UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,819
Published in 7 days
572
Critical in 30 days
384
Actively exploited
421

Latest vulnerabilities

38,819 vulnerabilities
  1. Medium 4.9

    CVE-2023-3814 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Incorrect Authorization

    Published 14 Aug 2023 · Fixed in 5.1.1 · WPVulnerability
  2. Medium 5.5

    CVE-2021-28429 · FFmpeg

    Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.

    Published 11 Aug 2023 · NVD
  3. High 7.5

    CVE-2020-36138 · FFmpeg

    An issue was discovered in decode_frame in libavcodec/tiff.c in FFmpeg version 4.3, allows remote attackers to cause a denial of service (DoS).

    Published 11 Aug 2023 · NVD
  4. Medium 4.3

    CVE-2023-39418 · PostgreSQL

    A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

    Published 11 Aug 2023 · Fixed in 15.4 · NVD
  5. High 8.8

    CVE-2023-39417 · PostgreSQL

    IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

    Published 11 Aug 2023 · Fixed in 13.12, 14.9, 15.4 · NVD
  6. High 7.5

    CVE-2023-4108 · Mattermost

    Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged

    Published 11 Aug 2023 · Fixed in 7.8.8, 7.9.6, 7.10.4 · NVD
  7. Medium 6.5

    CVE-2023-4107 · Mattermost

    Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.

    Published 11 Aug 2023 · Fixed in 7.8.8, 7.9.6, 7.10.4 · NVD
  8. Medium 6.5

    CVE-2023-4106 · Mattermost

    Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks.

    Published 11 Aug 2023 · Fixed in 7.8.8, 7.9.6, 7.10.4 · NVD
  9. Medium 4.3

    CVE-2023-4105 · Mattermost

    Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message

    Published 11 Aug 2023 · Fixed in 7.8.8, 7.9.6, 7.10.4 · NVD
  10. Critical 9.8

    CVE-2023-3824 · PHP

    In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.

    Published 11 Aug 2023 · Fixed in 8.0.30, 8.1.22, 8.2.9 · NVD
  11. High 7.5

    CVE-2023-3823 · PHP

    In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick -…

    Published 11 Aug 2023 · Fixed in 8.0.30, 8.1.22, 8.2.9 · NVD
  12. Low 2.7

    CVE-2023-4304 · Froxlor

    Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.

    Published 11 Aug 2023 · Fixed in 2.0.22 · NVD
  13. High 7.2

    CVE-2023-35179 · SolarWinds Serv-U

    A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action.

    Published 11 Aug 2023 · NVD
  14. High 7.2

    CVE-2023-40225 · HAProxy

    HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.

    Published 10 Aug 2023 · Fixed in 2.6.15, 2.7.10, 2.8.2 · NVD
  15. High 7.8

    CVE-2023-39963 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a missing password confirmation allowed an attacker, after successfully stealing a session from a logged in user, to create app passwords for the victim. Nextcloud server versions…

    Published 10 Aug 2023 · Fixed in 24.0.12.5, 25.0.9, 26.0.4 · NVD
  16. High 7.7

    CVE-2023-39962 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a malicious user could delete any personal or global external storage, making them inaccessible for everyone else as well. Nextcloud server versions 25.0.9, 26.0.4,…

    Published 10 Aug 2023 · Fixed in 24.0.12.5, 25.0.9, 26.0.4 · NVD
  17. Medium 4.3

    CVE-2023-39961 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an image was shared without download permissions, the user could add the image inline into a text file and download it. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server…

    Published 10 Aug 2023 · Fixed in 25.0.9, 26.0.4 · NVD
  18. Medium 5.3

    CVE-2023-39959 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for the victim. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server…

    Published 10 Aug 2023 · Fixed in 25.0.9, 26.0.4 · NVD
  19. Medium 5.3

    CVE-2023-39958 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, missing protection allows an attacker to brute force the client secrets of configured OAuth2 clients. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions…

    Published 10 Aug 2023 · Fixed in 24.0.12.5, 25.0.9, 26.0.4 · NVD
  20. Medium 6.5

    CVE-2023-39952 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1, a user can access files inside a subfolder of a groupfolder accessible to them, even if advanced permissions would block access to the subfolder. Nextcloud Server versions 25.0.8, 26.0.3, and 27.0.1 and…

    Published 10 Aug 2023 · Fixed in 24.0.12.4, 25.0.8, 26.0.3 · NVD
  21. Unrated

    WPV-df8b70a8ee35 · Advanced Custom Fields Pro (WordPress plugin)

    Vulnerability in Advanced Custom Field Pro

    Published 10 Aug 2023 · WPVulnerability
  22. Unrated

    WPV-d1cadcfacbd1 · Advanced Custom Fields Pro (WordPress plugin)

    Vulnerability in Advanced Custom Field Pro

    Published 10 Aug 2023 · Fixed in 6.1.8 · WPVulnerability
  23. Critical 9.8

    CVE-2023-39008 · OPNsense

    A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands.

    Published 9 Aug 2023 · Fixed in 23.7 · NVD
  24. Critical 9.6

    CVE-2023-39007 · OPNsense

    /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php.

    Published 9 Aug 2023 · Fixed in 23.7 · NVD
  25. Medium 5.4

    CVE-2023-39006 · OPNsense

    The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization.

    Published 9 Aug 2023 · Fixed in 23.7 · NVD
  26. High 7.5

    CVE-2023-39005 · OPNsense

    Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2.

    Published 9 Aug 2023 · Fixed in 23.7 · NVD
  27. Critical 9.8

    CVE-2023-39004 · OPNsense

    Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.

    Published 9 Aug 2023 · Fixed in 23.7 · NVD
  28. High 7.5

    CVE-2023-39003 · OPNsense

    OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp.

    Published 9 Aug 2023 · Fixed in 23.7 · NVD
  29. Medium 6.1

    CVE-2023-39002 · OPNsense

    A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

    Published 9 Aug 2023 · Fixed in 23.7 · NVD
  30. Critical 9.8

    CVE-2023-39001 · OPNsense

    A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file.

    Published 9 Aug 2023 · Fixed in 23.7 · NVD
  31. Medium 6.1

    CVE-2023-39000 · OPNsense

    A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path.

    Published 9 Aug 2023 · Fixed in 23.7 · NVD
  32. Medium 6.5

    CVE-2023-38999 · OPNsense

    A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.

    Published 9 Aug 2023 · Fixed in 23.7 · NVD
  33. Medium 6.1

    CVE-2023-38998 · OPNsense

    An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL.

    Published 9 Aug 2023 · Fixed in 23.7 · NVD
  34. High 7.2

    CVE-2023-38997 · OPNsense

    A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands as root via a crafted ZIP archive.

    Published 9 Aug 2023 · Fixed in 23.7 · NVD
  35. Medium 6.8

    CVE-2023-39531 · Sentry

    Incorrect credential validation on OAuth token requests

    Published 9 Aug 2023 · Fixed in 23.7.2 · NVD, Project advisories (GitHub)
  36. Medium 6.5

    CVE-2023-38209 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that could lead to a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.

    Published 9 Aug 2023 · Fixed in 2.4.4 · NVD
  37. High 7.2

    CVE-2023-38208 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

    Published 9 Aug 2023 · Fixed in 2.4.4 · NVD
  38. High 7.5

    CVE-2023-38207 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by a XML Injection (aka Blind XPath Injection) vulnerability that could lead in minor arbitrary file system read. Exploitation of this issue does not require user interaction.

    Published 9 Aug 2023 · Fixed in 2.4.4 · NVD
  39. Critical 9.1

    CVE-2023-33934 · Apache Traffic Server

    Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.

    Published 9 Aug 2023 · NVD
  40. High 7.5

    CVE-2022-47185 · Apache Traffic Server

    Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.

    Published 9 Aug 2023 · NVD
  41. High 7.5Actively exploited

    CVE-2023-38180 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 8 Aug 2023 · Fixed in 2.1.40, 6.0.21, 7.0.10 · NVD
  42. High 7.5

    CVE-2023-35391 · .NET

    ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

    Published 8 Aug 2023 · Fixed in 2.1.40, 6.0.21, 7.0.10 · NVD
  43. High 8.8

    CVE-2023-38185 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 8 Aug 2023 · NVD
  44. High 8.0

    CVE-2023-38182 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 8 Aug 2023 · NVD
  45. High 8.8

    CVE-2023-38181 · Microsoft Exchange Server

    Microsoft Exchange Server Spoofing Vulnerability

    Published 8 Aug 2023 · NVD
  46. High 7.5

    CVE-2023-38178 · .NET

    .NET Core and Visual Studio Denial of Service Vulnerability

    Published 8 Aug 2023 · NVD
  47. High 7.8

    CVE-2023-35390 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 8 Aug 2023 · Fixed in 6.0.21, 7.0.10 · NVD
  48. High 8.0

    CVE-2023-35388 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 8 Aug 2023 · NVD
  49. High 8.8

    CVE-2023-35368 · Microsoft Exchange Server

    Microsoft Exchange Remote Code Execution Vulnerability

    Published 8 Aug 2023 · NVD
  50. Critical 9.8

    CVE-2023-21709 · Microsoft Exchange Server

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Published 8 Aug 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.