Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 38,819
- Published in 7 days
- 572
- Critical in 30 days
- 383
- Actively exploited
- 421
Latest vulnerabilities
38,819 vulnerabilities- High 7.5
CVE-2023-34966 · Samba
An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop…
Published 20 Jul 2023 · Fixed in 4.16.11, 4.17.10, 4.18.5 · NVD - Medium 5.9
CVE-2022-2127 · Samba
An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can…
Published 20 Jul 2023 · Fixed in 4.16.10, 4.17.9, 4.18.4 · NVD - Critical 9.8
CVE-2023-38408 · OpenSSH
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.
Published 20 Jul 2023 · Fixed in 9.3 · NVD - High 8.0
CVE-2023-3467 · NetScaler ADC and Gateway
Privilege Escalation to root administrator (nsroot)
Published 19 Jul 2023 · Fixed in 13.0-91.13, 13.1-37.159, 13.1-49.13 · NVD - Medium 6.1
CVE-2023-3466 · NetScaler ADC and Gateway
Reflected Cross-Site Scripting (XSS)
Published 19 Jul 2023 · Fixed in 13.0-91.13, 13.1-37.159, 13.1-49.13 · NVD - Critical 9.8Actively exploited
CVE-2023-3519 · NetScaler ADC and Gateway
Unauthenticated remote code execution
Published 19 Jul 2023 · Fixed in 13.0-91.13, 13.1-37.159, 13.1-49.13 · NVD - High 7.2
CVE-2023-30799 · MikroTik RouterOS
MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse this vulnerability to execute arbitrary code on the system.
Published 19 Jul 2023 · Fixed in 6.49.7 · NVD - Medium 5.3
CVE-2023-3446 · OpenSSL
Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function…
Published 19 Jul 2023 · NVD - Critical 10.0
CVE-2023-3765 · MLflow
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
Published 19 Jul 2023 · Fixed in 2.5.0 · NVD - Medium 6.1
CVE-2022-4953 · Elementor
Elementor Website Builder – more than just a page builder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published 19 Jul 2023 · Fixed in 3.5.5 · NVD, WPVulnerability - High 8.8
CVE-2023-22508 · Confluence
This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Center & Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user…
Published 18 Jul 2023 · Fixed in 7.13.20, 7.19.8, 8.2.0 · NVD - High 8.8
CVE-2023-37897 · Grav
Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash…
Published 18 Jul 2023 · NVD - High 8.8
CVE-2023-22505 · Confluence
This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Center & Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user…
Published 18 Jul 2023 · Fixed in 8.3.2 · NVD - Medium 4.4
CVE-2023-22058 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…
Published 18 Jul 2023 · NVD - Medium 4.9
CVE-2023-22057 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 18 Jul 2023 · NVD - Medium 4.9
CVE-2023-22056 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 18 Jul 2023 · NVD - Medium 4.9
CVE-2023-22054 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 18 Jul 2023 · NVD - Medium 5.9
CVE-2023-22053 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.42 and prior and 8.0.33 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…
Published 18 Jul 2023 · NVD - Low 3.7
CVE-2023-22049 · Java
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows…
Published 18 Jul 2023 · NVD - Low 3.1
CVE-2023-22048 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server…
Published 18 Jul 2023 · NVD - Medium 4.9
CVE-2023-22046 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 18 Jul 2023 · NVD - Low 3.7
CVE-2023-22045 · Java
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows…
Published 18 Jul 2023 · NVD - Low 3.7
CVE-2023-22044 · Java
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with…
Published 18 Jul 2023 · NVD - Medium 5.9
CVE-2023-22043 · Java
Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u371. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle…
Published 18 Jul 2023 · NVD - Medium 5.1
CVE-2023-22041 · Java
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated…
Published 18 Jul 2023 · NVD - Medium 6.5
CVE-2023-22040 · Oracle WebLogic Server
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation,…
Published 18 Jul 2023 · NVD - Low 2.7
CVE-2023-22038 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to…
Published 18 Jul 2023 · NVD - Low 3.7
CVE-2023-22036 · Java
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker…
Published 18 Jul 2023 · NVD - Medium 4.4
CVE-2023-22033 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…
Published 18 Jul 2023 · NVD - Medium 4.4
CVE-2023-22031 · Oracle WebLogic Server
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows high privileged attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…
Published 18 Jul 2023 · NVD - Medium 4.9
CVE-2023-22008 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…
Published 18 Jul 2023 · NVD - Medium 4.9
CVE-2023-22007 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…
Published 18 Jul 2023 · NVD - Low 3.1
CVE-2023-22006 · Java
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker…
Published 18 Jul 2023 · NVD - Medium 4.4
CVE-2023-22005 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 18 Jul 2023 · NVD - Medium 4.9
CVE-2023-21950 · MySQL
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…
Published 18 Jul 2023 · NVD - Medium
CVE-2023-0105 · Keycloak
Impersonation and lockout possible through incorrect handling of email trust
Published 18 Jul 2023 · Fixed in 22.0.1 · Project advisories (GitHub) - Medium 6.7
CVE-2021-43072 · Fortinet FortiProxy, Fortinet FortiOS
A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiManager version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiOS version 7.0.0 through…
Published 18 Jul 2023 · Fixed in 6.4.9, 7.0.4, 7.0.6 · NVD - High 7.1
CVE-2023-33999 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)
Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Cross-site Scripting
Published 18 Jul 2023 · Fixed in 1.32.4 · WPVulnerability - High 8.1
CVE-2023-3615 · Mattermost
Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection.
Published 17 Jul 2023 · Fixed in 2.5.1 · NVD - Low 3.3
CVE-2023-3614 · Mattermost
Mattermost fails to properly validate a gif image file, allowing an attacker to consume a significant amount of server resources, making the server unresponsive for an extended period of time by linking to specially crafted image file.
Published 17 Jul 2023 · Fixed in 7.8.7, 7.9.5, 7.10.3 · NVD - Low 3.5
CVE-2023-3613 · Mattermost
Mattermost WelcomeBot plugin fails to to validate the membership status when inviting or adding users to channels allowing guest accounts to be added or invited to channels by default.
Published 17 Jul 2023 · Fixed in 7.8.6, 7.10.3 · NVD - Medium 6.5
CVE-2023-3593 · Mattermost
Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input.
Published 17 Jul 2023 · Fixed in 7.8.7, 7.9.5, 7.10.3 · NVD - High 8.2
CVE-2023-3591 · Mattermost
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
Published 17 Jul 2023 · Fixed in 7.8.7, 7.9.5, 7.10.3 · NVD - High 7.5
CVE-2023-3590 · Mattermost
Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments.
Published 17 Jul 2023 · Fixed in 7.10.3 · NVD - Low 2.7
CVE-2023-3587 · Mattermost
Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions.
Published 17 Jul 2023 · Fixed in 7.8.7, 7.10.3 · NVD - Medium 5.4
CVE-2023-3586 · Mattermost
Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boards to remain accessible.
Published 17 Jul 2023 · Fixed in 7.8.7, 7.9.5, 7.10.3 · NVD - Medium 4.3
CVE-2023-3585 · Mattermost
Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link.
Published 17 Jul 2023 · Fixed in 7.8.7, 7.9.5, 7.10.3 · NVD - Low 3.1
CVE-2023-3584 · Mattermost
Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated attacker with knowledge of a Team Override Scheme ID to create a new team with said team override scheme.
Published 17 Jul 2023 · Fixed in 7.8.5, 7.10.3 · NVD - Medium 4.3
CVE-2023-3582 · Mattermost
Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channel they don't have access to,
Published 17 Jul 2023 · Fixed in 7.8.7, 7.9.5, 7.10.3 · NVD - High 8.1
CVE-2023-3581 · Mattermost
Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs.
Published 17 Jul 2023 · Fixed in 7.8.7, 7.9.5, 7.10.3 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.