065 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Dec 2023 · NVD - Medium 5.4
CVE-2023-47064 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Published 15 Dec 2023 · NVD - High 8.1
CVE-2023-6831 · MLflow
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.
Published 15 Dec 2023 · Fixed in 2.9.2 · NVD - High 7.5
CVE-2023-50269 · Squid
SQUID-2023:10 Denial of Service in HTTP Request parsing
Published 14 Dec 2023 · NVD, Project advisories (GitHub) - Critical 9.8
CVE-2023-48085 · Nagios XI
Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php.
Published 14 Dec 2023 · Fixed in 5.11.3 · NVD - Critical 9.8
CVE-2023-48084 · Nagios XI
Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.
Published 14 Dec 2023 · Fixed in 5.11.3 · NVD - High 7.8
CVE-2023-41720 · Ivanti Connect Secure
A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker with a foothold on an Ivanti Connect Secure (ICS) appliance can escalate their privileges by exploiting a vulnerable installed application. This vulnerability allows the attacker to gain elevated execution privileges on the affected system.
Published 14 Dec 2023 · NVD - High 7.2
CVE-2023-41719 · Ivanti Connect Secure
A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker impersonating an administrator may craft a specific web request which may lead to remote code execution.
Published 14 Dec 2023 · NVD - Medium 4.7
CVE-2023-6795 · Palo Alto Networks PAN-OS
An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.
Published 13 Dec 2023 · Fixed in 9.1.12, 10.0.9, 10.1.3 · NVD - Medium 4.7
CVE-2023-6794 · Palo Alto Networks PAN-OS
An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.
Published 13 Dec 2023 · Fixed in 8.1.26, 9.0.17, 9.1.14 · NVD - Low 2.7
CVE-2023-6793 · Palo Alto Networks PAN-OS
An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API keys from the firewall and disrupt XML API usage.
Published 13 Dec 2023 · Fixed in 10.1.11, 10.2.5, 11.0.2 · NVD - Medium 6.3
CVE-2023-6792 · Palo Alto Networks PAN-OS
An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.
Published 13 Dec 2023 · Fixed in 9.1.15, 10.0.12, 10.1.6 · NVD - Medium 4.9
CVE-2023-6791 · Palo Alto Networks PAN-OS
A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credentials of stored external system integrations such as LDAP, SCP, RADIUS, TACACS+, and SNMP from the web interface.
Published 13 Dec 2023 · Fixed in 10.0.12, 10.1.9, 10.2.4 · NVD - Medium 6.1
CVE-2023-6790 · Palo Alto Networks PAN-OS
A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the context of an administrator’s browser when they view a specifically crafted link to the PAN-OS web interface.
Published 13 Dec 2023 · Fixed in 10.0.12, 10.1.9, 10.2.4 · NVD - Medium 4.8
CVE-2023-6789 · Palo Alto Networks PAN-OS
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the JavaScript payload executes and disguises all associated actions as performed by that unsuspecting authenticated administrator.
Published 13 Dec 2023 · Fixed in 10.1.11, 10.2.5, 11.0.2 · NVD - Critical 9.8
CVE-2023-46727 · GLPI
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. Version 10.0.11 contains a patch for the issue. As a workaround, disable native inventory.
Published 13 Dec 2023 · Fixed in 10.0.11 · NVD - Critical 9.8
CVE-2023-46726 · GLPI
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP 7.4 only, the LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI document. Version 10.0.11 contains a patch for the issue.
Published 13 Dec 2023 · Fixed in 10.0.11 · NVD - High 8.8
CVE-2023-43813 · GLPI
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perform a SQL injection. Version 10.0.11 contains a patch for the issue.
Published 13 Dec 2023 · Fixed in 10.0.11 · NVD - Medium 5.3
CVE-2023-47536 · Fortinet FortiProxy, Fortinet FortiOS
An improper access control vulnerability [CWE-284] in FortiOS version 7.2.0, version 7.0.13 and below, version 6.4.14 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below may allow a remote unauthenticated attacker to bypass the firewall deny geolocalisation policy via timing the bypass with a GeoIP database update.
Published 13 Dec 2023 · NVD - Medium 5.7
CVE-2023-45725 · Apache CouchDB
Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: * list * show * rewrite * update An attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a…
Published 13 Dec 2023 · NVD - Medium 5.3
CVE-2023-46713 · Fortinet FortiWeb
An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to forge traffic logs via a crafted URL of the web application.
Published 13 Dec 2023 · NVD - Medium 6.5
CVE-2023-46675 · Kibana
An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log may contain Account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users, Elastic…
Published 13 Dec 2023 · Fixed in 7.17.16, 8.11.2 · NVD - Medium 6.5
CVE-2023-46671 · Kibana
An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error message recorded in the log may contain account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users. The issue occurs infrequently, only if an error is returned from an…
Published 13 Dec 2023 · Fixed in 8.11.1 · NVD - Medium 5.4
CVE-2023-45587 · Fortinet FortiSandbox
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions allows attacker to execute unauthorized code or commands via crafted HTTP requests
Published 13 Dec 2023 · NVD - Medium 5.4
CVE-2023-41844 · Fortinet FortiSandbox
A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.4 and above allows attacker to execute unauthorized code or commands via crafted HTTP requests in capture…
Published 13 Dec 2023 · NVD - High 8.8
CVE-2023-41678 · Fortinet FortiOS
A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically crafted request.
Published 13 Dec 2023 · NVD - High 8.8
CVE-2023-36639 · Fortinet FortiProxy, Fortinet FortiOS
A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted API requests.
Published 13 Dec 2023 · NVD - High 8.8
CVE-2023-6753 · MLflow
Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.
Published 13 Dec 2023 · Fixed in 2.9.2 · NVD - Medium 4.3
CVE-2023-20275 · Cisco ASA and Firepower Threat Defense
A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to send packets with another VPN user's source IP address. This vulnerability is due to improper validation of the packet's inner source IP address after decryption. An attacker could exploit this…
Published 12 Dec 2023 · NVD - Medium 4.3
CVE-2023-6727 · Mattermost
Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in a post, some playbook information, like the name, can be leaked.
Published 12 Dec 2023 · NVD - Medium 5.4
CVE-2023-6547 · Mattermost
Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to the team the playbook is on to access and modify the playbook. This can happen if the user was once a member of the team, got permissions to the playbook and was then removed from the team.
Published 12 Dec 2023 · NVD - Medium 4.3
CVE-2023-49874 · Mattermost
Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID.
Published 12 Dec 2023 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.