UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,795
Published in 7 days
548
Critical in 30 days
384
Actively exploited
421

Latest vulnerabilities

38,795 vulnerabilities
  1. High 7.8

    CVE-2023-36793 · .NET

    Visual Studio Remote Code Execution Vulnerability

    Published 12 Sept 2023 · NVD
  2. High 7.8

    CVE-2023-36792 · .NET

    Visual Studio Remote Code Execution Vulnerability

    Published 12 Sept 2023 · NVD
  3. Medium 5.7

    CVE-2023-36777 · Microsoft Exchange Server

    Microsoft Exchange Server Information Disclosure Vulnerability

    Published 12 Sept 2023 · NVD
  4. High 8.0

    CVE-2023-36757 · Microsoft Exchange Server

    Microsoft Exchange Server Spoofing Vulnerability

    Published 12 Sept 2023 · NVD
  5. High 8.0

    CVE-2023-36756 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 12 Sept 2023 · NVD
  6. High 8.0

    CVE-2023-36745 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 12 Sept 2023 · NVD
  7. High 8.0

    CVE-2023-36744 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 12 Sept 2023 · NVD
  8. Critical 9.8

    CVE-2023-40834 · OpenCart

    OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthenticated attackers to gain access to the application via a brute force attack to the password parameter.

    Published 12 Sept 2023 · NVD
  9. Medium 6.5

    CVE-2023-40712 · Apache Airflow

    Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability.

    Published 12 Sept 2023 · Fixed in 2.7.1 · NVD
  10. Medium 4.3

    CVE-2023-40611 · Apache Airflow

    Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.1 or later which has removed the vulnerability.

    Published 12 Sept 2023 · Fixed in 2.7.3 · NVD
  11. High 8.8

    CVE-2023-37881 · Wing FTP Server

    Weak access control in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0.

    Published 12 Sept 2023 · NVD
  12. High 7.5

    CVE-2023-37879 · Wing FTP Server

    Insecure storage of sensitive information in Wing FTP Server (User Web Client) allows information elicitation.This issue affects Wing FTP Server: <= 7.2.0.

    Published 12 Sept 2023 · NVD
  13. High 8.8

    CVE-2023-37878 · Wing FTP Server

    Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0.

    Published 12 Sept 2023 · NVD
  14. Medium 5.4

    CVE-2023-37875 · Wing FTP Server

    Improper encoding or escaping of output in Wing FTP Server (User Web Client) allows Cross-Site Scripting (XSS).This issue affects Wing FTP Server: <= 7.2.0.

    Published 12 Sept 2023 · NVD
  15. High 7.2

    CVE-2022-24093 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.

    Published 12 Sept 2023 · Fixed in 2.3.7, 2.4.3 · NVD
  16. High 7.5

    CVE-2023-32558 · Node.js

    The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

    Published 12 Sept 2023 · Fixed in 20.5.1 · NVD
  17. Medium 5.3

    CVE-2023-32005 · Node.js

    A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file stats through the `fs.statfs` API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.…

    Published 12 Sept 2023 · Fixed in 20.5.1 · NVD
  18. Medium 5.5

    CVE-2023-40032 · libvips

    libvips is a demand-driven, horizontally threaded image processing library. A specially crafted SVG input can cause libvips versions 8.14.3 or earlier to segfault when attempting to parse a malformed UTF-8 character. Users should upgrade to libvips version 8.14.4 (or later) when processing untrusted input.

    Published 11 Sept 2023 · Fixed in 8.14.4 · NVD
  19. Medium 4.3

    CVE-2023-4630 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project's imports.

    Published 11 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD
  20. Unrated

    WPV-dad0462eb592 · WooCommerce

    Vulnerability in WooCommerce

    Published 11 Sept 2023 · Fixed in 7.0.1 · WPVulnerability
  21. Unrated

    WPV-8b5ff6bece96 · WooCommerce

    Vulnerability in WooCommerce

    Published 11 Sept 2023 · Fixed in 7.9.0 · WPVulnerability
  22. High 8.8

    CVE-2023-4827 · Filester (WordPress plugin)

    File Manager Pro – Filester: Cross-Site Request Forgery (CSRF)

    Published 11 Sept 2023 · Fixed in 1.8 · WPVulnerability
  23. High 7.8

    CVE-2023-4807 · OpenSSL

    Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the…

    Published 8 Sept 2023 · Fixed in 1.1.1w, 3.0.11, 3.1.3 · NVD
  24. Critical 9.6

    CVE-2023-40029 · Argo CD

    Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. pull request #7139 introduced the ability to manage cluster labels and annotations. Since clusters are stored as secrets it also exposes the…

    Published 7 Sept 2023 · Fixed in 2.6.15, 2.7.14, 2.8.3 · NVD
  25. Medium 6.5

    CVE-2023-40584 · Argo CD

    Denial of Service to Argo CD repo-server

    Published 7 Sept 2023 · Fixed in 2.6.15, 2.7.14, 2.8.3 · NVD, Project advisories (GitHub)
  26. High 7.2

    CVE-2023-40060 · SolarWinds Serv-U

    A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action. 15.4.  SolarWinds found that the issue was not completely fixed in 15.4 Hotfix 1.

    Published 7 Sept 2023 · NVD
  27. High 7.5

    CVE-2023-30800 · MikroTik RouterOS

    The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTTP request. As a result, the web interface crashes and is immediately restarted. The issue was fixed in RouterOS 6.49.10 stable. RouterOS version 7 is not affected.

    Published 7 Sept 2023 · Fixed in 6.49.10 · NVD
  28. High 7.4

    CVE-2021-40699 · Adobe ColdFusion

    ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.

    Published 7 Sept 2023 · Fixed in 2018 · NVD
  29. High 7.4

    CVE-2021-40698 · Adobe ColdFusion

    ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vulnerability that can lead to a security feature bypass  . An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.

    Published 7 Sept 2023 · Fixed in 2018 · NVD
  30. Low 3.3

    CVE-2023-41053 · Redis

    Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for…

    Published 6 Sept 2023 · Fixed in 7.0.13 · NVD
  31. Medium 6.4

    CVE-2023-38486 · HPE ArubaOS

    A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypass security controls which would normally prohibit unsigned kernel images from executing. An attacker can use this vulnerability to execute arbitrary runtime operating systems, including unverified and unsigned OS images.

    Published 6 Sept 2023 · Fixed in 8.10.0.7, 8.11.1.1, 10.4.0.2 · NVD
  32. Medium 6.4

    CVE-2023-38485 · HPE ArubaOS

    Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code early in the boot sequence. An attacker could exploit this vulnerability to gain access to and change underlying sensitive information in the affected controller leading to complete system compromise.

    Published 6 Sept 2023 · Fixed in 8.10.0.7, 8.11.1.1, 10.4.0.2 · NVD
  33. Medium 6.4

    CVE-2023-38484 · HPE ArubaOS

    Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code early in the boot sequence. An attacker could exploit this vulnerability to gain access to and change underlying sensitive information in the affected controller leading to complete system compromise.

    Published 6 Sept 2023 · Fixed in 8.10.0.7, 8.11.1.1, 10.4.0.2 · NVD
  34. Critical 9.1Actively exploited

    CVE-2023-20269 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized…

    Published 6 Sept 2023 · NVD
  35. Medium 6.5

    CVE-2023-39265 · Apache Superset

    Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe…

    Published 6 Sept 2023 · NVD
  36. Medium 6.6

    CVE-2023-37941 · Apache Superset

    If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be…

    Published 6 Sept 2023 · NVD
  37. Medium 4.3

    CVE-2023-32672 · Apache Superset

    An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.

    Published 6 Sept 2023 · NVD
  38. High 7.2

    CVE-2021-36036 · Magento / Adobe Commerce

    Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving…

    Published 6 Sept 2023 · Fixed in 2.3.7, 2.4.2 · NVD
  39. High 7.2

    CVE-2021-36023 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

    Published 6 Sept 2023 · Fixed in 2.3.7, 2.4.2 · NVD
  40. High 7.2

    CVE-2021-36021 · Magento / Adobe Commerce

    Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.

    Published 6 Sept 2023 · Fixed in 2.3.7, 2.4.2 · NVD
  41. High 7.5

    CVE-2023-41328 · Frappe Framework

    Possibility of limited SQL injection due to insufficient validation

    Published 6 Sept 2023 · Fixed in 13.46.1, 14.20.0 · NVD, Project advisories (GitHub)
  42. Medium 4.3

    CVE-2023-39264 · Apache Superset

    By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.

    Published 6 Sept 2023 · NVD
  43. Medium 5.4

    CVE-2023-36388 · Apache Superset

    Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.

    Published 6 Sept 2023 · NVD
  44. Medium 5.4

    CVE-2023-36387 · Apache Superset

    An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

    Published 6 Sept 2023 · NVD
  45. Medium 4.3

    CVE-2023-27526 · Apache Superset

    A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0.

    Published 6 Sept 2023 · NVD
  46. Medium 4.3

    CVE-2023-27523 · Apache Superset

    Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.

    Published 6 Sept 2023 · NVD
  47. High 7.5

    GHSA-jm7h-w5q5-jpq9 · Squid

    SQUID-2020:13 Denial of Service in gopher gateway

    Published 6 Sept 2023 · Fixed in 6.0.1 · Project advisories (GitHub)
  48. High 7.5

    CVE-2023-41058 · Parse Server

    Parse Server is an open source backend server. In affected versions the Parse Cloud trigger `beforeFind` is not invoked in certain conditions of `Parse.Query`. This can pose a vulnerability for deployments where the `beforeFind` trigger is used as a security layer to modify the incoming query. The vulnerability has been fixed by refactoring the internal query pipeline for a more concise code…

    Published 4 Sept 2023 · Fixed in 5.5.5, 6.2.2 · NVD
  49. Medium 4.9

    CVE-2023-39582 · Chamilo LMS

    SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions.

    Published 1 Sept 2023 · NVD
  50. Critical 9.8

    CVE-2020-22612 · MyBB

    Installer RCE on settings file write in MyBB before 1.8.22.

    Published 1 Sept 2023 · Fixed in 1.8.22 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.