UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,795
Published in 7 days
548
Critical in 30 days
384
Actively exploited
421

Latest vulnerabilities

38,795 vulnerabilities
  1. High 7.2

    CVE-2023-38886 · Dolibarr ERP CRM

    An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.

    Published 20 Sept 2023 · NVD
  2. High 7.2

    CVE-2023-40934 · Nagios XI

    A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings.

    Published 19 Sept 2023 · Fixed in 5.11.2 · NVD
  3. High 8.8

    CVE-2023-40933 · Nagios XI

    A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function.

    Published 19 Sept 2023 · Fixed in 5.11.2 · NVD
  4. Medium 5.4

    CVE-2023-40932 · Nagios XI

    A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means the attacker is able to to steal plaintext credentials.

    Published 19 Sept 2023 · Fixed in 5.11.2 · NVD
  5. Medium 6.5

    CVE-2023-40931 · Nagios XI

    A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php

    Published 19 Sept 2023 · Fixed in 5.11.2 · NVD
  6. Medium 5.4

    CVE-2023-43566 · TeamCity

    In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration

    Published 19 Sept 2023 · Fixed in 2023.05.4 · NVD
  7. Critical 9.8Actively exploited

    CVE-2023-42793 · TeamCity

    In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

    Published 19 Sept 2023 · Fixed in 2023.05.4 · NVD
  8. High 8.8

    CVE-2023-22513 · Bitbucket Data Center

    This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.…

    Published 19 Sept 2023 · Fixed in 8.10.5, 8.11.4, 8.12.2 · NVD
  9. High 7.5

    CVE-2023-42451 · Mastodon

    Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2 contain a patch for this issue.

    Published 19 Sept 2023 · Fixed in 3.5.14, 4.0.10, 4.1.8 · NVD
  10. Medium 5.4

    CVE-2023-42452 · Mastodon

    Stored XSS through the translation feature

    Published 19 Sept 2023 · Fixed in 4.0.10, 4.1.8 · NVD, Project advisories (GitHub)
  11. High 7.5

    CVE-2023-42450 · Mastodon

    Server-side request forgery

    Published 19 Sept 2023 · Fixed in 4.2.0-rc2 · NVD, Project advisories (GitHub)
  12. Critical 9.8

    CVE-2023-5009 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. This was a bypass of [CVE-2023-3932](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3932) showing additional impact.

    Published 19 Sept 2023 · Fixed in 16.2.7, 16.3.4 · NVD
  13. Medium 4.8

    CVE-2023-4862 · Filester (WordPress plugin)

    File Manager Pro – Filester: Cross-site Scripting

    Published 19 Sept 2023 · Fixed in 1.8.1 · WPVulnerability
  14. High 7.2

    CVE-2023-4861 · Filester (WordPress plugin)

    File Manager Pro – Filester: Code Injection

    Published 19 Sept 2023 · Fixed in 1.8.1 · WPVulnerability
  15. Medium 5.9

    CVE-2023-4806 · GNU C Library

    A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of…

    Published 18 Sept 2023 · NVD
  16. Medium 6.5

    CVE-2023-4527 · GNU C Library

    A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.

    Published 18 Sept 2023 · Fixed in 2.36.113, 2.37.38, 2.38.19 · NVD
  17. High 8.8

    CVE-2023-43115 · Ghostscript

    In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS…

    Published 18 Sept 2023 · NVD
  18. Medium 5.4

    CVE-2023-39777 · vBulletin

    A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter.

    Published 16 Sept 2023 · NVD
  19. Medium 4.3

    CVE-2023-41900 · Eclipse Jetty

    Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared…

    Published 15 Sept 2023 · Fixed in 9.4.52, 10.0.16, 11.0.16 · NVD
  20. Medium 6.5

    CVE-2023-41043 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server processes to be killed and lead to downtime. The issue is patched in version 3.1.1 of the `stable`…

    Published 15 Sept 2023 · Fixed in 3.1.1 · NVD
  21. Medium 6.5

    CVE-2023-41042 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed`…

    Published 15 Sept 2023 · Fixed in 3.1.1 · NVD
  22. Medium 6.5

    CVE-2023-40588 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the…

    Published 15 Sept 2023 · Fixed in 3.1.1 · NVD
  23. Medium 5.3

    CVE-2023-40167 · Eclipse Jetty

    Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request…

    Published 15 Sept 2023 · Fixed in 9.4.52, 10.0.16, 11.0.16 · NVD
  24. Medium 6.5

    CVE-2023-38706 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the…

    Published 15 Sept 2023 · Fixed in 3.1.0 · NVD
  25. Low 2.7

    CVE-2023-37263 · Strapi

    Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible. Version 4.12.1 has a fix for this issue.

    Published 15 Sept 2023 · Fixed in 4.12.1 · NVD
  26. Low 3.1

    CVE-2023-36479 · Eclipse Jetty

    Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an…

    Published 15 Sept 2023 · Fixed in 9.4.52, 10.0.16, 11.0.16 · NVD
  27. Medium 6.1

    CVE-2023-40983 · Webmin

    A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Find in Results file.

    Published 15 Sept 2023 · NVD
  28. High 7.5

    CVE-2023-38039 · curl

    When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

    Published 15 Sept 2023 · Fixed in 8.3.0 · NVD
  29. Medium 5.4

    CVE-2023-40982 · Webmin

    A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cloned module name parameter.

    Published 15 Sept 2023 · NVD
  30. Medium 5.4

    CVE-2023-40986 · Webmin

    A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HTML via a crafted payload injected into the Custom field.

    Published 15 Sept 2023 · NVD
  31. Medium 5.4

    CVE-2023-40985 · Webmin

    An issue was discovered in Webmin 2.100. The File Manager functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when any file is searched/replaced.

    Published 15 Sept 2023 · NVD
  32. Medium 5.4

    CVE-2023-40984 · Webmin

    A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Replace in Results file.

    Published 15 Sept 2023 · NVD
  33. Medium 6.8

    CVE-2023-4680 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0…

    Published 15 Sept 2023 · Fixed in 1.12.11, 1.13.7, 1.14.3 · NVD
  34. High 7.6

    GHSA-22rr-f3p8-5gf8 · Directus

    VM2 Sandbox escape

    Published 14 Sept 2023 · Fixed in 10.6.0 · Project advisories (GitHub)
  35. Medium 5.3

    CVE-2023-38206 · Adobe ColdFusion

    Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints resulting in a low-confidentiality impact. Exploitation of this issue does not require user…

    Published 14 Sept 2023 · NVD
  36. High 7.5Actively exploited

    CVE-2023-38205 · Adobe ColdFusion

    Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

    Published 14 Sept 2023 · NVD
  37. Critical 9.8

    CVE-2023-38204 · Adobe ColdFusion

    Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

    Published 14 Sept 2023 · NVD
  38. Medium 5.4

    CVE-2023-41155 · Webmin

    A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the forward to field while creating a mail forwarding rule.

    Published 13 Sept 2023 · NVD
  39. Critical 9.8

    CVE-2023-41892 · Craft CMS

    Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.

    Published 13 Sept 2023 · Fixed in 4.4.15 · NVD
  40. Medium 5.7

    CVE-2023-36472 · Strapi

    Leaking sensitive user information, user reset password, tokens via content-manager views

    Published 13 Sept 2023 · Fixed in 4.11.7 · NVD, Project advisories (GitHub)
  41. Critical 9.8

    CVE-2023-38507 · Strapi

    Improper Rate Limiting

    Published 13 Sept 2023 · Fixed in 4.12.1 · NVD, Project advisories (GitHub)
  42. Medium 5.4

    CVE-2023-38215 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.17 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 13 Sept 2023 · Fixed in 6.5.18.0 · NVD
  43. Medium 5.4

    CVE-2023-38214 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.17 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 13 Sept 2023 · NVD
  44. High 8.8

    CVE-2023-34984 · Fortinet FortiWeb

    A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests.

    Published 13 Sept 2023 · NVD
  45. Medium 5.4

    CVE-2023-29183 · Fortinet FortiProxy, Fortinet FortiOS

    An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 and FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14 GUI may allow an authenticated attacker to trigger malicious JavaScript code execution via crafted guest management setting.

    Published 13 Sept 2023 · Fixed in 7.0.11, 7.0.12, 7.2.5 · NVD
  46. Medium 5.9

    CVE-2023-4813 · GNU C Library

    A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

    Published 12 Sept 2023 · Fixed in 2.36 · NVD
  47. High 8.8

    CVE-2023-4918 · Keycloak

    Plaintext Storage of User Password

    Published 12 Sept 2023 · Project advisories (GitHub)
  48. Medium 6.5

    CVE-2023-36799 · .NET

    .NET Core and Visual Studio Denial of Service Vulnerability

    Published 12 Sept 2023 · NVD
  49. High 7.8

    CVE-2023-36796 · .NET

    Visual Studio Remote Code Execution Vulnerability

    Published 12 Sept 2023 · NVD
  50. High 7.8

    CVE-2023-36794 · .NET

    Visual Studio Remote Code Execution Vulnerability

    Published 12 Sept 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.