UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,789
Published in 7 days
543
Critical in 30 days
384
Actively exploited
420

Latest vulnerabilities

38,789 vulnerabilities
  1. Medium 4.9

    CVE-2023-22066 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 17 Oct 2023 · NVD
  2. Medium 4.9

    CVE-2023-22065 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 17 Oct 2023 · NVD
  3. Medium 4.9

    CVE-2023-22064 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 17 Oct 2023 · NVD
  4. Medium 6.5

    CVE-2023-22059 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Oct 2023 · NVD
  5. Medium 4.9

    CVE-2023-22032 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 17 Oct 2023 · NVD
  6. Medium 4.9

    CVE-2023-22028 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.43 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Oct 2023 · NVD
  7. Medium 4.9

    CVE-2023-22026 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.42 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Oct 2023 · NVD
  8. Low 3.7

    CVE-2023-22025 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u381-perf, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 21.3.7 and 22.3.3. Difficult to exploit vulnerability allows unauthenticated attacker with network…

    Published 17 Oct 2023 · NVD
  9. Medium 4.9

    CVE-2023-22015 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.42 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 17 Oct 2023 · NVD
  10. Medium 5.4

    CVE-2023-42627 · Liferay Portal / DXP

    Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping…

    Published 17 Oct 2023 · Fixed in 7.4.3.92 · NVD
  11. Medium 5.4

    CVE-2023-42628 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki…

    Published 17 Oct 2023 · Fixed in 7.4.3.88 · NVD
  12. Medium 4.3

    CVE-2023-5522 · Mattermost

    Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and freeze the mobile app of users when viewing that particular channel.

    Published 17 Oct 2023 · Fixed in 2.8.0 · NVD
  13. Medium 6.1

    CVE-2023-44311 · Liferay Portal / DXP

    Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.

    Published 17 Oct 2023 · Fixed in 7.4.3.90 · NVD
  14. Medium 5.4

    CVE-2023-44310 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.

    Published 17 Oct 2023 · Fixed in 7.4.3.49 · NVD
  15. Medium 5.4

    CVE-2023-44309 · Liferay Portal / DXP

    Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked source asset.

    Published 17 Oct 2023 · Fixed in 7.4.3.53 · NVD
  16. Medium 5.4

    CVE-2023-42629 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.

    Published 17 Oct 2023 · Fixed in 7.4.3.88 · NVD
  17. High 7.2

    CVE-2023-4399 · Grafana

    Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts. However, the restriction can be bypassed used punycode encoding of the characters in the request address.

    Published 17 Oct 2023 · Fixed in 9.5.13, 10.0.9, 10.1.5 · NVD
  18. Medium 6.1

    CVE-2023-42497 · Liferay Portal / DXP

    Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_translation_web_internal_portlet_TranslationPortlet_redirect` parameter.

    Published 17 Oct 2023 · Fixed in 7.4.3.86 · NVD
  19. High 7.5

    CVE-2023-41752 · Apache Traffic Server

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue.

    Published 17 Oct 2023 · Fixed in 8.1.9, 9.2.3 · NVD
  20. High 7.5

    CVE-2023-39456 · Apache Traffic Server

    Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 9.2.3, which fixes the issue.

    Published 17 Oct 2023 · Fixed in 9.2.3 · NVD
  21. High 7.5

    CVE-2023-45131 · Discourse

    Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 16 Oct 2023 · NVD
  22. Medium 5.3

    CVE-2023-44391 · Discourse

    Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when `hide_user_profiles_from_public` is enabled. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 16 Oct 2023 · NVD
  23. High 7.5

    CVE-2023-44388 · Discourse

    Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to temporarily work around this problem by reducing the `client_max_body_size nginx directive`.…

    Published 16 Oct 2023 · NVD
  24. Low 3.7

    CVE-2023-43814 · Discourse

    Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` endpoint to view the content of options in the poll and the number of votes for groups of poll participants. This impacts private polls where the results were intended to only be viewable by authorized users. This issue is patched in the…

    Published 16 Oct 2023 · NVD
  25. Medium 5.4

    CVE-2023-43659 · Discourse

    Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on…

    Published 16 Oct 2023 · NVD
  26. Low 3.1

    CVE-2023-45147 · Discourse

    Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation with the default plugins, this vulnerability has no impact. The problem has been patched in the…

    Published 16 Oct 2023 · NVD
  27. Medium 5.3

    CVE-2023-5561 · WordPress

    WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

    Published 16 Oct 2023 · Fixed in 6.1.4, 6.2.3, 6.3.2 · NVD
  28. High 8.8

    CVE-2023-45151 · Nextcloud

    Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their Nextcloud Server to version 25.0.8, 26.0.3 or 27.0.1. There are no known workarounds for this…

    Published 16 Oct 2023 · Fixed in 25.0.8, 26.0.3 · NVD
  29. Medium 4.3

    CVE-2023-45148 · Nextcloud

    Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgrade should change their config setting `memcache.distributed` to `\OC\Memcache\Redis` and install…

    Published 16 Oct 2023 · Fixed in 24.0.12.7, 25.0.11, 26.0.6 · NVD
  30. High 7.2

    CVE-2023-4822 · Grafana

    Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations. It also allows an Organization Admin to assign or…

    Published 16 Oct 2023 · Fixed in 9.5.11, 10.0.7, 10.1.3 · NVD
  31. Medium 4.3

    CVE-2023-45348 · Apache Airflow

    Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the "expose_config" option is set to "non-sensitive-only". The `expose_config` option is False by default. It is recommended to upgrade to a version that is not affected.

    Published 14 Oct 2023 · Fixed in 2.7.2 · NVD
  32. Medium 6.5

    CVE-2023-42792 · Apache Airflow

    Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. Users of Apache Airflow are strongly advised to upgrade to version 2.7.2 or…

    Published 14 Oct 2023 · Fixed in 2.7.2 · NVD
  33. Medium 6.5

    CVE-2023-42780 · Apache Airflow

    Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk…

    Published 14 Oct 2023 · Fixed in 2.7.2 · NVD
  34. Medium 6.5

    CVE-2023-42663 · Apache Airflow

    Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

    Published 14 Oct 2023 · Fixed in 2.7.2 · NVD
  35. Medium 5.4

    CVE-2023-41843 · Fortinet FortiSandbox

    A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4.1 allows attacker to execute unauthorized…

    Published 13 Oct 2023 · NVD
  36. Medium 6.1

    CVE-2023-41836 · Fortinet FortiSandbox

    An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.4, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.4 through 3.0.7 allows attacker to execute unauthorized code or commands via crafted HTTP requests.

    Published 13 Oct 2023 · NVD
  37. High 7.5

    CVE-2023-41682 · Fortinet FortiSandbox

    A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4 all versions allows attacker to denial of service via crafted…

    Published 13 Oct 2023 · NVD
  38. Medium 6.1

    CVE-2023-41681 · Fortinet FortiSandbox

    A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4.1 allows attacker to execute unauthorized…

    Published 13 Oct 2023 · NVD
  39. Medium 6.1

    CVE-2023-41680 · Fortinet FortiSandbox

    A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4.1 allows attacker to execute unauthorized…

    Published 13 Oct 2023 · NVD
  40. Low

    CVE-2023-45143 · Node.js

    undici - Cookie headers are not cleared in cross-domain redirect in undici-fetch

    Published 13 Oct 2023 · Fixed in 18.18.2, 20.8.1 · nodejs
  41. Low

    CVE-2023-39333 · Node.js

    Code injection via WebAssembly export names

    Published 13 Oct 2023 · Fixed in 18.18.2, 20.8.1 · nodejs
  42. Critical 9.8

    CVE-2023-39332 · Node.js

    Path traversal through path stored in Uint8Array

    Published 13 Oct 2023 · Fixed in 20.8.0, 20.8.1 · NVD, nodejs
  43. High 7.5

    CVE-2023-39331 · Node.js

    Permission model improperly protects against path traversal

    Published 13 Oct 2023 · Fixed in 20.8.1 · NVD, nodejs
  44. High 7.5

    CVE-2023-38552 · Node.js

    Integrity checks according to policies can be circumvented

    Published 13 Oct 2023 · Fixed in 18.18.2, 20.8.1 · NVD, nodejs
  45. Medium 5.4

    CVE-2023-4829 · Froxlor

    Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22.

    Published 13 Oct 2023 · Fixed in 2.0.22 · NVD
  46. Medium 5.4

    CVE-2023-4517 · Hestia Control Panel

    Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.

    Published 13 Oct 2023 · Fixed in 1.8.6 · NVD
  47. High 7.5

    CVE-2023-39960 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and…

    Published 13 Oct 2023 · Fixed in 24.0.12.5, 25.0.9, 26.0.4 · NVD
  48. Medium 4.3

    CVE-2023-39999 · WordPress

    Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0…

    Published 13 Oct 2023 · Fixed in 6.3.2 · NVD
  49. Medium 5.4

    CVE-2023-38000 · WordPress

    Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.

    Published 13 Oct 2023 · NVD
  50. Medium 5.3

    CVE-2023-38251 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Resource Consumption vulnerability that could lead in minor application denial-of-service. Exploitation of this issue does not require user interaction.

    Published 13 Oct 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.