Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 38,789
- Published in 7 days
- 558
- Critical in 30 days
- 387
- Actively exploited
- 420
Latest vulnerabilities
38,789 vulnerabilities- Medium 4.3
CVE-2023-6202 · Mattermost
Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.
Published 27 Nov 2023 · NVD - Medium 5.3
CVE-2023-48369 · Mattermost
Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log.
Published 27 Nov 2023 · NVD - High 7.5
CVE-2023-48268 · Mattermost
Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip (zip bomb).
Published 27 Nov 2023 · NVD - Medium 6.1
CVE-2023-47168 · Mattermost
Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providing a invalid custom url scheme in /oauth/{service}/mobile_login?redirect_to=
Published 27 Nov 2023 · NVD - Medium 4.3
CVE-2023-45223 · Mattermost
Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another user even if the Show Full Name option was disabled.
Published 27 Nov 2023 · NVD - Medium 4.3
CVE-2023-43754 · Mattermost
Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled.
Published 27 Nov 2023 · NVD - High 7.5
CVE-2023-40703 · Mattermost
Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resources, possibly leading to Denial of Service, by patching the field of a block using a specially crafted string.
Published 27 Nov 2023 · NVD - Medium 5.4
CVE-2023-35075 · Mattermost
Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though.
Published 27 Nov 2023 · NVD - Medium 4.3
CVE-2023-47865 · Mattermost
Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and icon when making a post even if the Hardened Mode setting was enabled
Published 27 Nov 2023 · NVD - Medium 5.3
CVE-2023-41134 · Antispam Bee (WordPress plugin)
Antispam Bee: Authentication Bypass by Spoofing
Published 27 Nov 2023 · Fixed in 2.11.4 · WPVulnerability - Unrated
WPV-bf8b4895a76f · Slider Revolution
Vulnerability in Slider Revolution
Published 26 Nov 2023 · Fixed in 3.0.96 · WPVulnerability - Medium 4.8
CVE-2023-40680 · Yoast SEO
Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting
Published 24 Nov 2023 · Fixed in 21.1 · NVD, WPVulnerability - Medium 6.5
CVE-2022-44011 · ClickHouse
An issue was discovered in ClickHouse before 22.9.1.2603. An authenticated user (with the ability to load data) could cause a heap buffer overflow and crash the server by inserting a malformed CapnProto object. The fixed versions are 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, and 22.3.12.19.
Published 23 Nov 2023 · Fixed in 22.7.4.16, 22.8.2.11, 22.9.1.2603 · NVD - High 7.5
CVE-2022-44010 · ClickHouse
An issue was discovered in ClickHouse before 22.9.1.2603. An attacker could send a crafted HTTP request to the HTTP Endpoint (usually listening on port 8123 by default), causing a heap-based buffer overflow that crashes the process. This does not require authentication. The fixed versions are 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, and 22.3.12.19.
Published 23 Nov 2023 · Fixed in 22.7.4.16, 22.8.2.11, 22.9.1.2603 · NVD - High 7.5
CVE-2023-30581 · Node.js
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js
Published 23 Nov 2023 · Fixed in 16.20.1, 18.16.1, 20.3.1 · NVD - High 7.5
CVE-2023-46673 · Elasticsearch
It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.
Published 22 Nov 2023 · Fixed in 7.17.14, 8.10.3 · NVD - High 8.8
CVE-2021-37937 · Elasticsearch
An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.
Published 22 Nov 2023 · NVD - Medium 4.3
CVE-2021-22151 · Kibana
It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension.
Published 22 Nov 2023 · NVD - High 7.2
CVE-2021-22150 · Kibana
It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server.
Published 22 Nov 2023 · Fixed in 7.14.1 · NVD - High 8.8
CVE-2021-22142 · Kibana
Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to generate reports is able to render arbitrary HTML with this browser, they may be able to leverage known Chromium vulnerabilities to conduct further attacks. Kibana contains a number of protections to prevent this browser from rendering…
Published 22 Nov 2023 · Fixed in 7.13.0 · NVD - Critical 9.8
CVE-2023-48306 · Nextcloud
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Enterprise Server, the DNS pin middleware was vulnerable to DNS rebinding allowing an…
Published 21 Nov 2023 · Fixed in 25.0.11, 26.0.6, 27.1.0 · NVD - Medium 4.4
CVE-2023-48305 · Nextcloud
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, when the log level was set to debug, the user_ldap app logged user passwords in plaintext into the log file. If the log file was then leaked or shared in any way the users' passwords…
Published 21 Nov 2023 · Fixed in 25.0.11, 26.0.6, 27.1.0 · NVD - Medium 6.1
CVE-2023-48701 · Statamic
XSS via uploaded assets
Published 21 Nov 2023 · Fixed in 3.4.15, 4.36.0 · NVD, Project advisories (GitHub) - Medium 4.3
CVE-2023-48304 · Nextcloud
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Enterprise Server, an attacker could enable and disable the birthday calendar for any…
Published 21 Nov 2023 · Fixed in 25.0.11, 26.0.6, 27.1.0 · NVD - Low 2.7
CVE-2023-48303 · Nextcloud
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, admins can change authentication details of user configured external storage. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.11, 26.0.6, and 27.1.0 contain a patch for…
Published 21 Nov 2023 · Fixed in 25.0.11, 26.0.6, 27.1.0 · NVD - Medium 5.4
CVE-2023-48302 · Nextcloud
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, when a user is tricked into copy pasting HTML code without markup (Ctrl+Shift+V) the markup will actually render. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.13,…
Published 21 Nov 2023 · Fixed in 25.0.13, 26.0.8, 27.1.3 · NVD - Medium 5.4
CVE-2023-48301 · Nextcloud
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, an attacker could insert links into circles name that would be opened when clicking the circle name in a search filter. Nextcloud Server and Nextcloud Enterprise Server versions…
Published 21 Nov 2023 · Fixed in 25.0.13, 26.0.8, 27.1.3 · NVD - High 7.1
CVE-2023-48239 · Nextcloud
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in version 20.0.0 and prior to versions 20.0.14.16, 21.0.9.13, 22.2.10.15, 23.0.12.12, 24.0.12.8, 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Enterprise Server, a malicious user could update any personal or…
Published 21 Nov 2023 · Fixed in 25.0.13, 26.0.8, 27.1.3 · NVD - Critical 9.8
CVE-2023-48228 · authentik
OAuth2: Insufficient PKCE check
Published 21 Nov 2023 · Fixed in 2023.8.5, 2023.10.4 · NVD, Project advisories (GitHub) - High 7.5
CVE-2023-45886 · F5 BIG-IP
The BGP daemon (bgpd) in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending crafted BGP update messages containing a malformed attribute.
Published 21 Nov 2023 · NVD - Medium 5.5
CVE-2023-5341 · ImageMagick
A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
Published 19 Nov 2023 · Fixed in 7.1.2 · NVD - Medium 5.4
CVE-2023-44796 · LimeSurvey
Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the _generaloptions_panel.php component.
Published 18 Nov 2023 · Fixed in 6.2.9 · NVD - Critical 9.8
CVE-2023-43177 · CrushFTP
CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.
Published 18 Nov 2023 · Fixed in 10.5.2 · NVD - Medium 4.3
CVE-2023-44355 · Adobe ColdFusion
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to impact a minor integrity feature. Exploitation of this issue does require user interaction.
Published 17 Nov 2023 · Fixed in 2021 · NVD - Critical 9.8
CVE-2023-44353 · Adobe ColdFusion
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Published 17 Nov 2023 · Fixed in 2021 · NVD - Medium 6.1
CVE-2023-44352 · Adobe ColdFusion
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 17 Nov 2023 · Fixed in 2021 · NVD - Critical 9.8
CVE-2023-44351 · Adobe ColdFusion
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Published 17 Nov 2023 · Fixed in 2021 · NVD - Critical 9.8
CVE-2023-44350 · Adobe ColdFusion
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Published 17 Nov 2023 · Fixed in 2021 · NVD - High 7.5
CVE-2023-26347 · Adobe ColdFusion
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
Published 17 Nov 2023 · Fixed in 2021 · NVD - Medium 6.1
CVE-2023-47797 · Liferay Portal / DXP
Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script or HTML via the `p_l_back_url_title` parameter.
Published 17 Nov 2023 · NVD - Medium 5.4
CVE-2023-48649 · Concrete CMS
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name.
Published 17 Nov 2023 · Fixed in 8.5.13, 9.2.2 · NVD - Critical 9.8
CVE-2023-48648 · Concrete CMS
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not…
Published 17 Nov 2023 · Fixed in 8.5.13, 9.2.2 · NVD - Critical 9.8
CVE-2023-6014 · MLflow
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.
Published 16 Nov 2023 · NVD - High 8.8
CVE-2023-46214 · Splunk Enterprise
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.
Published 16 Nov 2023 · Fixed in 9.0.7, 9.1.2 · NVD - Medium 4.8
CVE-2023-46213 · Splunk Enterprise
In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web browser.
Published 16 Nov 2023 · Fixed in 9.0.7, 9.1.2 · NVD - High 7.5
CVE-2023-6015 · MLflow
MLflow allowed arbitrary files to be PUT onto the server.
Published 16 Nov 2023 · Fixed in 2.8.1 · NVD - High 7.8
CVE-2023-47470 · FFmpeg
Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an out-of-array write, execute arbitrary code, and cause a denial of service (DoS) via the ref_pic_list_struct function in libavcodec/evc_ps.c
Published 16 Nov 2023 · NVD - High 8.8
CVE-2023-47444 · OpenCart
An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbitrary untrusted data inside config.php and admin/config.php, resulting in remote code execution on the underlying server.
Published 15 Nov 2023 · NVD - High 8.8
CVE-2023-47637 · Pimcore
SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt()
Published 15 Nov 2023 · Fixed in 11.1.1 · NVD, Project advisories (GitHub) - High 8.8
CVE-2023-47788 · Jetpack
Jetpack – WP Security, Backup, Speed, & Growth: Missing Authorization
Published 15 Nov 2023 · Fixed in 12.7 · NVD, WPVulnerability
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.