UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,819
Published in 7 days
572
Critical in 30 days
383
Actively exploited
421

Latest vulnerabilities

38,819 vulnerabilities
  1. Medium 5.4

    CVE-2023-38303 · Webmin

    An issue was discovered in Webmin 2.021. One can exploit a stored Cross-Site Scripting (XSS) attack to achieve Remote Command Execution (RCE) through the Users and Group's real name parameter.

    Published 31 Jul 2023 · NVD
  2. Low

    CVE-2023-32302 · Silverstripe CMS

    Members with no password can be created and bypass custom login forms

    Published 31 Jul 2023 · Fixed in 4.13.14, 5.0.13 · Project advisories (GitHub)
  3. Medium 4.3

    CVE-2023-38685 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, information about restricted-visibility topic tags could be obtained by unauthorized users. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches.

    Published 28 Jul 2023 · Fixed in 3.0.6 · NVD
  4. High 7.5

    CVE-2023-38684 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, in multiple controller actions, Discourse accepts limit params but does not impose any upper bound on the values being accepted. Without an upper bound, the software may allow arbitrary users to generate DB queries which may end up…

    Published 28 Jul 2023 · Fixed in 3.0.6 · NVD
  5. Medium 6.5

    CVE-2023-38498 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can prevent the defer queue from proceeding promptly on sites hosted in the same multisite installation. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and…

    Published 28 Jul 2023 · Fixed in 3.0.6 · NVD
  6. Medium 4.3

    CVE-2023-37906 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are…

    Published 28 Jul 2023 · Fixed in 3.0.6 · NVD
  7. Low 3.1

    CVE-2023-37904 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. As a workaround, use restrict to email address…

    Published 28 Jul 2023 · Fixed in 3.0.6 · NVD
  8. Medium 5.4

    CVE-2023-37467 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous (i.e. unauthenticated) users. There are no known XSS vectors at the moment, but should one be discovered, this…

    Published 28 Jul 2023 · NVD
  9. Medium 4.9

    CVE-2023-3774 · HashiCorp Vault

    An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service. Fixed in 1.14.1, 1.13.5, and 1.12.9.

    Published 28 Jul 2023 · NVD
  10. High 8.8

    CVE-2023-38488 · Kirby

    Field injection in the KirbyData text storage handler

    Published 27 Jul 2023 · Fixed in 3.7.5.2, 3.8.4.1, 3.9.6 · NVD, Project advisories (GitHub)
  11. Critical 10.0

    CVE-2023-38490 · Kirby

    XML External Entity (XXE) vulnerability in the XML data handler

    Published 27 Jul 2023 · Fixed in 3.7.5.2, 3.8.4.1, 3.9.6 · NVD, Project advisories (GitHub)
  12. High 7.5

    CVE-2023-38492 · Kirby

    Denial of service from unlimited password lengths

    Published 27 Jul 2023 · Fixed in 3.7.5.2, 3.8.4.1, 3.9.6 · NVD, Project advisories (GitHub)
  13. High 7.3

    CVE-2023-38489 · Kirby

    Insufficient Session Expiration after a password change

    Published 27 Jul 2023 · Fixed in 3.7.5.2, 3.8.4.1, 3.9.6 · NVD, Project advisories (GitHub)
  14. Medium 5.4

    CVE-2023-38491 · Kirby

    Cross-site scripting (XSS) from MIME type auto-detection of uploaded files

    Published 27 Jul 2023 · Fixed in 3.7.5.2, 3.8.4.1, 3.9.6 · NVD, Project advisories (GitHub)
  15. High 7.5

    CVE-2023-38285 · ModSecurity

    Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.

    Published 26 Jul 2023 · Fixed in 3.0.10 · NVD
  16. Medium 5.4

    CVE-2023-37692 · October CMS

    An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.

    Published 26 Jul 2023 · NVD
  17. Critical 9.8

    CVE-2023-33308 · Fortinet FortiProxy, Fortinet FortiOS

    A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside deep or full packet inspection.

    Published 26 Jul 2023 · NVD
  18. Medium 5.4

    CVE-2023-39151 · Jenkins

    Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.

    Published 26 Jul 2023 · NVD
  19. Medium 4.3

    CVE-2023-1401 · GitLab

    An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies on redirect during authorization.

    Published 26 Jul 2023 · Fixed in 4.0.5 · NVD
  20. Medium 6.5

    CVE-2023-38503 · Directus

    Incorrect Permission Checking for GraphQL Subscriptions

    Published 25 Jul 2023 · Fixed in 10.5.0 · NVD, Project advisories (GitHub)
  21. Critical 9.8

    CVE-2023-35982 · HPE ArubaOS

    There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating…

    Published 25 Jul 2023 · Fixed in 10.4.0.2 · NVD
  22. Critical 9.8

    CVE-2023-35981 · HPE ArubaOS

    There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating…

    Published 25 Jul 2023 · Fixed in 10.4.0.2 · NVD
  23. Critical 9.8

    CVE-2023-35980 · HPE ArubaOS

    There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating…

    Published 25 Jul 2023 · Fixed in 10.4.0.2 · NVD
  24. Medium 6.5

    CVE-2023-36826 · Sentry

    Improper authorization on debug and artifact file downloads

    Published 25 Jul 2023 · Fixed in 23.5.2 · NVD, Project advisories (GitHub)
  25. Medium 6.1

    CVE-2023-39175 · TeamCity

    In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible

    Published 25 Jul 2023 · Fixed in 2023.05.2 · NVD
  26. High 7.5

    CVE-2023-39174 · TeamCity

    In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers

    Published 25 Jul 2023 · Fixed in 2023.05.2 · NVD
  27. High 8.8

    CVE-2023-39173 · TeamCity

    In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access

    Published 25 Jul 2023 · Fixed in 2023.05.2 · NVD
  28. High 7.5

    CVE-2023-35943 · Envoy

    CORS filter segfault when origin header is removed

    Published 25 Jul 2023 · Fixed in 1.24.10, 1.25.9, 1.26.4 · NVD, Project advisories (GitHub)
  29. Medium 5.3

    CVE-2023-35944 · Envoy

    Incorrect handling of HTTP requests and responses with mixed case schemes in Envoy

    Published 25 Jul 2023 · Fixed in 1.24.10, 1.25.9, 1.26.4 · NVD, Project advisories (GitHub)
  30. Medium 6.5

    CVE-2023-35942 · Envoy

    gRPC access log crash caused by the listener draining

    Published 25 Jul 2023 · Fixed in 1.24.10, 1.25.9, 1.26.4 · NVD, Project advisories (GitHub)
  31. Critical 9.8

    CVE-2023-35941 · Envoy

    OAuth2 credentials exploit with permanent validity

    Published 25 Jul 2023 · Fixed in 1.24.10, 1.25.9, 1.26.4 · NVD, Project advisories (GitHub)
  32. High 7.5

    CVE-2023-34235 · Strapi

    Leaking sensitive user information still possible by filtering on private with prefix fields

    Published 25 Jul 2023 · Fixed in 4.10.8 · NVD, Project advisories (GitHub)
  33. High 7.1

    CVE-2023-34093 · Strapi

    Making all attributes on a content-type public via review workflows

    Published 25 Jul 2023 · Fixed in 4.10.8 · NVD, Project advisories (GitHub)
  34. Medium 4.7

    CVE-2023-37905 · TYPO3

    Cross-Site Scripting in CKEditor4 WordCount Plugin

    Published 25 Jul 2023 · Fixed in 11.5.30 · Project advisories (GitHub)
  35. Medium 5.3

    CVE-2023-38499 · TYPO3

    Information Disclosure due to Out-of-scope Site Resolution

    Published 25 Jul 2023 · Fixed in 10.4.39, 11.5.30, 12.4.4 · NVD, Project advisories (GitHub)
  36. Medium 5.4

    CVE-2023-36806 · Contao

    Cross-site scripting in widgets with units

    Published 25 Jul 2023 · Fixed in 4.9.42, 4.13.28, 5.1.10 · NVD, Project advisories (GitHub)
  37. Medium 5.5

    CVE-2023-20593 · Xen

    An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.

    Published 24 Jul 2023 · NVD
  38. Medium 5.5

    CVE-2023-3745 · ImageMagick

    A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.

    Published 24 Jul 2023 · Fixed in 6.9-11-0, 7.0.10-0 · NVD
  39. Medium 4.3

    CVE-2023-3247 · PHP

    In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a…

    Published 22 Jul 2023 · Fixed in 8.0.29, 8.1.20, 8.2.7 · NVD
  40. Medium 5.3

    CVE-2023-3102 · GitLab

    A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows access to titles of private issue and MR.

    Published 21 Jul 2023 · Fixed in 16.0.6 · NVD
  41. Medium 6.1

    CVE-2023-3822 · Pimcore

    Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4.

    Published 21 Jul 2023 · Fixed in 10.6.4 · NVD
  42. Medium 5.4

    CVE-2023-3821 · Pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.

    Published 21 Jul 2023 · Fixed in 10.6.4 · NVD
  43. Critical 9.8

    CVE-2023-38646 · Metabase

    Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

    Published 21 Jul 2023 · Fixed in 1.44.7.1, 1.45.4.1, 1.46.6.1 · NVD
  44. High 7.2

    CVE-2023-3820 · Pimcore

    SQL Injection in Dataobjects sorting

    Published 21 Jul 2023 · Fixed in 10.6.4 · NVD, Project advisories (GitHub)
  45. Medium 6.5

    CVE-2023-3819 · Pimcore

    Exposure of Sensitive Information to an Unauthorized Actor

    Published 21 Jul 2023 · Fixed in 10.6.4 · NVD, Project advisories (GitHub)
  46. Medium 6.5

    CVE-2023-3484 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all versions starting from 16.1 before 16.1.2. An attacker could change the name or path of a public top-level group in certain situations.

    Published 21 Jul 2023 · Fixed in 15.11.11, 16.0.7, 16.1.2 · NVD
  47. Critical 9.8Actively exploited

    CVE-2023-38203 · Adobe ColdFusion

    Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

    Published 20 Jul 2023 · NVD
  48. Medium 5.9

    CVE-2023-3347 · Samba

    A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages…

    Published 20 Jul 2023 · Fixed in 4.17.10, 4.18.5 · NVD
  49. Medium 5.3

    CVE-2023-34968 · Samba

    A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path.

    Published 20 Jul 2023 · Fixed in 4.16.11, 4.17.10, 4.18.5 · NVD
  50. Medium 5.3

    CVE-2023-34967 · Samba

    A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the…

    Published 20 Jul 2023 · Fixed in 4.16.11, 4.17.10, 4.18.5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.