Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 38,819
- Published in 7 days
- 572
- Critical in 30 days
- 384
- Actively exploited
- 421
Latest vulnerabilities
38,819 vulnerabilities- High 7.5
CVE-2023-30800 · MikroTik RouterOS
The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTTP request. As a result, the web interface crashes and is immediately restarted. The issue was fixed in RouterOS 6.49.10 stable. RouterOS version 7 is not affected.
Published 7 Sept 2023 · Fixed in 6.49.10 · NVD - High 7.4
CVE-2021-40699 · Adobe ColdFusion
ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.
Published 7 Sept 2023 · Fixed in 2018 · NVD - High 7.4
CVE-2021-40698 · Adobe ColdFusion
ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an Use of Inherently Dangerous Function vulnerability that can lead to a security feature bypass . An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on the environment.
Published 7 Sept 2023 · Fixed in 2018 · NVD - Low 3.3
CVE-2023-41053 · Redis
Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for…
Published 6 Sept 2023 · Fixed in 7.0.13 · NVD - Medium 6.4
CVE-2023-38486 · HPE ArubaOS
A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypass security controls which would normally prohibit unsigned kernel images from executing. An attacker can use this vulnerability to execute arbitrary runtime operating systems, including unverified and unsigned OS images.
Published 6 Sept 2023 · Fixed in 8.10.0.7, 8.11.1.1, 10.4.0.2 · NVD - Medium 6.4
CVE-2023-38485 · HPE ArubaOS
Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code early in the boot sequence. An attacker could exploit this vulnerability to gain access to and change underlying sensitive information in the affected controller leading to complete system compromise.
Published 6 Sept 2023 · Fixed in 8.10.0.7, 8.11.1.1, 10.4.0.2 · NVD - Medium 6.4
CVE-2023-38484 · HPE ArubaOS
Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code early in the boot sequence. An attacker could exploit this vulnerability to gain access to and change underlying sensitive information in the affected controller leading to complete system compromise.
Published 6 Sept 2023 · Fixed in 8.10.0.7, 8.11.1.1, 10.4.0.2 · NVD - Critical 9.1Actively exploited
CVE-2023-20269 · Cisco ASA and Firepower Threat Defense
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized…
Published 6 Sept 2023 · NVD - Medium 6.5
CVE-2023-39265 · Apache Superset
Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe…
Published 6 Sept 2023 · NVD - Medium 6.6
CVE-2023-37941 · Apache Superset
If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be…
Published 6 Sept 2023 · NVD - Medium 4.3
CVE-2023-32672 · Apache Superset
An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.
Published 6 Sept 2023 · NVD - High 7.2
CVE-2021-36036 · Magento / Adobe Commerce
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving…
Published 6 Sept 2023 · Fixed in 2.3.7, 2.4.2 · NVD - High 7.2
CVE-2021-36023 · Magento / Adobe Commerce
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
Published 6 Sept 2023 · Fixed in 2.3.7, 2.4.2 · NVD - High 7.2
CVE-2021-36021 · Magento / Adobe Commerce
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.
Published 6 Sept 2023 · Fixed in 2.3.7, 2.4.2 · NVD - High 7.5
CVE-2023-41328 · Frappe Framework
Possibility of limited SQL injection due to insufficient validation
Published 6 Sept 2023 · Fixed in 13.46.1, 14.20.0 · NVD, Project advisories (GitHub) - Medium 4.3
CVE-2023-39264 · Apache Superset
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
Published 6 Sept 2023 · NVD - Medium 5.4
CVE-2023-36388 · Apache Superset
Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.
Published 6 Sept 2023 · NVD - Medium 5.4
CVE-2023-36387 · Apache Superset
An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.
Published 6 Sept 2023 · NVD - Medium 4.3
CVE-2023-27526 · Apache Superset
A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0.
Published 6 Sept 2023 · NVD - Medium 4.3
CVE-2023-27523 · Apache Superset
Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.
Published 6 Sept 2023 · NVD - High 7.5
GHSA-jm7h-w5q5-jpq9 · Squid
SQUID-2020:13 Denial of Service in gopher gateway
Published 6 Sept 2023 · Fixed in 6.0.1 · Project advisories (GitHub) - High 7.5
CVE-2023-41058 · Parse Server
Parse Server is an open source backend server. In affected versions the Parse Cloud trigger `beforeFind` is not invoked in certain conditions of `Parse.Query`. This can pose a vulnerability for deployments where the `beforeFind` trigger is used as a security layer to modify the incoming query. The vulnerability has been fixed by refactoring the internal query pipeline for a more concise code…
Published 4 Sept 2023 · Fixed in 5.5.5, 6.2.2 · NVD - Medium 4.9
CVE-2023-39582 · Chamilo LMS
SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions.
Published 1 Sept 2023 · NVD - Critical 9.8
CVE-2020-22612 · MyBB
Installer RCE on settings file write in MyBB before 1.8.22.
Published 1 Sept 2023 · Fixed in 1.8.22 · NVD - Medium 4.2
CVE-2022-22305 · Fortinet FortiSandbox, Fortinet FortiOS
An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and 6.0.x; FortiSandbox 4.0.x, 3.2.x and 3.1.x may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the listed products and some external peers.
Published 1 Sept 2023 · NVD - High 7.5
CVE-2023-4647 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances.
Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD - Medium 4.3
CVE-2023-4378 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for…
Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD - Medium 5.3
CVE-2023-4018 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to create model experiments in public projects.
Published 1 Sept 2023 · Fixed in 16.2.5 · NVD - Low 3.8
CVE-2023-3950 · GitLab
An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it.
Published 1 Sept 2023 · Fixed in 16.2.5 · NVD - High 7.2
CVE-2023-3915 · GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. If an external user is given an owner role on any group, that external user may escalate their privileges on the instance by creating a service account in that group. This service account is not classified…
Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD - Medium 6.5
CVE-2023-3210 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content.
Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD - Medium 6.5
CVE-2023-3205 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content.
Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD - Medium 4.3
CVE-2023-1555 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A namespace-level banned user can access the API.
Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD - Medium 6.1
CVE-2023-1279 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a different project.
Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD - Medium 4.3
CVE-2023-0120 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an unauthorised user.
Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD - Medium 4.3
CVE-2022-4343 · GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which a project member can leak credentials stored in site profile.
Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD - Unrated
WPV-2d2a9296eebe · Gtranslate (WordPress plugin)
Vulnerability in Translate WordPress with GTranslate
Published 1 Sept 2023 · Fixed in 3.0.4 · WPVulnerability - Medium 6.1
CVE-2023-41163 · Webmin
A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the replace in results field while replacing the results under the tools drop down.
Published 30 Aug 2023 · NVD - High 8.8
CVE-2023-40598 · Splunk Enterprise
In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance.
Published 30 Aug 2023 · Fixed in 8.2.12, 9.0.6, 9.1.1 · NVD - High 8.8
CVE-2023-40597 · Splunk Enterprise
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.
Published 30 Aug 2023 · Fixed in 8.2.12, 9.0.6 · NVD - High 8.8
CVE-2023-40596 · Splunk Enterprise
In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and subsequently install malicious code to achieve privilege escalation on the Windows machine.
Published 30 Aug 2023 · Fixed in 8.2.12, 9.0.6 · NVD - High 8.8
CVE-2023-40595 · Splunk Enterprise
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code.
Published 30 Aug 2023 · Fixed in 8.2.12, 9.0.6 · NVD - High 7.5
CVE-2023-40594 · Splunk Enterprise
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the `printf` SPL function to perform a denial of service (DoS) against the Splunk Enterprise instance.
Published 30 Aug 2023 · Fixed in 8.2.12, 9.0.6 · NVD - High 7.5
CVE-2023-40593 · Splunk Enterprise
In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor can send a malformed security assertion markup language (SAML) request to the `/saml/acs` REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.
Published 30 Aug 2023 · Fixed in 8.2.12, 9.0.6 · NVD - Medium 6.1
CVE-2023-40592 · Splunk Enterprise
In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XSS) on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk platform instance.
Published 30 Aug 2023 · Fixed in 8.2.12, 9.0.6 · NVD - Medium 5.3
CVE-2023-4522 · GitLab
An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 errors when viewing the commit.
Published 30 Aug 2023 · Fixed in 16.2.0 · NVD - Medium 6.5
CVE-2023-39615 · libxml2
Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.
Published 29 Aug 2023 · NVD - Medium 5.3
CVE-2023-39522 · authentik
Username enumeration attack
Published 29 Aug 2023 · Fixed in 2023.5.6, 2023.6.2 · NVD, Project advisories (GitHub) - High 7.2
CVE-2023-41362 · MyBB
ACP Templates RCE
Published 28 Aug 2023 · Fixed in 1.8.36 · NVD, Project advisories (GitHub) - Low
GHSA-4jj9-5vgc-gc4j · Frappe Framework
Possible HTML Injection attack
Published 28 Aug 2023 · Fixed in 14.31.0 · Project advisories (GitHub)
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.