UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,819
Published in 7 days
572
Critical in 30 days
383
Actively exploited
421

Latest vulnerabilities

38,819 vulnerabilities
  1. Low 3.3

    CVE-2023-39978 · ImageMagick

    ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.

    Published 8 Aug 2023 · Fixed in 6.9.12-91 · NVD
  2. Critical 9.8

    CVE-2023-39524 · PrestaShop

    PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, SQL injection possible in the product search field, in BO's product page. Version 8.1.1 contains a patch for this issue. There are no known workarounds.

    Published 7 Aug 2023 · Fixed in 8.1.1 · NVD
  3. Medium 6.5

    CVE-2022-38795 · Gitea

    In Gitea through 1.17.1, repo cloning can occur in the migration function.

    Published 7 Aug 2023 · NVD
  4. Critical 9.1

    CVE-2023-39530 · PrestaShop

    File deletion via CustomerMessage

    Published 7 Aug 2023 · Fixed in 8.1.1 · NVD, Project advisories (GitHub)
  5. Critical 9.1

    CVE-2023-39529 · PrestaShop

    File deletion via attachment API

    Published 7 Aug 2023 · Fixed in 8.1.1 · NVD, Project advisories (GitHub)
  6. High 8.6

    CVE-2023-39528 · PrestaShop

    Reading a file through path traversal

    Published 7 Aug 2023 · Fixed in 8.1.1 · NVD, Project advisories (GitHub)
  7. Medium 6.1

    CVE-2023-39527 · PrestaShop

    New possible XSS injection through Validate::isCleanHTML method

    Published 7 Aug 2023 · Fixed in 1.7.8.10, 8.0.5 · NVD, Project advisories (GitHub)
  8. Critical 9.8

    CVE-2023-39526 · PrestaShop

    SQL manager vulnerability (potential RCE)

    Published 7 Aug 2023 · Fixed in 1.7.8.10, 8.0.5 · NVD, Project advisories (GitHub)
  9. Critical 9.1

    CVE-2023-39525 · PrestaShop

    path traversal: file deletion

    Published 7 Aug 2023 · Fixed in 8.1.1 · NVD, Project advisories (GitHub)
  10. High 8.1

    CVE-2023-39349 · Sentry

    Privilege escalation via ApiTokensEndpoint

    Published 7 Aug 2023 · Fixed in 23.7.2 · NVD, Project advisories (GitHub)
  11. High 8.8

    CVE-2023-39508 · Apache Airflow

    Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The "Run…

    Published 5 Aug 2023 · Fixed in 2.6.0 · NVD
  12. Critical 9.8

    CVE-2023-37470 · Metabase

    Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3, and 1.46.6.4, a vulnerability could potentially allow remote code execution on one's Metabase server. The core issue is that one of the supported data warehouses (an embedded in-memory database H2), exposes a number of ways for a…

    Published 4 Aug 2023 · Fixed in 1.44.7.3, 1.45.4.3, 1.46.6.4 · NVD
  13. Medium 6.5

    CVE-2023-4002 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link any security policy project by its ID to projects or groups the user has access to, potentially revealing the security projects's configured security policies.

    Published 4 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  14. High 8.8

    CVE-2023-38708 · Pimcore

    Path traversal in AssetController:importServerFilesAction

    Published 3 Aug 2023 · Fixed in 10.6.7 · NVD, Project advisories (GitHub)
  15. Critical 9.8

    CVE-2023-4008 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random string added was known.

    Published 3 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  16. Medium 6.5

    CVE-2023-3932 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies.

    Published 3 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  17. Unrated

    WPV-644d89382edb · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Published 3 Aug 2023 · Fixed in 6.1.8 · WPVulnerability
  18. Medium 5.4

    CVE-2023-40068 · Advanced Custom Fields

    Advanced Custom Fields (ACF®): Cross-site Scripting

    Published 3 Aug 2023 · NVD, WPVulnerability
  19. Medium 6.1

    CVE-2023-3470 · F5 BIG-IP

    Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account.  The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, the information required to generate the correct password.  On vCMP systems, all Guests share the same deterministic…

    Published 2 Aug 2023 · Fixed in 13.1.4, 14.1.4 · NVD
  20. Medium 5.4

    CVE-2023-38423 · F5 BIG-IP

    A cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 2 Aug 2023 · Fixed in 15.1.9.1, 16.1.3.5, 17.1.0.2 · NVD
  21. Medium 4.3

    CVE-2023-38419 · F5 BIG-IP

    An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 2 Aug 2023 · Fixed in 15.1.9.1, 16.1.3.5, 17.1.0.2 · NVD
  22. High 7.8

    CVE-2023-38418 · F5 BIG-IP

    The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 2 Aug 2023 · NVD
  23. Medium 6.1

    CVE-2023-38138 · F5 BIG-IP

    A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 2 Aug 2023 · Fixed in 15.1.9.1, 16.1.3.5, 17.1.0.2 · NVD
  24. Medium 5.5

    CVE-2023-36858 · F5 BIG-IP

    An insufficient verification of data vulnerability exists in BIG-IP Edge Client for Windows and macOS that may allow an attacker to modify its configured server list.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 2 Aug 2023 · NVD
  25. Medium 4.3

    CVE-2023-3426 · Liferay Portal / DXP

    The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.

    Published 2 Aug 2023 · NVD
  26. Medium 6.5

    CVE-2023-3401 · GitLab

    An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.

    Published 2 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  27. Medium 4.3

    CVE-2023-2022 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have access to merge

    Published 2 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  28. High 7.5

    CVE-2023-4011 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS.

    Published 2 Aug 2023 · Fixed in 16.2.2 · NVD
  29. High 7.5

    CVE-2023-3994 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint.

    Published 2 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  30. High 7.5

    CVE-2023-3993 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint.

    Published 2 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  31. High 7.5

    CVE-2023-3900 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load.

    Published 2 Aug 2023 · Fixed in 16.1.3, 16.2.2 · NVD
  32. Medium 6.1

    CVE-2023-3500 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims.

    Published 2 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  33. Medium 6.5

    CVE-2023-3385 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file. This was due to a bug in `tar`, fixed in…

    Published 2 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  34. High 7.5

    CVE-2023-3364 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the preview_markdown endpoint.

    Published 2 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  35. Medium 5.4

    CVE-2023-2164 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta.

    Published 2 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  36. Medium 4.3

    CVE-2023-1210 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to leak a user's email via an error message for groups that restrict membership by email domain.

    Published 2 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  37. High 7.5

    CVE-2023-0632 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible by using crafted payloads to search Harbor Registry.

    Published 2 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  38. Medium 5.5

    CVE-2023-38559 · Ghostscript

    A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs.

    Published 1 Aug 2023 · Fixed in 10.02.0 · NVD
  39. High 7.8

    CVE-2023-4033 · MLflow

    OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0.

    Published 1 Aug 2023 · Fixed in 2.6.0 · NVD
  40. Medium 5.3

    CVE-2023-3462 · HashiCorp Vault

    HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.

    Published 31 Jul 2023 · Fixed in 1.13.5 · NVD
  41. Medium 5.3

    CVE-2023-3817 · OpenSSL

    Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function…

    Published 31 Jul 2023 · Fixed in 3.0.10, 3.1.2 · NVD
  42. Medium 6.1Actively exploited

    CVE-2023-37580 · Zimbra Collaboration

    Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

    Published 31 Jul 2023 · Fixed in 8.8.15 · NVD
  43. Medium 5.4

    CVE-2023-38311 · Webmin

    An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the System Logs Viewer functionality. The vulnerability allows an attacker to store a malicious payload in the configuration field, triggering the execution of the payload when saving the configuration or when accessing the System Logs Viewer page.

    Published 31 Jul 2023 · NVD
  44. Medium 5.4

    CVE-2023-38310 · Webmin

    An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the configuration settings of the system logs functionality. The vulnerability allows an attacker to store an XSS payload in the configuration settings of specific log files. This results in the execution of that payload whenever the affected log files are accessed.

    Published 31 Jul 2023 · NVD
  45. Medium 6.1

    CVE-2023-38309 · Webmin

    An issue was discovered in Webmin 2.021. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the package search functionality. The vulnerability allows an attacker to inject a malicious payload in the "Search for Package" field, which gets reflected back in the application's response, leading to the execution of arbitrary JavaScript code within the context of the victim's…

    Published 31 Jul 2023 · NVD
  46. Medium 6.1

    CVE-2023-38308 · Webmin

    An issue was discovered in Webmin 2.021. A Cross-Site Scripting (XSS) vulnerability was discovered in the HTTP Tunnel functionality when handling third-party domain URLs. By providing a crafted URL from a third-party domain, an attacker can inject malicious code. leading to the execution of arbitrary JavaScript code within the context of the victim's browser.

    Published 31 Jul 2023 · NVD
  47. Medium 5.4

    CVE-2023-38307 · Webmin

    An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality. The vulnerability occurs when an authenticated user adds a new user and inserts an XSS payload into the user's real name.

    Published 31 Jul 2023 · NVD
  48. Medium 6.1

    CVE-2023-38306 · Webmin

    An issue was discovered in Webmin 2.021. A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality. Normally, the application restricts the upload of certain file types such as .svg, .php, etc., and displays an error message if a prohibited file type is detected. However, by following certain steps, an attacker can bypass these restrictions and inject…

    Published 31 Jul 2023 · NVD
  49. Medium 6.1

    CVE-2023-38305 · Webmin

    An issue was discovered in Webmin 2.021. The download functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a crafted download path containing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when the download link is accessed.

    Published 31 Jul 2023 · NVD
  50. Medium 5.4

    CVE-2023-38304 · Webmin

    An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality, allowing an attacker to store a malicious payload in the Group Name field when creating a new group.

    Published 31 Jul 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.