Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 38,789
- Published in 7 days
- 558
- Critical in 30 days
- 387
- Actively exploited
- 420
Latest vulnerabilities
38,789 vulnerabilities- High 7.5
CVE-2023-47633 · Traefik
Uses 100% CPU after request to with host `traefik-service`
Published 4 Dec 2023 · Fixed in 2.10.6, 3.0.0-beta5 · NVD, Project advisories (GitHub) - Medium 6.5
CVE-2023-47106 · Traefik
Incorrect processing of fragment in the URL leads to Authorization Bypass
Published 4 Dec 2023 · Fixed in 2.10.6, 3.0.0-beta5 · NVD, Project advisories (GitHub) - High 8.1
CVE-2023-5332 · GitLab
Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.
Published 4 Dec 2023 · Fixed in 16.2.8, 16.3.5 · NVD - Medium 5.3
CVE-2023-49948 · Forgejo
Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL.
Published 3 Dec 2023 · Fixed in 1.20.5-1 · NVD - High 7.5
CVE-2023-49947 · Forgejo
Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.
Published 3 Dec 2023 · Fixed in 1.20.5-1 · NVD - Critical 9.1
CVE-2023-49946 · Forgejo
In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions.
Published 3 Dec 2023 · Fixed in 1.20.5-1 · NVD - High 7.5
CVE-2023-49288 · Squid
SQUID-2023:9 Denial of Service in HTTP Collapsed Forwarding
Published 2 Dec 2023 · Fixed in 6.0.1 · NVD, Project advisories (GitHub) - High 7.5
CVE-2023-49286 · Squid
SQUID-2023:8 Denial of Service in Helper Process management
Published 2 Dec 2023 · Fixed in 6.5 · NVD, Project advisories (GitHub) - High 7.5
CVE-2023-49285 · Squid
SQUID-2023:7 Denial of Service in HTTP Message Processing
Published 2 Dec 2023 · Fixed in 6.5 · NVD, Project advisories (GitHub) - Medium 6.1
CVE-2023-49276 · Uptime Kuma
Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting (XSS). Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. This…
Published 1 Dec 2023 · Fixed in 1.23.7 · NVD - Medium 5.4
CVE-2023-6033 · GitLab
Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.
Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3, 16.6.1 · NVD - High 7.5
CVE-2023-5995 · GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the policy bot to gain access to internal projects.
Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD - High 7.5
CVE-2023-5226 · GitLab
An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted branch name to manipulate repository content in the UI.
Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD - Medium 6.5
CVE-2023-4912 · GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted mermaid diagram input.
Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD - Low 3.1
CVE-2023-4658 · GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest user, when granted the permission through a group.
Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD - Medium 4.3
CVE-2023-4317 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an unprotected branch to a protected branch.
Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD - Medium 4.3
CVE-2023-3964 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled in the project settings.
Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD - Medium 5.3
CVE-2023-3949 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a public projects' release descriptions via an atom endpoint when release access on the public was set to only project members.
Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD - Medium 4.3
CVE-2023-3443 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items.
Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD - Medium 6.5
CVE-2023-49076 · Pimcore
Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5.
Published 30 Nov 2023 · Fixed in 4.0.5 · NVD - High 8.8
CVE-2023-6528 · Slider Revolution
Slider Revolution: Code Injection
Published 30 Nov 2023 · Fixed in 6.6.19 · NVD, WPVulnerability - High 7.2
CVE-2023-6449 · Contact Form 7
Contact Form 7: Unrestricted Upload of File with Dangerous Type
Published 30 Nov 2023 · Fixed in 5.8.4 · NVD, WPVulnerability - High 7.2
CVE-2023-6218 · MOVEit Transfer
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group members permissions to the role of an organization administrator.
Published 29 Nov 2023 · Fixed in 2022.1.10, 2023.0.7, 2023.1.2 · NVD - Medium 6.1
CVE-2023-6217 · MOVEit Transfer
In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer. An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user…
Published 29 Nov 2023 · Fixed in 2022.1.10, 2023.0.7, 2023.1.2 · NVD - High 7.5
CVE-2023-40626 · Joomla!
The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.
Published 29 Nov 2023 · Fixed in 3.10.14, 4.4.1 · NVD - High 8.8
CVE-2023-49097 · ZITADEL
Account Takeover via Malicious Host Header Injection
Published 29 Nov 2023 · Fixed in 2.39.9, 2.40.10, 2.41.6 · NVD, Project advisories (GitHub) - Low
CVE-2022-2232 · Keycloak
LDAP Injection on UsernameForm Login
Published 29 Nov 2023 · Fixed in 23.0.1 · Project advisories (GitHub) - Medium 5.4
CVE-2023-44383 · October CMS
Stored XSS by authenticated backend user with improper configuration
Published 29 Nov 2023 · Fixed in 3.5.2 · NVD, Project advisories (GitHub) - Medium 4.9
CVE-2023-44381 · October CMS
Safe mode bypass using Page template injection
Published 29 Nov 2023 · Fixed in 3.4.15 · NVD, Project advisories (GitHub) - Critical 9.1
CVE-2023-44382 · October CMS
Safe mode bypass using Twig sandbox escape
Published 29 Nov 2023 · Fixed in 3.4.15 · NVD, Project advisories (GitHub) - High 8.2
CVE-2023-45539 · HAProxy
HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.
Published 28 Nov 2023 · Fixed in 2.8.2 · NVD - High 7.5
CVE-2023-30590 · Node.js
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The…
Published 28 Nov 2023 · Fixed in 16.20.1, 18.16.1, 20.3.1 · NVD - Medium 5.3
CVE-2023-30588 · Node.js
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that…
Published 28 Nov 2023 · Fixed in 16.20.1, 18.16.1, 20.3.1 · NVD - Medium 6.5
CVE-2023-42504 · Apache Superset
An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0
Published 28 Nov 2023 · Fixed in 3.0.0 · NVD - Medium 4.3
CVE-2023-42505 · Apache Superset
An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0.
Published 28 Nov 2023 · Fixed in 3.0.0 · NVD - Medium 5.4
CVE-2023-42502 · Apache Superset
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.
Published 28 Nov 2023 · Fixed in 3.0.0 · NVD - High 7.5
CVE-2023-46589 · Apache Tomcat
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request…
Published 28 Nov 2023 · Fixed in 8.5.96, 9.0.83, 10.1.16 · NVD - High 8.8
CVE-2022-41678 · Apache ActiveMQ
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper…
Published 28 Nov 2023 · Fixed in 5.16.6, 5.17.4 · NVD - High 8.8
CVE-2023-4226 · Chamilo LMS
Unrestricted file upload in `/main/inc/ajax/work.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.
Published 28 Nov 2023 · NVD - High 8.8
CVE-2023-4225 · Chamilo LMS
Unrestricted file upload in `/main/inc/ajax/exercise.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.
Published 28 Nov 2023 · NVD - High 8.8
CVE-2023-4224 · Chamilo LMS
Unrestricted file upload in `/main/inc/ajax/dropbox.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.
Published 28 Nov 2023 · NVD - High 8.8
CVE-2023-4223 · Chamilo LMS
Unrestricted file upload in `/main/inc/ajax/document.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.
Published 28 Nov 2023 · NVD - High 8.8
CVE-2023-4222 · Chamilo LMS
Command injection in `main/lp/openoffice_text_document.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.
Published 28 Nov 2023 · NVD - High 8.8
CVE-2023-4221 · Chamilo LMS
Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.
Published 28 Nov 2023 · NVD - Medium 6.1
CVE-2023-4220 · Chamilo LMS
Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.
Published 28 Nov 2023 · NVD - High 7.5
CVE-2023-30585 · Node.js
A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the "msiexec.exe" process, running under the NT AUTHORITY\SYSTEM context, attempts to read the %USERPROFILE% environment variable from the current user's registry.…
Published 28 Nov 2023 · Fixed in 16.20.1, 18.16.1, 20.3.1 · NVD - High 7.8
CVE-2023-4931 · Plesk
Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll, propsys.dll and profapi.dll files.
Published 27 Nov 2023 · NVD - Medium 5.4
CVE-2023-43701 · Apache Superset
Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2. Users are recommended to upgrade to version 2.1.2, which fixes this…
Published 27 Nov 2023 · Fixed in 2.1.2 · NVD - Medium 4.3
CVE-2023-42501 · Apache Superset
Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache Superset: before 2.1.2. Users should upgrade to version or above 2.1.2 and run `superset init` to reconstruct the Gamma role or remove `can_read` permission from the mentioned resources.
Published 27 Nov 2023 · Fixed in 2.1.1 · NVD - High 8.8
CVE-2023-40610 · Apache Superset
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the…
Published 27 Nov 2023 · Fixed in 2.1.2 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.