UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,825
Published in 7 days
578
Critical in 30 days
384
Actively exploited
421

Latest vulnerabilities

38,825 vulnerabilities
  1. Low 2.7

    CVE-2023-3587 · Mattermost

    Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions.

    Published 17 Jul 2023 · Fixed in 7.8.7, 7.10.3 · NVD
  2. Medium 5.4

    CVE-2023-3586 · Mattermost

    Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boards to remain accessible.

    Published 17 Jul 2023 · Fixed in 7.8.7, 7.9.5, 7.10.3 · NVD
  3. Medium 4.3

    CVE-2023-3585 · Mattermost

    Mattermost Boards fail to properly validate a board link, allowing an attacker to crash a channel by posting a specially crafted boards link.

    Published 17 Jul 2023 · Fixed in 7.8.7, 7.9.5, 7.10.3 · NVD
  4. Low 3.1

    CVE-2023-3584 · Mattermost

    Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated attacker with knowledge of a Team Override Scheme ID to create a new team with said team override scheme.

    Published 17 Jul 2023 · Fixed in 7.8.5, 7.10.3 · NVD
  5. Medium 4.3

    CVE-2023-3582 · Mattermost

    Mattermost fails to verify channel membership when linking a board to a channel allowing a low-privileged authenticated user to link a Board to a private channel they don't have access to,

    Published 17 Jul 2023 · Fixed in 7.8.7, 7.9.5, 7.10.3 · NVD
  6. High 8.1

    CVE-2023-3581 · Mattermost

    Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs.

    Published 17 Jul 2023 · Fixed in 7.8.7, 7.9.5, 7.10.3 · NVD
  7. Medium 4.3

    CVE-2023-3577 · Mattermost

    Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SSRF.

    Published 17 Jul 2023 · Fixed in 7.8.7, 7.10.3 · NVD
  8. Medium 6.5

    CVE-2023-32600 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 17 Jul 2023 · Fixed in 1.0.119.1 · WPVulnerability
  9. Medium 5.9

    CVE-2021-31294 · Redis

    Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

    Published 15 Jul 2023 · Fixed in 6.2.0 · NVD
  10. High 7.5

    CVE-2023-36818 · Discourse

    Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit `52b003d915`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 14 Jul 2023 · NVD
  11. Medium 4.3

    CVE-2023-36466 · Discourse

    Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passed version of Discourse.

    Published 14 Jul 2023 · Fixed in 3.0.5 · NVD
  12. High 7.2

    CVE-2023-3673 · Pimcore

    SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.24.

    Published 14 Jul 2023 · Fixed in 10.5.24 · NVD
  13. Medium 5.3

    CVE-2023-2975 · OpenSSL

    Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misled by removing, adding or reordering such empty entries as these are ignored by the OpenSSL…

    Published 14 Jul 2023 · NVD
  14. High 7.2

    CVE-2023-3668 · Froxlor

    Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21.

    Published 14 Jul 2023 · Fixed in 2.0.21 · NVD
  15. Critical 9.1

    CVE-2023-37278 · GLPI

    GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An administrator can trigger SQL injection via dashboards administration. This vulnerability has been patched in version 10.0.9.

    Published 13 Jul 2023 · Fixed in 10.0.9 · NVD
  16. Medium 6.1

    CVE-2023-36473 · Discourse

    Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass CSP. The vulnerability is patched in the latest tests-passed, beta and stable branches.

    Published 13 Jul 2023 · Fixed in 3.0.5 · NVD
  17. High 8.8

    CVE-2022-24834 · Redis

    Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in…

    Published 13 Jul 2023 · Fixed in 6.0.20, 6.2.13, 7.0.12 · NVD
  18. High 7.5

    CVE-2023-29458 · Zabbix

    Duktape is an 3rd-party embeddable JavaScript engine, with a focus on portability and compact footprint. When adding too many values in valstack JavaScript will crash. This issue occurs due to bug in Duktape 2.6 which is an 3rd-party solution that we use.

    Published 13 Jul 2023 · NVD
  19. Medium 5.4

    CVE-2023-29452 · Zabbix

    Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.

    Published 13 Jul 2023 · NVD
  20. High 7.5

    CVE-2023-29451 · Zabbix

    Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy.

    Published 13 Jul 2023 · NVD
  21. High 7.5

    CVE-2023-29450 · Zabbix

    JavaScript pre-processing can be used by the attacker to gain access to the file system (read-only access on behalf of user "zabbix") on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data.

    Published 13 Jul 2023 · NVD
  22. Medium 4.9

    CVE-2023-29449 · Zabbix

    JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles (Admin and Superadmin). Administrative privileges should be typically granted to users who need to perform tasks that require more control over the system. The security risk is…

    Published 13 Jul 2023 · NVD
  23. Critical 9.8

    CVE-2023-37267 · Umbraco CMS

    Possible admin-level access to backoffice without authentication under rare conditions

    Published 13 Jul 2023 · Fixed in 10.6.1, 11.4.2, 12.0.1 · NVD, Project advisories (GitHub)
  24. Medium 6.5

    CVE-2023-3444 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to merge arbitrary code into protected branches.

    Published 13 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  25. High 7.5

    CVE-2023-3424 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.

    Published 13 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  26. Low 3.8

    CVE-2023-3363 · GitLab

    An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1, resulted in the Sidekiq log including webhook tokens when the log format was set to `default`.

    Published 13 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  27. Medium 5.3

    CVE-2023-3362 · GitLab

    An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access the import error information if a project was imported from GitHub.

    Published 13 Jul 2023 · Fixed in 16.0.6 · NVD
  28. Low 3.8

    CVE-2023-2620 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1. A maintainer could modify a webhook URL to leak masked webhook secrets by manipulating other masked portions. This addresses an incomplete fix for CVE-2023-0838.

    Published 13 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  29. Medium 4.3

    CVE-2023-2576 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. This allowed a developer to remove the CODEOWNERS rules and merge to a protected branch.

    Published 13 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  30. Medium 5.4

    CVE-2023-2200 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field.

    Published 13 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  31. Medium 6.5

    CVE-2023-2190 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. It may be possible for users to view new commits to private projects in a fork created while the project was public.

    Published 13 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  32. High 7.5

    CVE-2023-35945 · Envoy

    HTTP/2 memory leak in nghttp2 codec

    Published 12 Jul 2023 · Fixed in 1.24.9, 1.25.8, 1.26.3 · NVD, Project advisories (GitHub)
  33. Medium 4.9

    CVE-2023-38046 · Palo Alto Networks PAN-OS

    A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system.

    Published 12 Jul 2023 · Fixed in 10.2.4 · NVD
  34. High 7.5

    CVE-2023-29301 · Adobe ColdFusion

    Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the confidentiality of the user. Exploitation of this issue does not require user interaction.

    Published 12 Jul 2023 · NVD
  35. Critical 9.8Actively exploited

    CVE-2023-29300 · Adobe ColdFusion

    Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

    Published 12 Jul 2023 · NVD
  36. High 7.5Actively exploited

    CVE-2023-29298 · Adobe ColdFusion

    Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

    Published 12 Jul 2023 · NVD
  37. Medium 4.8

    GHSA-wp7j-3w22-93j6 · Frappe Framework

    html2text is not safe on user input

    Published 12 Jul 2023 · Fixed in 13.46.1, 14.20.0 · Project advisories (GitHub)
  38. Medium 6.5

    CVE-2023-38067 · TeamCity

    In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log

    Published 12 Jul 2023 · Fixed in 2023.05.1 · NVD
  39. Medium 6.1

    CVE-2023-38066 · TeamCity

    In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads

    Published 12 Jul 2023 · Fixed in 2023.05.1 · NVD
  40. Medium 5.4

    CVE-2023-38065 · TeamCity

    In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible

    Published 12 Jul 2023 · Fixed in 2023.05.1 · NVD
  41. Medium 6.5

    CVE-2023-38064 · TeamCity

    In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log

    Published 12 Jul 2023 · Fixed in 2023.05.1 · NVD
  42. Medium 5.4

    CVE-2023-38063 · TeamCity

    In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible

    Published 12 Jul 2023 · Fixed in 2023.05.1 · NVD
  43. Medium 6.5

    CVE-2023-38062 · TeamCity

    In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations

    Published 12 Jul 2023 · Fixed in 2023.05.1 · NVD
  44. Medium 5.4

    CVE-2023-38061 · TeamCity

    In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible

    Published 12 Jul 2023 · Fixed in 2023.05.1 · NVD
  45. High 7.5

    CVE-2020-20021 · MikroTik RouterOS

    An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon.

    Published 12 Jul 2023 · NVD
  46. Medium 6.5

    CVE-2023-36543 · Apache Airflow

    Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommended to upgrade to a version that is not affected

    Published 12 Jul 2023 · Fixed in 2.6.3 · NVD
  47. Medium 6.5

    CVE-2023-35908 · Apache Airflow

    Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgrade to a version that is not affected

    Published 12 Jul 2023 · Fixed in 2.6.3 · NVD
  48. Medium 6.5

    CVE-2023-22888 · Apache Airflow

    Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected

    Published 12 Jul 2023 · Fixed in 2.6.3 · NVD
  49. Medium 6.5

    CVE-2023-22887 · Apache Airflow

    Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected

    Published 12 Jul 2023 · Fixed in 2.6.3 · NVD
  50. Medium 6.5

    CVE-2022-46651 · Apache Airflow

    Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the…

    Published 12 Jul 2023 · Fixed in 2.6.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.