UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,789
Published in 7 days
543
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,789 vulnerabilities
  1. Medium 5.5

    CVE-2022-4900 · PHP

    A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.

    Published 2 Nov 2023 · Fixed in 8.0.22 · NVD
  2. Critical 9.8

    CVE-2023-42802 · GLPI

    GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PHP files can then be executed through a web server request. Version 10.0.10 fixes this issue. As a…

    Published 2 Nov 2023 · Fixed in 10.0.10 · NVD
  3. Medium 6.1

    CVE-2023-5917 · phpBB

    A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named…

    Published 2 Nov 2023 · Fixed in 3.3.11 · NVD
  4. Medium 6.1

    CVE-2023-20264 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 single sign-on (SSO) for remote access VPN in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to intercept the SAML assertion of a user who is authenticating to a remote access VPN session. This vulnerability is…

    Published 1 Nov 2023 · NVD
  5. Medium 4.3

    CVE-2023-20247 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the remote access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to bypass a configured multiple certificate authentication policy and connect using only a valid username and password. This vulnerability is due to improper error handling during remote access VPN…

    Published 1 Nov 2023 · NVD
  6. High 8.6

    CVE-2023-20095 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of HTTPS requests. An attacker could exploit this vulnerability by sending crafted…

    Published 1 Nov 2023 · NVD
  7. High 8.6

    CVE-2023-20042 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an implementation error within the SSL/TLS session handling process that can prevent the release of a…

    Published 1 Nov 2023 · NVD
  8. Medium 5.8

    CVE-2023-20256 · Cisco ASA and Firepower Threat Defense

    Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should be denied to flow through an affected device. These vulnerabilities are due to a logic error that could occur…

    Published 1 Nov 2023 · NVD
  9. Medium 5.8

    CVE-2023-20245 · Cisco ASA and Firepower Threat Defense

    Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should be denied to flow through an affected device. These vulnerabilities are due to a logic error that could occur…

    Published 1 Nov 2023 · NVD
  10. High 8.6

    CVE-2023-20086 · Cisco ASA and Firepower Threat Defense

    A vulnerability in ICMPv6 processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper processing of ICMPv6 messages. An attacker could exploit this vulnerability by sending crafted ICMPv6 messages to a targeted…

    Published 1 Nov 2023 · NVD
  11. High 7.5

    CVE-2023-46724 · Squid

    SQUID-2023:4 Denial of Service in SSL Certificate validation

    Published 1 Nov 2023 · Fixed in 6.4 · NVD, Project advisories (GitHub)
  12. Medium 6.5

    CVE-2023-4198 · Dolibarr ERP CRM

    Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data

    Published 1 Nov 2023 · NVD
  13. High 8.8

    CVE-2023-4197 · Dolibarr ERP CRM

    Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.

    Published 1 Nov 2023 · NVD
  14. High 8.8

    CVE-2023-3955 · Kubernetes

    A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

    Published 31 Oct 2023 · Fixed in 1.26.8, 1.27.5, 1.28.1 · NVD
  15. High 8.8

    CVE-2023-3676 · Kubernetes

    A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

    Published 31 Oct 2023 · Fixed in 1.26.8, 1.27.5, 1.28.1 · NVD
  16. Critical 9.8Actively exploited

    CVE-2023-22518 · Confluence

    All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to -…

    Published 31 Oct 2023 · Fixed in 8.3.4, 8.4.4, 8.5.3 · NVD
  17. Medium 5.4

    CVE-2023-5873 · Pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0.

    Published 31 Oct 2023 · Fixed in 11.1.0 · NVD
  18. Medium 5.4

    CVE-2023-45746 · Movable Type

    Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script. Affected products/versions are as follows: Movable Type 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5405 and earlier (Movable Type 7 Series), Movable Type Premium 1.58 and earlier, Movable Type Premium Advanced 1.58 and earlier, Movable Type…

    Published 30 Oct 2023 · Fixed in 1.59, 7.902.0 · NVD
  19. Medium 6.3

    CVE-2021-25736 · Kubernetes

    Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBalancer Service when the LoadBalancer controller does not set the “status.loadBalancer.ingress[].ip” field. Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected.

    Published 30 Oct 2023 · Fixed in 1.18.18, 1.19.10, 1.20.6 · NVD
  20. Medium 4.8

    CVE-2023-5842 · Dolibarr ERP CRM

    Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5.

    Published 30 Oct 2023 · Fixed in 16.0.5 · NVD
  21. High 7.8

    CVE-2023-5839 · Hestia Control Panel

    Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.

    Published 29 Oct 2023 · Fixed in 1.8.9 · NVD
  22. Medium 5.4

    CVE-2023-46858 · Moodle

    Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms of rich content [are] used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not."

    Published 29 Oct 2023 · NVD
  23. Critical 9.8

    CVE-2023-46249 · authentik

    Potential Installation takeover when default admin user is deleted

    Published 28 Oct 2023 · Fixed in 2023.8.4, 2023.10.2 · NVD, Project advisories (GitHub)
  24. High 7.5

    CVE-2023-46215 · Apache Airflow

    Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs. This issue affects Apache Airflow Celery provider: from 3.3.0 through…

    Published 28 Oct 2023 · Fixed in 2.7.0 · NVD
  25. Critical 9.8

    CVE-2023-46853 · Memcached

    In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.

    Published 27 Oct 2023 · Fixed in 1.6.22 · NVD
  26. High 7.5

    CVE-2023-46852 · Memcached

    In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the "get" substring.

    Published 27 Oct 2023 · Fixed in 1.6.22 · NVD
  27. Medium 5.5

    CVE-2023-46407 · FFmpeg

    FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function.

    Published 27 Oct 2023 · NVD
  28. High 7.5

    CVE-2023-4967 · NetScaler ADC and Gateway

    Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA Virtual Server

    Published 27 Oct 2023 · Fixed in 13.0-92.19, 13.1-49.15, 14.1-8.50 · NVD
  29. Critical 9.8Actively exploited

    CVE-2023-46604 · Apache ActiveMQ

    The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are…

    Published 27 Oct 2023 · Fixed in 5.16.7, 5.17.6, 5.18.3 · NVD
  30. Medium

    GHSA-jq35-85cj-fj4p · Docker Engine

    /sys/devices/virtual/powercap accessible by default to containers

    Published 27 Oct 2023 · Fixed in 24.0.7 · Project advisories (GitHub)
  31. High 7.2

    CVE-2023-46818 · ISPConfig

    An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled.

    Published 27 Oct 2023 · Fixed in 3.2.11 · NVD
  32. High 8.8Actively exploited

    CVE-2023-46748 · F5 BIG-IP

    An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    Published 26 Oct 2023 · NVD
  33. Critical 9.8Actively exploited

    CVE-2023-46747 · F5 BIG-IP

    Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    Published 26 Oct 2023 · NVD
  34. High 7.5

    CVE-2023-31419 · Elasticsearch

    A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.

    Published 26 Oct 2023 · NVD
  35. High 7.5

    CVE-2023-31418 · Elasticsearch

    An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild.

    Published 26 Oct 2023 · NVD
  36. Medium 4.4

    CVE-2023-31417 · Elasticsearch

    Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is…

    Published 26 Oct 2023 · NVD
  37. Medium 5.4

    CVE-2023-46238 · ZITADEL

    XSS with User Avatar image

    Published 26 Oct 2023 · Fixed in 2.38.2, 2.39.2 · NVD, Project advisories (GitHub)
  38. High 7.5

    CVE-2023-31422 · Kibana

    An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern. Elastic has released Kibana 8.10.1 which resolves this issue. The error object recorded in the log contains request information, which…

    Published 26 Oct 2023 · NVD
  39. High 8.8

    CVE-2023-5044 · Ingress NGINX Controller

    Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.

    Published 25 Oct 2023 · Fixed in 1.9.0 · NVD
  40. High 8.8

    CVE-2023-5043 · Ingress NGINX Controller

    Ingress nginx annotation injection causes arbitrary command execution.

    Published 25 Oct 2023 · Fixed in 1.9.0 · NVD
  41. Medium 6.5

    CVE-2022-4886 · Ingress NGINX Controller

    Ingress-nginx `path` sanitization can be bypassed with `log_format` directive.

    Published 25 Oct 2023 · Fixed in 1.8.0 · NVD
  42. Medium 6.5

    CVE-2023-5568 · Samba

    A heap-based Buffer Overflow flaw was discovered in Samba. It could allow a remote, authenticated attacker to exploit this vulnerability to cause a denial of service.

    Published 25 Oct 2023 · Fixed in 4.19.2 · NVD
  43. High 7.5

    CVE-2023-5363 · OpenSSL

    Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes. When calling EVP_EncryptInit_ex2(),…

    Published 25 Oct 2023 · Fixed in 3.0.12, 3.1.4 · NVD
  44. Critical 9.8

    CVE-2023-46158 · IBM WebSphere Liberty

    IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling. IBM X-Force ID: 268775.

    Published 25 Oct 2023 · Fixed in 23.0.0.11 · NVD
  45. High 7.5

    CVE-2023-46119 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1.

    Published 25 Oct 2023 · Fixed in 5.5.6, 6.3.1 · NVD
  46. Medium 4.3

    CVE-2023-34056 · VMware vCenter Server

    vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data.

    Published 25 Oct 2023 · NVD
  47. Critical 9.8Actively exploited

    CVE-2023-34048 · VMware vCenter Server

    vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.

    Published 25 Oct 2023 · NVD
  48. Medium 4.8

    CVE-2023-44760 · Concrete CMS

    Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics. NOTE: the vendor disputes this because these header/footer changes can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature. Also,…

    Published 23 Oct 2023 · NVD
  49. Critical 9.8

    CVE-2023-27152 · OPNsense

    DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication.

    Published 23 Oct 2023 · NVD
  50. Medium 4.3

    CVE-2023-46288 · Apache Airflow

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for configuration even when the expose_config option is set to non-sensitive-only. The expose_config option is False…

    Published 23 Oct 2023 · Fixed in 2.7.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.