UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,795
Published in 7 days
548
Critical in 30 days
384
Actively exploited
421

Latest vulnerabilities

38,795 vulnerabilities
  1. Medium 5.4

    CVE-2023-4829 · Froxlor

    Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22.

    Published 13 Oct 2023 · Fixed in 2.0.22 · NVD
  2. Medium 5.4

    CVE-2023-4517 · Hestia Control Panel

    Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.

    Published 13 Oct 2023 · Fixed in 1.8.6 · NVD
  3. High 7.5

    CVE-2023-39960 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and…

    Published 13 Oct 2023 · Fixed in 24.0.12.5, 25.0.9, 26.0.4 · NVD
  4. Medium 4.3

    CVE-2023-39999 · WordPress

    Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0…

    Published 13 Oct 2023 · Fixed in 6.3.2 · NVD
  5. Medium 5.4

    CVE-2023-38000 · WordPress

    Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.

    Published 13 Oct 2023 · NVD
  6. Medium 5.3

    CVE-2023-38251 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Resource Consumption vulnerability that could lead in minor application denial-of-service. Exploitation of this issue does not require user interaction.

    Published 13 Oct 2023 · NVD
  7. Medium 6.6

    CVE-2023-38250 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and…

    Published 13 Oct 2023 · NVD
  8. Medium 6.6

    CVE-2023-38249 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and…

    Published 13 Oct 2023 · NVD
  9. Medium 6.6

    CVE-2023-38221 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and…

    Published 13 Oct 2023 · NVD
  10. High 7.5

    CVE-2023-38220 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could access unauthorised data. Exploitation of this issue does not require user interaction.

    Published 13 Oct 2023 · NVD
  11. High 8.7

    CVE-2023-38219 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing…

    Published 13 Oct 2023 · NVD
  12. High 8.8

    CVE-2023-38218 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Authorization . An authenticated attacker can exploit this to achieve information exposure and privilege escalation.

    Published 13 Oct 2023 · NVD
  13. Medium 4.9

    CVE-2023-26367 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

    Published 13 Oct 2023 · NVD
  14. Medium 6.8

    CVE-2023-26366 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does…

    Published 13 Oct 2023 · NVD
  15. Medium 4.8

    CVE-2023-5564 · Froxlor

    Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1.

    Published 13 Oct 2023 · Fixed in 2.1.0 · NVD
  16. Medium

    GHSA-7v4p-328v-8v5g · Traefik

    HTTP/2 request could cause a deny of service

    Published 12 Oct 2023 · Fixed in 2.10.5, 3.0.0-beta4 · Project advisories (GitHub)
  17. High 8.8

    CVE-2023-32724 · Zabbix

    Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation.

    Published 12 Oct 2023 · NVD
  18. Critical 9.1

    CVE-2023-32723 · Zabbix

    Request to LDAP is sent before user permissions are checked.

    Published 12 Oct 2023 · Fixed in 4.0.19, 4.4.7 · NVD
  19. High 7.8

    CVE-2023-32722 · Zabbix

    The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open.

    Published 12 Oct 2023 · NVD
  20. Medium 5.4

    CVE-2023-32721 · Zabbix

    A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.

    Published 12 Oct 2023 · NVD
  21. High 8.8

    CVE-2023-5511 · Snipe-IT

    Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.

    Published 11 Oct 2023 · Fixed in 6.2.3 · NVD
  22. Medium 5.3

    CVE-2023-45648 · Apache Tomcat

    Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when…

    Published 10 Oct 2023 · Fixed in 8.5.94, 9.0.81, 10.1.14 · NVD
  23. Medium 5.3

    CVE-2023-42795 · Apache Tomcat

    Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Older, EOL…

    Published 10 Oct 2023 · Fixed in 8.5.94, 9.0.81, 10.1.14 · NVD
  24. Medium 5.9

    CVE-2023-42794 · Apache Tomcat

    Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from…

    Published 10 Oct 2023 · Fixed in 8.5.94, 9.0.81 · NVD
  25. High 7.5

    CVE-2023-38171 · .NET

    Microsoft QUIC Denial of Service Vulnerability

    Published 10 Oct 2023 · Fixed in 7.0.12 · NVD
  26. High 8.0

    CVE-2023-36778 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 10 Oct 2023 · NVD
  27. High 7.5

    CVE-2023-36435 · .NET

    Microsoft QUIC Denial of Service Vulnerability

    Published 10 Oct 2023 · NVD
  28. High 8.8

    CVE-2023-41841 · Fortinet FortiOS

    An improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4 allows an attacker belonging to the prof-admin profile to perform elevated actions.

    Published 10 Oct 2023 · NVD
  29. Medium 5.3

    CVE-2023-41675 · Fortinet FortiProxy, Fortinet FortiOS

    A use after free vulnerability [CWE-416] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2.0 through 7.2.2 and version 7.0.0 through 7.0.8 may allow an unauthenticated remote attacker to crash the WAD process via multiple crafted packets reaching proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection.

    Published 10 Oct 2023 · NVD
  30. High 7.5

    CVE-2023-37935 · Fortinet FortiOS

    A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view plaintext passwords of remote services such as RDP or VNC, if the attacker is able to read the GET requests to those services.

    Published 10 Oct 2023 · NVD
  31. Medium 5.4

    CVE-2023-36555 · Fortinet FortiOS

    An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components.

    Published 10 Oct 2023 · NVD
  32. High 7.5

    CVE-2023-36478 · Eclipse Jetty, Jenkins

    Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded.…

    Published 10 Oct 2023 · Fixed in 9.4.53, 10.0.16, 11.0.16 · NVD
  33. Medium 4.3

    CVE-2023-33301 · Fortinet FortiOS

    An improper access control vulnerability in Fortinet FortiOS 7.2.0 - 7.2.4 and 7.4.0 allows an attacker to access a restricted resource from a non trusted host.

    Published 10 Oct 2023 · NVD
  34. High 7.5Actively exploited

    CVE-2023-4966 · NetScaler ADC and Gateway

    Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.

    Published 10 Oct 2023 · Fixed in 13.1-37.164, 13.1-49.15, 14.1-8.50 · NVD
  35. High 7.5Actively exploited

    CVE-2023-44487 · Apache APISIX, Apache Solr, Apache Tomcat and 12 more

    HTTP/2 "Rapid Reset" DoS Vulnerability

    Published 10 Oct 2023 · Fixed in 18.18.2, 20.8.1, 2023-10-10 · NVD, Project advisories (GitHub), nodejs
  36. High 7.8

    CVE-2023-5450 · F5 BIG-IP

    An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 10 Oct 2023 · Fixed in 7.2.4.5, 15.1.10, 16.1.4 · NVD
  37. Medium 4.4

    CVE-2023-45219 · F5 BIG-IP

    Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 10 Oct 2023 · Fixed in 15.1.9, 16.1.4 · NVD
  38. High 8.7

    CVE-2023-43746 · F5 BIG-IP

    When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system.  A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 10 Oct 2023 · Fixed in 15.1.9, 16.1.4 · NVD
  39. High 7.8

    CVE-2023-43611 · F5 BIG-IP

    The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.  This vulnerability is due to an incomplete fix for CVE-2023-38418.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    Published 10 Oct 2023 · Fixed in 7.2.4.4, 15.1.9, 16.1.4 · NVD
  40. Medium 5.5

    CVE-2023-43485 · F5 BIG-IP

    When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 10 Oct 2023 · Fixed in 15.1.9, 16.1.4 · NVD
  41. High 7.2

    CVE-2023-42768 · F5 BIG-IP

    When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 10 Oct 2023 · Fixed in 15.1.9, 16.1.4 · NVD
  42. Medium 6.5

    CVE-2023-41964 · F5 BIG-IP

    The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 10 Oct 2023 · Fixed in 15.1.9, 16.1.4 · NVD
  43. Critical 9.9

    CVE-2023-41373 · F5 BIG-IP

    A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 10 Oct 2023 · Fixed in 15.1.10.2, 16.1.4.1, 17.1.0.3 · NVD
  44. Medium 5.5

    CVE-2023-41253 · F5 BIG-IP

    When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the audit log.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 10 Oct 2023 · Fixed in 15.1.9, 16.1.4 · NVD
  45. High 7.5

    CVE-2023-41085 · F5 BIG-IP

    When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 10 Oct 2023 · Fixed in 15.1.9, 16.1.4 · NVD
  46. High 7.5

    CVE-2023-40542 · F5 BIG-IP

    When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    Published 10 Oct 2023 · Fixed in 15.1.9, 16.1.4 · NVD
  47. High 8.1

    CVE-2023-40537 · F5 BIG-IP

    An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 10 Oct 2023 · Fixed in 15.1.9, 16.1.4 · NVD
  48. High 7.5

    CVE-2023-40534 · F5 BIG-IP

    When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated with the virtual server, undisclosed requests can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 10 Oct 2023 · Fixed in 16.1.4.1 · NVD
  49. Medium 4.4

    CVE-2023-39447 · F5 BIG-IP

    When BIG-IP APM Guided Configurations are configured, undisclosed sensitive information may be logged in restnoded log.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 10 Oct 2023 · Fixed in 15.1.8, 16.1.4 · NVD
  50. Medium 5.4

    CVE-2023-44763 · Concrete CMS

    Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is one of the allowed file types in the default configuration.

    Published 10 Oct 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.