Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 38,819
- Published in 7 days
- 572
- Critical in 30 days
- 384
- Actively exploited
- 421
Latest vulnerabilities
38,819 vulnerabilities- Medium
GHSA-whww-ggp5-r2xq · Frappe Framework
Improper Authorization while renaming docs
Published 28 Aug 2023 · Fixed in 13.22.0 · Project advisories (GitHub) - Medium 6.1
CVE-2023-41080 · Apache Tomcat
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.
Published 25 Aug 2023 · NVD - Medium 6.1
CVE-2023-41250 · TeamCity
In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration
Published 25 Aug 2023 · Fixed in 2023.05.3 · NVD - Medium 6.1
CVE-2023-41249 · TeamCity
In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step
Published 25 Aug 2023 · Fixed in 2023.05.3 · NVD - Medium 5.4
CVE-2023-41248 · TeamCity
In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration
Published 25 Aug 2023 · Fixed in 2023.05.3 · NVD - Medium 4.8
CVE-2023-32575 · WooCommerce
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <= 1.3.25 versions.
Published 25 Aug 2023 · NVD - High 8.2
CVE-2023-4478 · Mattermost
Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts.
Published 25 Aug 2023 · Fixed in 7.8.9, 7.10.5 · NVD - Medium 5.3
CVE-2023-40217 · Python
An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not…
Published 25 Aug 2023 · Fixed in 3.9.18, 3.10.13, 3.11.5 · NVD - Unrated
CVE-2025-15695 · Gtranslate (WordPress plugin)
Translate WordPress with GTranslate: Cross-site Scripting
Published 25 Aug 2023 · Fixed in 3.0.10 · WPVulnerability - Medium 4.8
CVE-2023-4502 · Gtranslate (WordPress plugin)
Translate WordPress with GTranslate: Cross-site Scripting
Published 25 Aug 2023 · Fixed in 3.0.4 · WPVulnerability - Medium 6.1
CVE-2023-40030 · Rust
Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by `cargo build --timings`. A malicious package included as a dependency may inject nearly arbitrary HTML here, potentially leading to cross-site scripting if the report is subsequently uploaded…
Published 24 Aug 2023 · Fixed in 1.72.0 · NVD - High 7.5
CVE-2023-32559 · Node.js
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note…
Published 24 Aug 2023 · NVD - High 7.2
CVE-2023-40035 · Craft CMS
Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a…
Published 23 Aug 2023 · Fixed in 3.8.15, 4.4.15 · NVD - High 7.1
CVE-2023-40025 · Argo CD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug where open web terminal sessions do not expire. This bug allows users to send any websocket messages even if the token has already expired. The most straightforward scenario is when a user opens the terminal view and leaves it open for an extended period. This…
Published 23 Aug 2023 · NVD - High 8.0
CVE-2023-40273 · Apache Airflow
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to…
Published 23 Aug 2023 · NVD - Medium 5.9
CVE-2023-39441 · Apache Airflow
Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability. The default SSL context with SSL library did not check a server's X.509 certificate. Instead, the code accepted any certificate, which could result in the disclosure of mail server credentials or mail…
Published 23 Aug 2023 · Fixed in 2.7.0 · NVD - High 8.1
CVE-2023-37379 · Apache Airflow
Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can…
Published 23 Aug 2023 · Fixed in 2.7.0 · NVD - High 7.5
CVE-2023-1409 · MongoDB
If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate. This issue affect all…
Published 23 Aug 2023 · Fixed in 4.4.23, 6.0.7 · NVD - Medium 6.1
CVE-2023-32300 · Yoast SEO
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.8 versions.
Published 23 Aug 2023 · NVD - Medium 5.5
CVE-2023-4042 · Ghostscript
A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.
Published 23 Aug 2023 · Fixed in 9.51 · NVD - High 7.5
CVE-2023-41105 · Python
An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.
Published 23 Aug 2023 · NVD - High 7.5
CVE-2022-48571 · Memcached
memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP.
Published 22 Aug 2023 · NVD - Medium 5.9
CVE-2022-48566 · Python
An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.
Published 22 Aug 2023 · Fixed in 3.7.10, 3.8.7, 3.9.1 · NVD - Critical 9.8
CVE-2022-48565 · Python
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
Published 22 Aug 2023 · Fixed in 3.7.10, 3.8.7, 3.9.1 · NVD - Medium 6.5
CVE-2022-48564 · Python
read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
Published 22 Aug 2023 · Fixed in 3.7.10, 3.8.7, 3.9.1 · NVD - High 7.5
CVE-2022-48560 · Python
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
Published 22 Aug 2023 · Fixed in 3.6.11, 3.7.7, 3.8.2 · NVD - High 7.1
CVE-2022-48541 · ImageMagick
A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the "identify -help" command.
Published 22 Aug 2023 · NVD - High 7.5
CVE-2022-34038 · etcd
Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.
Published 22 Aug 2023 · NVD - High 7.5
CVE-2021-40211 · ImageMagick
An issue was discovered with ImageMagick 7.1.0-4 via Division by zero in function ReadEnhMetaFile of coders/emf.c.
Published 22 Aug 2023 · NVD - High 7.5
CVE-2021-30047 · vsftpd
VSFTPD 3.0.3 allows attackers to cause a denial of service due to limited number of connections allowed.
Published 22 Aug 2023 · NVD - Medium 6.1
CVE-2020-23992 · Nagios XI
Cross Site Scripting (XSS) in Nagios XI 5.7.1 allows remote attackers to run arbitrary code via returnUrl parameter in a crafted GET request.
Published 22 Aug 2023 · NVD - High 7.5
CVE-2020-22570 · Memcached
Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted meta command.
Published 22 Aug 2023 · Fixed in 1.6.3 · NVD - Medium 5.9
CVE-2020-22217 · c-ares
Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.
Published 22 Aug 2023 · NVD - High 7.8
CVE-2020-21890 · Ghostscript
Buffer Overflow vulnerability in clj_media_size function in devices/gdevclj.c in Artifex Ghostscript 9.50 allows remote attackers to cause a denial of service or other unspecified impact(s) via opening of crafted PDF document.
Published 22 Aug 2023 · NVD - Medium 5.5
CVE-2020-21710 · Ghostscript
A divide by zero issue discovered in eps_print_page in gdevepsn.c in Artifex Software GhostScript 9.50 allows remote attackers to cause a denial of service via opening of crafted PDF file.
Published 22 Aug 2023 · NVD - Medium 4.4
CVE-2020-21469 · PostgreSQL
An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly sending SIGHUP signals. NOTE: this is disputed by the vendor because untrusted users cannot send SIGHUP signals; they can only be sent by a PostgreSQL superuser, a user with pg_reload_conf access, or a user with sufficient privileges at the OS level (the postgres account or the root account).
Published 22 Aug 2023 · NVD - High 7.5
CVE-2020-20813 · OpenVPN
Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet.
Published 22 Aug 2023 · NVD - Low 3.3
CVE-2020-19909 · curl
Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially…
Published 22 Aug 2023 · NVD - Critical 9.8
CVE-2023-32002 · Node.js
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Published 21 Aug 2023 · NVD - Medium 5.4
CVE-2023-4453 · Pimcore
Cross-site Scripting (XSS) in DataObject datetime fields
Published 21 Aug 2023 · Fixed in 10.6.8 · NVD, Project advisories (GitHub) - Medium 5.3
CVE-2023-36674 · MediaWiki
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.
Published 20 Aug 2023 · Fixed in 1.35.11, 1.38.7, 1.39.4 · NVD - Medium
GHSA-38fg-mjcm-3hc6 · Frappe Framework
Error logs could potentially leak secrets
Published 17 Aug 2023 · Fixed in 14.45.0 · Project advisories (GitHub) - Medium 6.7
CVE-2023-29182 · Fortinet FortiOS
A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiOS before 7.0.3 allows a privileged attacker to execute arbitrary code via specially crafted CLI commands, provided the attacker were able to evade FortiOS stack protections.
Published 17 Aug 2023 · Fixed in 7.0.4 · NVD - High 7.5
CVE-2023-38737 · IBM WebSphere Application Server
IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 262567.
Published 16 Aug 2023 · NVD - Medium 6.5
CVE-2023-40028 · Ghost
Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's `content/`…
Published 15 Aug 2023 · Fixed in 5.59.1 · NVD - Medium 5.3
CVE-2023-38898 · Python
An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1) neither 3.7 nor any other release is affected (it is a bug in some 3.12 pre-releases); (2) there are no common scenarios in which an adversary can call _asyncio._swap_current_task but does not already have the ability…
Published 15 Aug 2023 · NVD - High 8.8
CVE-2023-32006 · Node.js
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Published 15 Aug 2023 · NVD - High 8.8
CVE-2023-32004 · Node.js
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the…
Published 15 Aug 2023 · NVD - Medium 5.3
CVE-2023-32003 · Node.js
`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the…
Published 15 Aug 2023 · NVD - High 7.5
CVE-2023-40518 · OpenLiteSpeed
LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers.
Published 14 Aug 2023 · Fixed in 1.7.18 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.