UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,789
Published in 7 days
543
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,789 vulnerabilities
  1. Medium 6.5

    CVE-2023-47777 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 15 Nov 2023 · Fixed in 8.2.0 · WPVulnerability
  2. Medium 5.4

    CVE-2023-47774 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Improper Restriction of Rendered UI Layers or Frames

    Published 15 Nov 2023 · Fixed in 12.7 · NVD, WPVulnerability
  3. Medium 5.4

    CVE-2023-45050 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting

    Published 15 Nov 2023 · Fixed in 12.8-a.3 · NVD, WPVulnerability
  4. Medium 6.5

    CVE-2023-45627 · HPE ArubaOS

    An authenticated Denial-of-Service (DoS) vulnerability exists in the CLI service. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.

    Published 14 Nov 2023 · Fixed in 10.4.0.3 · NVD
  5. High 7.2

    CVE-2023-45626 · HPE ArubaOS

    An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across boot cycles.

    Published 14 Nov 2023 · Fixed in 10.4.0.3 · NVD
  6. High 7.2

    CVE-2023-45625 · HPE ArubaOS

    Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

    Published 14 Nov 2023 · Fixed in 10.4.0.3 · NVD
  7. High 7.5

    CVE-2023-45624 · HPE ArubaOS

    An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.

    Published 14 Nov 2023 · Fixed in 10.4.0.3 · NVD
  8. High 7.5

    CVE-2023-45623 · HPE ArubaOS

    Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

    Published 14 Nov 2023 · Fixed in 10.4.0.3 · NVD
  9. High 7.5

    CVE-2023-45622 · HPE ArubaOS

    Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

    Published 14 Nov 2023 · Fixed in 10.4.0.3 · NVD
  10. High 7.5

    CVE-2023-45621 · HPE ArubaOS

    Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

    Published 14 Nov 2023 · Fixed in 10.4.0.3 · NVD
  11. High 7.5

    CVE-2023-45620 · HPE ArubaOS

    Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

    Published 14 Nov 2023 · Fixed in 10.4.0.3 · NVD
  12. High 8.2

    CVE-2023-45619 · HPE ArubaOS

    There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.

    Published 14 Nov 2023 · Fixed in 10.4.0.3 · NVD
  13. High 8.2

    CVE-2023-45618 · HPE ArubaOS

    There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.

    Published 14 Nov 2023 · Fixed in 10.4.0.3 · NVD
  14. High 8.2

    CVE-2023-45617 · HPE ArubaOS

    There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the access point.

    Published 14 Nov 2023 · Fixed in 10.4.0.3 · NVD
  15. Critical 9.8

    CVE-2023-45616 · HPE ArubaOS

    There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying…

    Published 14 Nov 2023 · Fixed in 10.4.0.3 · NVD
  16. Critical 9.8

    CVE-2023-45615 · HPE ArubaOS

    There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

    Published 14 Nov 2023 · Fixed in 10.4.0.3 · NVD
  17. Critical 9.8

    CVE-2023-45614 · HPE ArubaOS

    There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

    Published 14 Nov 2023 · Fixed in 10.4.0.3 · NVD
  18. Medium 5.3

    CVE-2023-41570 · MikroTik RouterOS

    MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.

    Published 14 Nov 2023 · Fixed in 7.12 · NVD
  19. Medium 5.5

    CVE-2023-36558 · .NET

    ASP.NET Core Security Feature Bypass Vulnerability

    Published 14 Nov 2023 · Fixed in 6.0.25, 7.0.14 · NVD
  20. High 7.5

    CVE-2023-36038 · .NET

    ASP.NET Core Denial of Service Vulnerability

    Published 14 Nov 2023 · NVD
  21. High 8.8

    CVE-2023-5528 · Kubernetes

    A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.

    Published 14 Nov 2023 · Fixed in 1.26.11, 1.27.8, 1.28.4 · NVD
  22. Critical 9.8

    CVE-2023-36049 · .NET

    .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

    Published 14 Nov 2023 · Fixed in 6.0.25, 7.0.14 · NVD
  23. Medium 6.1

    CVE-2023-47125 · TYPO3

    TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this…

    Published 14 Nov 2023 · Fixed in 10.4.41, 11.5.33, 12.4.8 · NVD
  24. High 8.8

    CVE-2023-48217 · Statamic

    Remote code execution via form uploads

    Published 14 Nov 2023 · Fixed in 3.4.14, 4.34.0 · NVD, Project advisories (GitHub)
  25. Medium 6.5

    CVE-2023-36641 · Fortinet FortiProxy, Fortinet FortiOS

    A numeric truncation error vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy 7.2.0 through 7.2.4, FortiProxy 7.0.0 through 7.0.10, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions,…

    Published 14 Nov 2023 · NVD
  26. High 8.0

    CVE-2023-36439 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 14 Nov 2023 · NVD
  27. High 8.0

    CVE-2023-36050 · Microsoft Exchange Server

    Microsoft Exchange Server Spoofing Vulnerability

    Published 14 Nov 2023 · NVD
  28. High 8.0

    CVE-2023-36039 · Microsoft Exchange Server

    Microsoft Exchange Server Spoofing Vulnerability

    Published 14 Nov 2023 · NVD
  29. High 8.0

    CVE-2023-36035 · Microsoft Exchange Server

    Microsoft Exchange Server Spoofing Vulnerability

    Published 14 Nov 2023 · NVD
  30. Medium 6.7

    CVE-2023-28002 · Fortinet FortiProxy, Fortinet FortiOS

    An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all versions, 6.0 all versions and VMs may allow a local attacker with admin privileges to boot a malicious image on the device and bypass the filesystem integrity check in place.

    Published 14 Nov 2023 · NVD
  31. Medium 5.4

    CVE-2023-47127 · TYPO3

    Weak Authentication in Session Handling

    Published 14 Nov 2023 · Fixed in 10.4.41, 11.5.33, 12.4.8 · NVD, Project advisories (GitHub)
  32. Medium 5.3

    CVE-2023-47126 · TYPO3

    Information Disclosure in Install Tool

    Published 14 Nov 2023 · Fixed in 12.4.8 · NVD, Project advisories (GitHub)
  33. High 8.8

    CVE-2023-42326 · pfSense

    An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components.

    Published 14 Nov 2023 · NVD
  34. Medium 5.4

    CVE-2023-42327 · pfSense

    Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page.

    Published 14 Nov 2023 · NVD
  35. Medium 5.4

    CVE-2023-42325 · pfSense

    Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page.

    Published 14 Nov 2023 · NVD
  36. High 8.8

    CVE-2023-47784 · Slider Revolution

    Slider Revolution: Unrestricted Upload of File with Dangerous Type

    Published 14 Nov 2023 · Fixed in 6.6.16 · NVD, WPVulnerability
  37. Medium 5.4

    CVE-2023-47772 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 14 Nov 2023 · Fixed in 6.6.15 · NVD, WPVulnerability
  38. Medium 4.3

    CVE-2023-47037 · Apache Airflow

    We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then.  Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.  Users should upgrade to version…

    Published 12 Nov 2023 · Fixed in 2.7.3 · NVD
  39. Medium 6.5

    CVE-2023-42781 · Apache Airflow

    Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.  This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.

    Published 12 Nov 2023 · Fixed in 2.7.3 · NVD
  40. Critical 9.8

    CVE-2023-46850 · OpenVPN

    Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.

    Published 11 Nov 2023 · NVD
  41. High 7.5

    CVE-2023-46849 · OpenVPN

    Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.

    Published 11 Nov 2023 · NVD
  42. Critical 9.8

    CVE-2023-47129 · Statamic

    Remote code execution via front-end form uploads

    Published 10 Nov 2023 · Fixed in 3.4.13, 4.33.0 · NVD, Project advisories (GitHub)
  43. Critical 9.8

    CVE-2023-47121 · Discourse

    Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, the embedding feature is susceptible to server side request forgery. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable…

    Published 10 Nov 2023 · Fixed in 3.1.3, 3.2.0 · NVD
  44. High 7.5

    CVE-2023-47120 · Discourse

    Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the `stable` branch and versions 3.1.0,beta6 through 3.2.0.beta2 of the `beta` and `tests-passed` branches, Redis memory can be depleted by crafting a site with an abnormally long favicon URL and drafting multiple posts which Onebox it. The issue is patched in version 3.1.3 of the `stable` branch…

    Published 10 Nov 2023 · Fixed in 3.1.3 · NVD
  45. Medium 6.1

    CVE-2023-47119 · Discourse

    Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some links can inject arbitrary HTML tags when rendered through our Onebox engine. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are…

    Published 10 Nov 2023 · Fixed in 3.1.3, 3.2.0 · NVD
  46. Medium 5.4

    CVE-2023-46130 · Discourse

    Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some theme components allow users to add svgs with unlimited `height` attributes, and this can affect the availability of subsequent replies in a topic. Most Discourse instances are unaffected, only instances with the…

    Published 10 Nov 2023 · Fixed in 3.1.3, 3.2.0 · NVD
  47. Low 3.3

    CVE-2023-45816 · Discourse

    Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, there is an edge case where a bookmark reminder is sent and an unread notification is generated, but the underlying bookmarkable (e.g. post, topic, chat message) security has changed, making it so the user can no longer…

    Published 10 Nov 2023 · Fixed in 3.1.3, 3.2.0 · NVD
  48. Medium 5.4

    CVE-2023-45806 · Discourse

    Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, if a user has been quoted and uses a `|` in their full name, they might be able to trigger a bug that generates a lot of duplicate content in all the posts they've been quoted by updating their full name again. Version…

    Published 10 Nov 2023 · Fixed in 3.1.3, 3.2.0 · NVD
  49. Medium

    CVE-2023-46733 · Symfony

    Possible session fixation

    Published 10 Nov 2023 · Fixed in 5.4.31, 6.3.8 · Project advisories (GitHub)
  50. Low

    CVE-2023-46734 · Symfony

    Potential XSS vulnerabilities in CodeExtension filters

    Published 10 Nov 2023 · Fixed in 4.4.51, 5.4.31, 6.3.8 · Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.