UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,789
Published in 7 days
543
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,789 vulnerabilities
  1. Medium 4.9

    CVE-2023-46118 · RabbitMQ

    Denial of Service by publishing large messages over the HTTP API

    Published 23 Oct 2023 · Fixed in 3.11.24, 3.12.7 · NVD, Project advisories (GitHub)
  2. Medium 5.9

    CVE-2023-45802 · Apache HTTP Server

    When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the…

    Published 23 Oct 2023 · Fixed in 2.4.58 · NVD
  3. High 7.5

    CVE-2023-43622 · Apache HTTP Server

    An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection…

    Published 23 Oct 2023 · Fixed in 2.4.58 · NVD
  4. High 7.5

    CVE-2023-31122 · Apache HTTP Server

    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.

    Published 23 Oct 2023 · Fixed in 2.4.58 · NVD
  5. Medium 5.4

    CVE-2023-4372 · LiteSpeed Cache

    LiteSpeed Cache: Cross-site Scripting

    Published 23 Oct 2023 · Fixed in 5.7 · NVD, WPVulnerability
  6. Low

    CVE-2023-46298 · Next.js

    Next.js missing cache-control header may lead to CDN caching empty reply

    Published 22 Oct 2023 · Fixed in 13.4.20-canary.13 · OSV.dev and GitHub
  7. High 7.5

    CVE-2023-46848 · Squid

    SQUID-2023:5 Denial of Service in FTP

    Published 21 Oct 2023 · Fixed in 6.4 · NVD, Project advisories (GitHub)
  8. Medium 5.3

    CVE-2023-46846 · Squid

    SQUID-2023:1 Request/Response smuggling in HTTP/1.1 and ICAP

    Published 21 Oct 2023 · Fixed in 6.4 · NVD, Project advisories (GitHub)
  9. High 7.5

    CVE-2023-5824 · Squid

    SQUID-2023:2 Multiple issues in HTTP response caching

    Published 21 Oct 2023 · Fixed in 6.4 · NVD, Project advisories (GitHub)
  10. High 7.5

    CVE-2023-46847 · Squid

    SQUID-2023:3 Denial of Service in HTTP Digest Authentication

    Published 21 Oct 2023 · Fixed in 6.4 · NVD, Project advisories (GitHub)
  11. Medium 5.4

    CVE-2023-46127 · Frappe Framework

    Possible HTML injection by any Desk user

    Published 21 Oct 2023 · Fixed in 14.49.0 · NVD, Project advisories (GitHub)
  12. Medium 6.5

    CVE-2023-45820 · Directus

    Directus crashes on invalid WebSocket message

    Published 19 Oct 2023 · Fixed in 10.6.2 · NVD, Project advisories (GitHub)
  13. Low 2.7

    CVE-2023-45809 · Wagtail

    Disclosure of user names via admin bulk action views

    Published 19 Oct 2023 · Fixed in 4.1.9, 5.0.5, 5.1.3 · NVD, Project advisories (GitHub)
  14. Medium 5.4Actively exploited

    CVE-2023-5631 · Roundcube

    Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

    Published 18 Oct 2023 · Fixed in 1.4.15, 1.5.5, 1.6.4 · NVD
  15. Low 3.6

    CVE-2023-45145 · Redis

    Redis Unix-domain socket may be exposed with the wrong permissions for a short time window.

    Published 18 Oct 2023 · Fixed in 6.2.14, 7.0.14, 7.2.2 · NVD, Project advisories (GitHub)
  16. Low 3.7

    CVE-2023-38546 · curl

    This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called…

    Published 18 Oct 2023 · Fixed in 8.4.0 · NVD
  17. Critical 9.8

    CVE-2023-38545 · curl

    This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved…

    Published 18 Oct 2023 · Fixed in 8.4.0 · NVD
  18. High 8.8

    CVE-2023-41715 · SonicWall SonicOS

    SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileges inside the tunnel.

    Published 17 Oct 2023 · Fixed in 6.5.4.4-44v-21-2340, 6.5.4.13-105n, 7.0.1-5145 · NVD
  19. High 7.5

    CVE-2023-41713 · SonicWall SonicOS

    SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function.

    Published 17 Oct 2023 · Fixed in 6.5.4.4-44v-21-2340, 6.5.4.13-105n, 7.0.1-5145 · NVD
  20. Medium 6.5

    CVE-2023-41712 · SonicWall SonicOS

    SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the SSL VPN plainprefs.exp URL endpoint leads to a firewall crash.

    Published 17 Oct 2023 · Fixed in 6.5.4.4-44v-21-2340, 6.5.4.13-105n, 7.0.1-5145 · NVD
  21. Medium 6.5

    CVE-2023-41711 · SonicWall SonicOS

    SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the sonicwall.exp, prefs.exp URL endpoints lead to a firewall crash.

    Published 17 Oct 2023 · Fixed in 6.5.4.4-44v-21-2340, 6.5.4.13-105n, 7.0.1-5145 · NVD
  22. Medium 6.5

    CVE-2023-39280 · SonicWall SonicOS

    SonicOS p ost-authentication Stack-Based Buffer Overflow vulnerability in the ssoStats-s.xml, ssoStats-s.wri URL endpoints leads to a firewall crash.

    Published 17 Oct 2023 · Fixed in 6.5.4.4-44v-21-2340, 6.5.4.13-105n, 7.0.1-5145 · NVD
  23. Medium 6.5

    CVE-2023-39279 · SonicWall SonicOS

    SonicOS post-authentication Stack-Based Buffer Overflow vulnerability in the getPacketReplayData.json URL endpoint leads to a firewall crash.

    Published 17 Oct 2023 · Fixed in 6.5.4.4-44v-21-2340, 6.5.4.13-105n, 7.0.1-5145 · NVD
  24. Medium 6.5

    CVE-2023-39278 · SonicWall SonicOS

    SonicOS post-authentication user assertion failure leads to Stack-Based Buffer Overflow vulnerability via main.cgi leads to a firewall crash.

    Published 17 Oct 2023 · Fixed in 6.5.4.4-44v-21-2340, 6.5.4.13-105n, 7.0.1-5145 · NVD
  25. Medium 6.5

    CVE-2023-39277 · SonicWall SonicOS

    SonicOS post-authentication stack-based buffer overflow vulnerability in the sonicflow.csv and appflowsessions.csv URL endpoints leads to a firewall crash.

    Published 17 Oct 2023 · Fixed in 6.5.4.4-44v-21-2340, 6.5.4.13-105n, 7.0.1-5145 · NVD
  26. Medium 6.5

    CVE-2023-39276 · SonicWall SonicOS

    SonicOS post-authentication stack-based buffer overflow vulnerability in the getBookmarkList.json URL endpoint leads to a firewall crash.

    Published 17 Oct 2023 · Fixed in 6.5.4.4-44v-21-2340, 6.5.4.13-105n, 7.0.1-5145 · NVD
  27. Medium 4.9

    CVE-2023-22115 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 17 Oct 2023 · NVD
  28. Medium 4.9

    CVE-2023-22114 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 17 Oct 2023 · NVD
  29. Low 2.7

    CVE-2023-22113 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL…

    Published 17 Oct 2023 · NVD
  30. Medium 4.9

    CVE-2023-22112 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 17 Oct 2023 · NVD
  31. Medium 4.9

    CVE-2023-22111 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 17 Oct 2023 · NVD
  32. Medium 4.9

    CVE-2023-22110 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 17 Oct 2023 · NVD
  33. High 7.5

    CVE-2023-22108 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or…

    Published 17 Oct 2023 · NVD
  34. Medium 4.9

    CVE-2023-22104 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 17 Oct 2023 · NVD
  35. Medium 4.9

    CVE-2023-22103 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Oct 2023 · NVD
  36. High 8.1

    CVE-2023-22101 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.…

    Published 17 Oct 2023 · NVD
  37. Medium 4.9

    CVE-2023-22097 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 17 Oct 2023 · NVD
  38. Medium 6.5

    CVE-2023-22095 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). The supported version that is affected is 8.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 17 Oct 2023 · NVD
  39. Medium 4.9

    CVE-2023-22092 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 17 Oct 2023 · NVD
  40. Critical 9.8

    CVE-2023-22089 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS…

    Published 17 Oct 2023 · NVD
  41. High 7.5

    CVE-2023-22086 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or…

    Published 17 Oct 2023 · NVD
  42. Medium 4.9

    CVE-2023-22084 · MariaDB, MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Oct 2023 · Fixed in 11.0.4, 11.1.3, 11.2.2 · NVD
  43. Medium 5.3

    CVE-2023-22081 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 20.3.11, 21.3.7 and 22.3.3. Easily exploitable vulnerability allows unauthenticated…

    Published 17 Oct 2023 · NVD
  44. Medium 6.5

    CVE-2023-22079 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 17 Oct 2023 · NVD
  45. Medium 4.9

    CVE-2023-22078 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Oct 2023 · NVD
  46. Critical 9.8

    CVE-2023-22072 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base…

    Published 17 Oct 2023 · NVD
  47. Medium 4.9

    CVE-2023-22070 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Oct 2023 · NVD
  48. Critical 9.8

    CVE-2023-22069 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS…

    Published 17 Oct 2023 · NVD
  49. Medium 4.9

    CVE-2023-22068 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 17 Oct 2023 · NVD
  50. Medium 5.3

    CVE-2023-22067 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf; Oracle GraalVM Enterprise Edition: 20.3.11 and 21.3.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via CORBA to compromise Oracle Java SE, Oracle GraalVM Enterprise…

    Published 17 Oct 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.