UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,789
Published in 7 days
543
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,789 vulnerabilities
  1. Medium

    CVE-2023-46735 · Symfony

    Potential XSS in WebhookController

    Published 10 Nov 2023 · Fixed in 6.3.8 · Project advisories (GitHub)
  2. High 8.8

    CVE-2023-6069 · Froxlor

    Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0.

    Published 10 Nov 2023 · Fixed in 2.1.0 · NVD
  3. Low 3.3

    CVE-2023-5543 · Moodle

    When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting.

    Published 9 Nov 2023 · Fixed in 4.0.11, 4.1.6, 4.2.3 · NVD
  4. High 7.5

    CVE-2023-5954 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.

    Published 9 Nov 2023 · Fixed in 1.13.10, 1.14.6, 1.15.2 · NVD
  5. High 7.5

    CVE-2023-4379 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated.

    Published 9 Nov 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  6. Low 3.3

    CVE-2023-5551 · Moodle

    Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.

    Published 9 Nov 2023 · Fixed in 4.0.11, 4.1.6, 4.2.3 · NVD
  7. Critical 9.8

    CVE-2023-5550 · Moodle

    In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.

    Published 9 Nov 2023 · Fixed in 4.0.11, 4.1.6, 4.2.3 · NVD
  8. Medium 5.3

    CVE-2023-5549 · Moodle

    Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.

    Published 9 Nov 2023 · Fixed in 4.0.11, 4.1.6, 4.2.3 · NVD
  9. Medium 5.3

    CVE-2023-5548 · Moodle

    Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.

    Published 9 Nov 2023 · Fixed in 4.0.11, 4.1.6, 4.2.3 · NVD
  10. Medium 6.1

    CVE-2023-5547 · Moodle

    The course upload preview contained an XSS risk for users uploading unsafe data.

    Published 9 Nov 2023 · Fixed in 4.0.11, 4.1.6, 4.2.3 · NVD
  11. Medium 5.4

    CVE-2023-5546 · Moodle

    ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.

    Published 9 Nov 2023 · Fixed in 4.0.11, 4.1.6, 4.2.3 · NVD
  12. Medium 5.3

    CVE-2023-5545 · Moodle

    H5P metadata automatically populated the author with the user's username, which could be sensitive information.

    Published 9 Nov 2023 · Fixed in 4.0.11, 4.1.6, 4.2.3 · NVD
  13. Medium 5.4

    CVE-2023-5544 · Moodle

    Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.

    Published 9 Nov 2023 · Fixed in 4.0.11, 4.1.6, 4.2.3 · NVD
  14. Medium 4.3

    CVE-2023-5542 · Moodle

    Students in "Only see own membership" groups could see other students in the group, which should be hidden.

    Published 9 Nov 2023 · NVD
  15. Medium 6.1

    CVE-2023-5541 · Moodle

    The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.

    Published 9 Nov 2023 · Fixed in 4.0.11, 4.1.6, 4.2.3 · NVD
  16. High 8.8

    CVE-2023-5540 · Moodle

    A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.

    Published 9 Nov 2023 · Fixed in 4.0.11, 4.1.6, 4.2.3 · NVD
  17. High 8.8

    CVE-2023-5539 · Moodle

    A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.

    Published 9 Nov 2023 · Fixed in 4.0.11, 4.1.6, 4.2.3 · NVD
  18. Medium 6.5

    CVE-2023-20902 · Harbor

    A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below,  Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information.

    Published 9 Nov 2023 · Fixed in 1.10.17, 2.7.3, 2.8.3 · NVD
  19. Low 3.7

    CVE-2023-47111 · ZITADEL

    Race condition in lockout policy execution

    Published 8 Nov 2023 · Fixed in 2.38.3, 2.40.4, 2.40.5 · NVD, Project advisories (GitHub)
  20. Medium 5.4

    CVE-2023-47505 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 8 Nov 2023 · Fixed in 3.16.5 · NVD, WPVulnerability
  21. Critical 9.8

    CVE-2023-47504 · Elementor

    Elementor Website Builder – more than just a page builder: Improper Authentication

    Published 8 Nov 2023 · Fixed in 3.16.5 · NVD, WPVulnerability
  22. Medium 6.5

    CVE-2023-4154 · Samba

    A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some…

    Published 7 Nov 2023 · Fixed in 4.17.12, 4.18.8, 4.19.1 · NVD
  23. High 8.8

    CVE-2023-42659 · WS_FTP Server

    In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying operating system hosting the WS_FTP Server application.

    Published 7 Nov 2023 · Fixed in 8.7.6, 8.8.4 · NVD
  24. Medium 5.3

    CVE-2023-46819 · Apache OFBiz

    Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09.  Users are recommended to upgrade to version 18.12.09

    Published 7 Nov 2023 · Fixed in 18.12.09 · NVD
  25. Medium 5.4

    CVE-2023-5982 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Cross-Site Request Forgery (CSRF)

    Published 7 Nov 2023 · Fixed in 1.23.11 · NVD, WPVulnerability
  26. Medium 6.5

    CVE-2023-4700 · GitLab

    An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to run jobs in protected environments, bypassing any required approvals.

    Published 6 Nov 2023 · Fixed in 16.3.6, 16.4.2 · NVD
  27. Medium 5.3

    CVE-2023-5969 · Mattermost

    Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_location, to fill up the memory due to caching large items.

    Published 6 Nov 2023 · NVD
  28. Medium 4.9

    CVE-2023-5968 · Mattermost

    Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.

    Published 6 Nov 2023 · NVD
  29. Medium 4.3

    CVE-2023-5967 · Mattermost

    Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin

    Published 6 Nov 2023 · NVD
  30. Medium 5.3

    CVE-2023-5678 · OpenSSL

    Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH…

    Published 6 Nov 2023 · Fixed in 1.1.1x, 3.0.13, 3.1.5 · NVD
  31. Medium 4.3

    CVE-2023-5963 · GitLab

    An issue has been discovered in GitLab EE with Advanced Search affecting all versions from 13.9 to 16.3.6, 16.4 prior to 16.4.2 and 16.5 prior to 16.5.1 that could allow a denial of service in the Advanced Search function by chaining too many syntax operators.

    Published 6 Nov 2023 · Fixed in 16.4.2 · NVD
  32. Medium 6.5

    CVE-2023-3909 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in gitlab-ci.yml file.

    Published 6 Nov 2023 · Fixed in 16.3.6, 16.4.2 · NVD
  33. High 7.7

    CVE-2023-3399 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom project templates.

    Published 6 Nov 2023 · Fixed in 12.9.8, 12.10.7 · NVD
  34. Medium 4.3

    CVE-2023-3246 · GitLab

    An issue has been discovered in GitLab EE/CE affecting all versions starting before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1 which allows an attackers to block Sidekiq job processor.

    Published 6 Nov 2023 · Fixed in 16.3.6, 16.4.2 · NVD
  35. Medium 5.3

    CVE-2023-5831 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the `super_sidebar_logged_out` feature flag enabled. Affected versions with this default-disabled feature flag enabled may unintentionally disclose GitLab version metadata to…

    Published 6 Nov 2023 · Fixed in 16.3.6, 16.4.2 · NVD
  36. Medium 6.5

    CVE-2023-5825 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.2 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A low-privileged attacker can point a CI/CD Component to an incorrect path and cause the server to exhaust all available memory through an infinite loop and cause Denial of Service.

    Published 6 Nov 2023 · Fixed in 16.3.6, 16.4.2 · NVD
  37. Medium 6.5

    CVE-2023-42669 · Samba

    A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing…

    Published 6 Nov 2023 · Fixed in 4.17.12, 4.18.8, 4.19.1 · NVD
  38. Medium 6.1

    CVE-2023-47272 · Roundcube

    Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).

    Published 6 Nov 2023 · Fixed in 1.5.6, 1.6.5 · NVD
  39. Medium 6.1

    CVE-2023-47260 · Redmine

    Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails.

    Published 5 Nov 2023 · Fixed in 4.2.11, 5.0.6 · NVD
  40. Medium 6.1

    CVE-2023-47259 · Redmine

    Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter.

    Published 5 Nov 2023 · Fixed in 4.2.11, 5.0.6 · NVD
  41. Medium 6.1

    CVE-2023-47258 · Redmine

    Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter.

    Published 5 Nov 2023 · Fixed in 4.2.11, 5.0.6 · NVD
  42. Medium 6.1

    CVE-2023-46251 · MyBB

    Visual editor persistent XSS

    Published 4 Nov 2023 · Fixed in 1.8.37 · NVD, Project advisories (GitHub)
  43. Medium 5.4

    CVE-2023-45556 · MyBB

    ACP Themes persistent XSS

    Published 4 Nov 2023 · Fixed in 1.8.37 · NVD, Project advisories (GitHub)
  44. Critical 9.8

    CVE-2023-3961 · Samba

    A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client…

    Published 3 Nov 2023 · Fixed in 4.17.12, 4.18.8, 4.19.1 · NVD
  45. Medium 6.5

    CVE-2023-4091 · Samba

    A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate…

    Published 3 Nov 2023 · Fixed in 4.17.12, 4.18.8, 4.19.1 · NVD
  46. Medium 6.5

    CVE-2023-42670 · Samba

    A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation "classic DCs") can erroneously start and compete for the same unix domain sockets. This issue…

    Published 3 Nov 2023 · Fixed in 4.17.12, 4.18.8, 4.19.1 · NVD
  47. High 7.5

    CVE-2023-39345 · Strapi

    Unauthorized Access to Private Fields in User Registration API

    Published 3 Nov 2023 · Fixed in 4.13.1 · NVD, Project advisories (GitHub)
  48. Critical 9.8

    CVE-2023-5763 · Eclipse GlassFish

    In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners.

    Published 3 Nov 2023 · NVD
  49. Medium 4.3

    CVE-2023-45362 · MediaWiki

    An issue was discovered in DifferenceEngine.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. diff-multi-sameuser (aka "X intermediate revisions by the same user not shown") ignores username suppression. This is an information leak.

    Published 3 Nov 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  50. Medium 5.4

    CVE-2023-45360 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is XSS in youhavenewmessagesmanyusers and youhavenewmessages i18n messages. This is related to MediaWiki:Youhavenewmessagesfromusers.

    Published 3 Nov 2023 · Fixed in 1.35.12, 1.39.5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.