UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,795
Published in 7 days
548
Critical in 30 days
384
Actively exploited
421

Latest vulnerabilities

38,795 vulnerabilities
  1. Medium 5.3

    CVE-2023-44399 · ZITADEL

    Password reset does not respect the "Ignoring unknown usernames" setting

    Published 10 Oct 2023 · Fixed in 2.37.2 · NVD, Project advisories (GitHub)
  2. High 7.8

    CVE-2023-44400 · Uptime Kuma

    Persistentent User Sessions

    Published 9 Oct 2023 · Fixed in 1.23.3 · NVD, Project advisories (GitHub)
  3. Medium 6.5

    CVE-2023-5333 · Mattermost

    Mattermost fails to deduplicate input IDs allowing a simple user to cause the application to consume excessive resources and possibly crash by sending a specially crafted request to /api/v4/users/ids with multiple identical IDs.

    Published 9 Oct 2023 · Fixed in 7.8.11, 8.0.3, 8.1.2 · NVD
  4. Medium 5.3

    CVE-2023-5331 · Mattermost

    Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information.

    Published 9 Oct 2023 · Fixed in 7.8.11, 8.0.3, 8.1.2 · NVD
  5. High 7.5

    CVE-2023-5330 · Mattermost

    Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4/opengraph filling the cache and turning the server unavailable.

    Published 9 Oct 2023 · Fixed in 7.8.11, 8.0.3, 8.1.2 · NVD
  6. Medium 5.3

    CVE-2023-45374 · MediaWiki

    An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It does not check for the anti-CSRF edit token in Special:SportsTeamsManager and Special:UpdateFavoriteTeams.

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  7. Medium 6.1

    CVE-2023-45373 · MediaWiki

    An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. XSS can occur via formatNumNoSeparators.

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  8. Medium 5.3

    CVE-2023-45372 · MediaWiki

    An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  9. High 7.5

    CVE-2023-45371 · MediaWiki

    An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate limit for merging items.

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  10. Medium 5.3

    CVE-2023-45370 · MediaWiki

    An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. SportsTeams: Special:SportsManagerLogo and Special:SportsTeamsManagerLogo do not check for the sportsteamsmanager user right, and thus an attacker may be able to affect pages that are concerned with sports teams.

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  11. Medium 4.3

    CVE-2023-45369 · MediaWiki

    An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. Usernames of hidden users are exposed.

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  12. Medium 6.5

    CVE-2023-45367 · MediaWiki

    An issue was discovered in the CheckUser extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. A user can use a rest.php/checkuser/v0/useragent-clienthints/revision/ URL to store an arbitrary number of rows in cu_useragent_clienthints, leading to a denial of service.

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  13. Medium 5.3

    CVE-2023-45364 · MediaWiki

    An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is leaked due to incorrect permissions being checked. This reveals that a given revision ID belonged to the given page title, and its timestamp, both of which are not supposed to be public information.

    Published 9 Oct 2023 · Fixed in 1.39.5 · NVD
  14. High 7.5

    CVE-2023-45363 · MediaWiki

    An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected to other variants with redirects and converttitles set.

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  15. Medium 6.5

    CVE-2023-45322 · libxml2

    libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

    Published 6 Oct 2023 · NVD
  16. Medium 5.4

    CVE-2023-5452 · Snipe-IT

    Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.

    Published 6 Oct 2023 · Fixed in 6.2.2 · NVD
  17. Medium 4.8

    CVE-2023-44766 · Concrete CMS

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made by an admin, and allowing an admin to place JavaScript there is an intentional customization feature.

    Published 6 Oct 2023 · NVD
  18. Medium 5.4

    CVE-2023-44765 · Concrete CMS

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings.

    Published 6 Oct 2023 · NVD
  19. Medium 5.4

    CVE-2023-44764 · Concrete CMS

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings).

    Published 6 Oct 2023 · NVD
  20. Medium 5.4

    CVE-2023-44762 · Concrete CMS

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags.

    Published 6 Oct 2023 · NVD
  21. Medium 5.4

    CVE-2023-44761 · Concrete CMS

    Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects.

    Published 6 Oct 2023 · NVD
  22. Medium 5.5

    CVE-2023-3428 · ImageMagick

    A heap-based buffer overflow vulnerability was found in coders/tiff.c in ImageMagick. This issue may allow a local attacker to trick the user into opening a specially crafted file, resulting in an application crash and denial of service.

    Published 4 Oct 2023 · Fixed in 7.1.1-19 · NVD
  23. Critical 9.8Actively exploited

    CVE-2023-22515 · Confluence

    Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site…

    Published 4 Oct 2023 · Fixed in 8.3.3, 8.4.3, 8.5.2 · NVD
  24. High 7.8Actively exploited

    CVE-2023-4911 · GNU C Library

    A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

    Published 3 Oct 2023 · Fixed in 2.39 · NVD
  25. Medium 6.5

    CVE-2023-42508 · JFrog Artifactory

    JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body.

    Published 3 Oct 2023 · Fixed in 7.66.0 · NVD
  26. High 7.5

    CVE-2023-5106 · GitLab

    An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports.

    Published 2 Oct 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  27. Medium 4.3

    CVE-2023-5160 · Mattermost

    Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing a member to get the full name of another user even if the Show Full Name option was disabled

    Published 2 Oct 2023 · Fixed in 7.8.10, 8.1.1 · NVD
  28. Medium 6.1

    CVE-2023-5323 · Dolibarr ERP CRM

    Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0.

    Published 1 Oct 2023 · Fixed in 18.0 · NVD
  29. High 8.8

    CVE-2023-5207 · GitLab

    A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user.

    Published 30 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  30. Medium 4.8

    CVE-2023-41661 · Smarty

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions.

    Published 29 Sept 2023 · NVD
  31. Medium 6.5

    CVE-2023-5196 · Mattermost

    Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notification_prop resulting in the server consuming an abnormal quantity of computing resources and possibly becoming temporarily unavailable for its users.

    Published 29 Sept 2023 · Fixed in 7.8.10, 8.0.2, 8.1.1 · NVD
  32. Medium 5.4

    CVE-2023-5195 · Mattermost

    Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of

    Published 29 Sept 2023 · Fixed in 7.8.10, 8.0.2, 8.1.1 · NVD
  33. Medium 4.3

    CVE-2023-5194 · Mattermost

    Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager

    Published 29 Sept 2023 · Fixed in 7.8.10, 8.1.1 · NVD
  34. Low 2.7

    CVE-2023-5193 · Mattermost

    Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation.

    Published 29 Sept 2023 · Fixed in 7.8.10, 8.0.2, 8.1.1 · NVD
  35. Low 2.7

    CVE-2023-5159 · Mattermost

    Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots.

    Published 29 Sept 2023 · Fixed in 7.8.10, 8.1.1 · NVD
  36. High 7.5

    CVE-2023-3413 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to read the source code of a project through a fork created before changing visibility to only project members.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  37. Medium 4.3

    CVE-2023-5198 · GitLab

    An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16.4 before 16.4.1. It was possible for a removed project member to write to protected branches using deploy keys.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  38. High 7.1

    CVE-2023-3922 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to a malicious page.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  39. Medium 4.3

    CVE-2023-4532 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI/CD jobs of private projects which they are not a member of.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  40. Medium 4.3

    CVE-2023-3979 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your branch get permission to write to the merge request’s source branch.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  41. Medium 4.3

    CVE-2023-3920 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that a maintainer to create a fork relationship between existing projects contrary to the documentation.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  42. High 7.5

    CVE-2023-3917 · GitLab

    Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  43. Medium 5.3

    CVE-2023-3914 · GitLab

    A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects. A service account is not deleted when a namespace is deleted, allowing access to internal projects.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  44. Low 3.5

    CVE-2023-3906 · GitLab

    An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  45. Medium 4.3

    CVE-2023-3115 · GitLab

    An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositories.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  46. Medium 4.3

    CVE-2023-2233 · GitLab

    An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4 before 16.4.1. It allows a project reporter to leak the owner's Sentry instance projects.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  47. Medium 5.7

    CVE-2023-0989 · GitLab

    An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to extract non-protected CI/CD variables by tricking a user to visit a fork with a malicious CI/CD configuration.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  48. High 7.5

    CVE-2023-5077 · HashiCorp Vault

    The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

    Published 29 Sept 2023 · Fixed in 1.13.0 · NVD
  49. Medium 4.9

    CVE-2023-3775 · HashiCorp Vault

    A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in another non-descendant namespace, potentially resulting in denial of service. Fixed in Vault Enterprise 1.15.0, 1.14.4, 1.13.8.

    Published 29 Sept 2023 · Fixed in 1.13.8, 1.14.4 · NVD
  50. High 7.5

    CVE-2023-5256 · Drupal

    In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not…

    Published 28 Sept 2023 · Fixed in 9.5.11, 10.0.11, 10.1.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.