UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,788
Published in 7 days
558
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,788 vulnerabilities
  1. Medium 4.3

    CVE-2023-20275 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to send packets with another VPN user's source IP address. This vulnerability is due to improper validation of the packet's inner source IP address after decryption. An attacker could exploit this…

    Published 12 Dec 2023 · NVD
  2. Medium 4.3

    CVE-2023-6727 · Mattermost

    Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in a post, some playbook information, like the name, can be leaked.

    Published 12 Dec 2023 · NVD
  3. Medium 5.4

    CVE-2023-6547 · Mattermost

    Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to the team the playbook is on to access and modify the playbook. This can happen if the user was once a member of the team, got permissions to the playbook and was then removed from the team.

    Published 12 Dec 2023 · NVD
  4. Medium 4.3

    CVE-2023-49874 · Mattermost

    Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID.

    Published 12 Dec 2023 · NVD
  5. Medium 6.5

    CVE-2023-49809 · Mattermost

    Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and make it crash. After a few repetitions, the plugin is disabled.

    Published 12 Dec 2023 · NVD
  6. High 7.5

    CVE-2023-49607 · Mattermost

    Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playbook Plugin when updating the status dialog.

    Published 12 Dec 2023 · NVD
  7. Medium 5.3

    CVE-2023-46701 · Mattermost

    Mattermost fails to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint of the Playbooks plugin allowing an attacker to get limited information about a post if they know the post ID

    Published 12 Dec 2023 · NVD
  8. High 7.5

    CVE-2023-45847 · Mattermost

    Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and crash the Playbooks plugin

    Published 12 Dec 2023 · NVD
  9. High 8.8

    CVE-2023-45316 · Mattermost

    Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a telemetry run ID, allowing an attacker to use a path traversal payload that points to a different endpoint leading to a CSRF attack.

    Published 12 Dec 2023 · NVD
  10. Medium 5.4

    CVE-2023-49273 · Umbraco CMS

    Privilege Escalation using Spoofing

    Published 12 Dec 2023 · Fixed in 8.18.10, 10.8.1, 12.3.4 · NVD, Project advisories (GitHub)
  11. Medium 6.1

    CVE-2023-48313 · Umbraco CMS

    DOM-based stored cross-site scripting

    Published 12 Dec 2023 · Fixed in 10.8.1, 12.3.4 · NVD, Project advisories (GitHub)
  12. Medium 5.3

    CVE-2023-49274 · Umbraco CMS

    SMTP misconfiguration leading to potential registered user email.

    Published 12 Dec 2023 · Fixed in 8.18.10, 10.8.1, 12.3.4 · NVD, Project advisories (GitHub)
  13. Medium 4.3

    CVE-2023-48227 · Umbraco CMS

    Backoffice User can bypass "Publish" restriction

    Published 12 Dec 2023 · Fixed in 8.18.10, 10.7.0, 12.3.0 · NVD, Project advisories (GitHub)
  14. Medium 6.5

    CVE-2023-49089 · Umbraco CMS

    Possible Path traversal when creating packages from backoffice

    Published 12 Dec 2023 · Fixed in 8.18.10, 10.8.1, 12.3.0 · NVD, Project advisories (GitHub)
  15. Medium 5.3

    CVE-2023-49278 · Umbraco CMS

    Brute force exploit can be used to collect valid usernames

    Published 12 Dec 2023 · Fixed in 8.18.10, 10.8.1, 12.3.4 · NVD, Project advisories (GitHub)
  16. Medium 5.4

    CVE-2023-49279 · Umbraco CMS

    Stored XSS via SVG File Upload

    Published 12 Dec 2023 · Fixed in 10.7.0, 11.5.0, 12.2.0 · NVD, Project advisories (GitHub)
  17. Medium 5.4

    CVE-2023-38694 · Umbraco CMS

    Possible injection of HTML in a unintended form

    Published 12 Dec 2023 · Fixed in 8.18.10, 10.7.0, 12.1.0 · NVD, Project advisories (GitHub)
  18. High 8.8

    CVE-2023-6709 · MLflow

    Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.

    Published 12 Dec 2023 · Fixed in 2.9.2 · NVD
  19. Medium 5.3

    CVE-2023-46219 · curl

    When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.

    Published 12 Dec 2023 · Fixed in 8.5.0 · NVD
  20. Medium

    CVE-2023-51769 · Frappe Framework

    Cross-Site Scripting (XSS) Attack on exceptions and Blog Page

    Published 11 Dec 2023 · Fixed in 14.49.0 · Project advisories (GitHub)
  21. Medium 6.5

    CVE-2023-50463 · Caddy

    The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism (trusted_proxy directive in reverse_proxy or IP address range restrictions).

    Published 10 Dec 2023 · NVD
  22. Medium 4.4

    CVE-2023-5870 · PostgreSQL

    A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to…

    Published 10 Dec 2023 · Fixed in 13.13, 14.10, 15.5 · NVD
  23. High 8.8

    CVE-2023-5869 · PostgreSQL

    A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing…

    Published 10 Dec 2023 · Fixed in 13.13, 14.10, 15.5 · NVD
  24. Medium 4.3

    CVE-2023-5868 · PostgreSQL

    A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output…

    Published 10 Dec 2023 · Fixed in 13.13, 14.10, 15.5 · NVD
  25. High 7.8

    CVE-2023-49804 · Uptime Kuma

    Changing Password does not close all logged in socket connections immediately

    Published 10 Dec 2023 · Fixed in 1.3.3, 1.23.9 · NVD, Project advisories (GitHub)
  26. High 8.8

    CVE-2023-49805 · Uptime Kuma

    Missing Origin Validation in WebSockets

    Published 10 Dec 2023 · Fixed in 1.3.3, 1.23.9 · NVD, Project advisories (GitHub)
  27. High 7.5

    CVE-2023-6337 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash. Fixed in Vault 1.15.4, 1.14.8, 1.13.12.

    Published 8 Dec 2023 · Fixed in 1.13.12, 1.14.8, 1.15.4 · NVD
  28. Medium 5.5

    CVE-2023-34320 · Xen

    Cortex-A77 cores (r0p0 and r1p0) are affected by erratum 1508412 where software, under certain circumstances, could deadlock a core due to the execution of either a load to device or non-cacheable memory, and either a store exclusive or register read of the Physical Address Register (PAR_EL1) in close proximity.

    Published 8 Dec 2023 · NVD
  29. Medium 4.9

    CVE-2023-6507 · Python

    An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the…

    Published 8 Dec 2023 · NVD
  30. Critical 9.8

    CVE-2023-50164 · Apache Struts

    An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

    Published 7 Dec 2023 · Fixed in 2.5.33, 6.3.0.2 · NVD
  31. Medium 6.1

    CVE-2023-43103 · Zimbra Collaboration

    An XSS issue was discovered in a web endpoint in Zimbra Collaboration (ZCS) before 10.0.4 via an unsanitized parameter. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch 36.

    Published 7 Dec 2023 · Fixed in 8.8.15, 10.0.4 · NVD
  32. Medium 6.1

    CVE-2023-43102 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4. An XSS issue can be exploited to access the mailbox of an authenticated user. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch 36.

    Published 7 Dec 2023 · Fixed in 8.8.15, 10.0.4 · NVD
  33. Medium 6.1

    CVE-2023-6568 · MLflow

    A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the user without adequate sanitization or escaping, leading to arbitrary JavaScript execution in the…

    Published 7 Dec 2023 · NVD
  34. High 7.5

    CVE-2023-41106 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.3. An attacker can gain access to a Zimbra account. This is also fixed in 9.0.0 Patch 35 and 8.8.15 Patch 42.

    Published 7 Dec 2023 · Fixed in 8.8.15, 10.0.3 · NVD
  35. Medium 6.5

    CVE-2023-46218 · curl

    This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List…

    Published 7 Dec 2023 · NVD
  36. High 8.8

    CVE-2023-48123 · pfSense

    An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php file.

    Published 6 Dec 2023 · NVD
  37. High 7.5

    CVE-2023-46751 · Ghostscript

    An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer.

    Published 6 Dec 2023 · NVD
  38. Medium 5.3

    CVE-2023-6459 · Mattermost

    Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint is revealing channelIDs.

    Published 6 Dec 2023 · Fixed in 7.8.14, 8.1.5 · NVD
  39. Critical 9.8

    CVE-2023-6458 · Mattermost

    Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal.

    Published 6 Dec 2023 · Fixed in 8.1.5, 9.0.3, 9.1.2 · NVD
  40. High 8.8

    CVE-2023-22522 · Confluence

    This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the…

    Published 6 Dec 2023 · Fixed in 8.4.5, 8.5.4, 8.6.2 · NVD
  41. Medium 5.0

    CVE-2023-40053 · SolarWinds Serv-U

    A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function feature of Serv-U, which could be used maliciously.

    Published 6 Dec 2023 · NVD
  42. High 7.5

    CVE-2023-5761 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): SQL Injection

    Published 6 Dec 2023 · Fixed in 1.5.0 · WPVulnerability
  43. High 8.8

    CVE-2023-48777 · Elementor

    Elementor Website Builder – more than just a page builder: Unrestricted Upload of File with Dangerous Type

    Published 6 Dec 2023 · Fixed in 3.18.2 · NVD, WPVulnerability
  44. High 7.8

    CVE-2023-46674 · Elasticsearch

    An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.

    Published 5 Dec 2023 · Fixed in 7.17.11, 8.9.0 · NVD
  45. High 7.5

    CVE-2023-41835 · Apache Struts

    When a Multipart request is performed but some of the fields exceed the maxStringLength  limit, the upload files will remain in struts.multipart.saveDir  even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.

    Published 5 Dec 2023 · Fixed in 2.5.32, 6.3.0.1 · NVD
  46. Low

    GHSA-x9qq-236j-gj97 · LXD

    Improve documentation to make clear restricted.devices.disk=allow without restricted.devices.disk.paths also allows shift=true

    Published 5 Dec 2023 · Project advisories (GitHub)
  47. Critical 9.8

    CVE-2023-49070 · Apache OFBiz

    Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10.  Users are recommended to upgrade to version 18.12.10

    Published 5 Dec 2023 · Fixed in 18.12.10 · NVD
  48. High 7.5

    CVE-2023-43472 · MLflow

    An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API.

    Published 5 Dec 2023 · NVD
  49. Medium 5.9

    CVE-2023-47124 · Traefik

    Potential DDoS whith ACME HTTPChallenge

    Published 4 Dec 2023 · Fixed in 2.10.6, 3.0.0-beta5 · NVD, Project advisories (GitHub)
  50. High 7.5

    CVE-2023-47633 · Traefik

    Uses 100% CPU after request to with host `traefik-service`

    Published 4 Dec 2023 · Fixed in 2.10.6, 3.0.0-beta5 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.