UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,825
Published in 7 days
578
Critical in 30 days
384
Actively exploited
421

Latest vulnerabilities

38,825 vulnerabilities
  1. High 8.1

    CVE-2023-33170 · .NET

    ASP.NET and Visual Studio Security Feature Bypass Vulnerability

    Published 11 Jul 2023 · Fixed in 6.0.20, 7.0.9 · NVD
  2. High 8.1

    CVE-2023-33127 · .NET

    .NET and Visual Studio Elevation of Privilege Vulnerability

    Published 11 Jul 2023 · Fixed in 6.0.20, 7.0.9 · NVD
  3. Critical 9.8

    CVE-2023-28001 · Fortinet FortiOS

    An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing the session of a deleted user in the REST API.

    Published 11 Jul 2023 · NVD
  4. High 7.2

    CVE-2023-23777 · Fortinet FortiWeb

    An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.18 and below may allow a privileged attacker to execute arbitrary bash commands via crafted cli backup parameters.

    Published 11 Jul 2023 · NVD
  5. Low 3.3

    CVE-2022-22302 · Fortinet FortiOS

    A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud…

    Published 11 Jul 2023 · NVD
  6. Medium 4.3

    CVE-2023-1936 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to leak the email address of a user who created a service desk issue.

    Published 11 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  7. High 8.8

    CVE-2023-36824 · Redis

    Heap overflow in COMMAND GETKEYS and ACL evaluation

    Published 10 Jul 2023 · Fixed in 7.0.12 · NVD, Project advisories (GitHub)
  8. Medium 5.5

    CVE-2023-35890 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file. IBM X-Force ID: 258637.

    Published 7 Jul 2023 · NVD
  9. Medium 6.8

    CVE-2023-36829 · Sentry

    CORS misconfiguration

    Published 6 Jul 2023 · Fixed in 23.6.2 · Project advisories (GitHub)
  10. High 7.5

    CVE-2023-36461 · Mastodon

    Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended…

    Published 6 Jul 2023 · Fixed in 3.5.9, 4.0.5, 4.1.3 · NVD
  11. High 7.3

    CVE-2023-36456 · authentik

    Lack of Proxy IP headers validation

    Published 6 Jul 2023 · Fixed in 2023.4.3, 2023.5.4, 2023.5.5 · NVD, Project advisories (GitHub)
  12. High 8.8

    CVE-2023-34193 · Zimbra Collaboration

    File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function.

    Published 6 Jul 2023 · NVD
  13. Critical 9.0Actively exploited

    CVE-2023-34192 · Zimbra Collaboration

    Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

    Published 6 Jul 2023 · NVD
  14. Critical 9.8

    CVE-2023-29382 · Zimbra Collaboration

    An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component.

    Published 6 Jul 2023 · NVD
  15. Critical 9.8

    CVE-2023-29381 · Zimbra Collaboration

    An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters.

    Published 6 Jul 2023 · NVD
  16. Medium 6.1

    CVE-2023-36459 · Mastodon

    XSS through oEmbed preview cards

    Published 6 Jul 2023 · Fixed in 3.5.9, 4.0.5, 4.1.3 · NVD, Project advisories (GitHub)
  17. Critical 9.9

    CVE-2023-36460 · Mastodon

    Arbitrary file creation through media attachments

    Published 6 Jul 2023 · Fixed in 3.5.9, 4.0.5, 4.1.3 · NVD, Project advisories (GitHub)
  18. Medium 5.4

    CVE-2023-36462 · Mastodon

    Verified profile links can be formatted in a misleading way

    Published 6 Jul 2023 · Fixed in 3.5.9, 4.0.5, 4.1.3 · NVD, Project advisories (GitHub)
  19. Critical 9.8

    CVE-2023-36808 · GLPI

    GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory.

    Published 5 Jul 2023 · Fixed in 10.0.8 · NVD
  20. High 7.5

    CVE-2023-35940 · GLPI

    GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an unauthenticated user to be able to access dashboards data. Version 10.0.8 contains a patch for this issue.

    Published 5 Jul 2023 · Fixed in 10.0.8 · NVD
  21. High 8.1

    CVE-2023-35939 · GLPI

    GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file accessible by an authenticated user (or not for certain actions), allows a threat actor to interact, modify, or see Dashboard data. Version 10.0.8 contains a patch for this issue.

    Published 5 Jul 2023 · Fixed in 10.0.8 · NVD
  22. Critical 9.8

    CVE-2023-35924 · GLPI

    GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory.

    Published 5 Jul 2023 · Fixed in 10.0.8 · NVD
  23. Medium 6.1

    CVE-2023-34244 · GLPI

    GLPI is a free asset and IT management software package. Starting in version 9.4.0 and prior to version 10.0.8, a malicious link can be crafted by an unauthenticated user that can exploit a reflected XSS in case any authenticated user opens the crafted link. Users should upgrade to version 10.0.8 to receive a patch.

    Published 5 Jul 2023 · Fixed in 10.0.8 · NVD
  24. Medium 6.5

    CVE-2023-34107 · GLPI

    GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user, allows access to the view all KnowbaseItems. Version 10.0.8 has a patch for this issue.

    Published 5 Jul 2023 · Fixed in 10.0.8 · NVD
  25. Medium 6.5

    CVE-2023-34106 · GLPI

    GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user. This allows access to the list of all users and their personal information. Users should upgrade to version 10.0.8 to receive a patch.

    Published 5 Jul 2023 · Fixed in 10.0.8 · NVD
  26. Medium 5.4

    CVE-2023-36828 · Statamic

    Antlers sanitizer cannot effectively sanitize malicious SVG

    Published 5 Jul 2023 · Fixed in 4.10.0 · NVD, Project advisories (GitHub)
  27. Critical 9.1

    CVE-2023-36934 · MOVEit Transfer

    In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a…

    Published 5 Jul 2023 · Fixed in 14.0.7, 14.1.8, 15.0.4 · NVD
  28. High 7.5

    CVE-2023-36933 · MOVEit Transfer

    In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception. Triggering this workflow can cause the MOVEit Transfer application to terminate unexpectedly.

    Published 5 Jul 2023 · Fixed in 2022.0.7, 2022.1.8, 2023.0.4 · NVD
  29. High 8.1

    CVE-2023-36932 · MOVEit Transfer

    In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted…

    Published 5 Jul 2023 · Fixed in 2022.0.7, 2022.1.8, 2023.0.4 · NVD
  30. Medium 4.4

    CVE-2023-3515 · Gitea

    Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4.

    Published 5 Jul 2023 · Fixed in 1.19.4 · NVD
  31. High 7.5

    CVE-2023-35979 · HPE ArubaOS

    There is an unauthenticated buffer overflow vulnerability in the process controlling the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in a Denial-of-Service (DoS) condition affecting the web-based management interface of the controller.

    Published 5 Jul 2023 · Fixed in 8.10.0.7, 8.11.1.1, 10.4.0.2 · NVD
  32. Medium 6.1

    CVE-2023-35978 · HPE ArubaOS

    A vulnerability in ArubaOS could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

    Published 5 Jul 2023 · Fixed in 8.10.0.7, 8.11.1.1, 10.4.0.2 · NVD
  33. Medium 6.5

    CVE-2023-35977 · HPE ArubaOS

    Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation could allow access to data beyond what is authorized by the users existing privilege level.

    Published 5 Jul 2023 · Fixed in 8.10.0.7, 8.11.1.1, 10.4.0.2 · NVD
  34. Medium 6.5

    CVE-2023-35976 · HPE ArubaOS

    Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation could allow access to data beyond what is authorized by the users existing privilege level.

    Published 5 Jul 2023 · Fixed in 8.10.0.7, 8.11.1.1, 10.4.0.2 · NVD
  35. High 8.1

    CVE-2023-35975 · HPE ArubaOS

    An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to delete arbitrary files in the underlying operating system.

    Published 5 Jul 2023 · Fixed in 8.10.0.7, 8.11.1.1, 10.4.0.2 · NVD
  36. High 7.2

    CVE-2023-35974 · HPE ArubaOS

    Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

    Published 5 Jul 2023 · Fixed in 8.10.0.7, 8.11.1.1, 10.4.0.2 · NVD
  37. High 7.2

    CVE-2023-35973 · HPE ArubaOS

    Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

    Published 5 Jul 2023 · Fixed in 8.10.0.7, 8.11.1.1, 10.4.0.2 · NVD
  38. High 7.2

    CVE-2023-35972 · HPE ArubaOS

    An authenticated remote command injection vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.

    Published 5 Jul 2023 · Fixed in 8.10.0.7, 8.11.1.1, 10.4.0.2 · NVD
  39. Medium 6.1

    CVE-2023-35971 · HPE ArubaOS

    A vulnerability in the ArubaOS web-based management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

    Published 5 Jul 2023 · Fixed in 8.10.0.7, 8.11.1.1, 10.4.0.2 · NVD
  40. Medium 4.3

    CVE-2022-47172 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-Site Request Forgery (CSRF)

    Published 5 Jul 2023 · Fixed in 2.6.3 · WPVulnerability
  41. Medium 6.5

    CVE-2023-36822 · Uptime Kuma

    Authenticated path traversal via plugin repository name leading to unavailability or data loss

    Published 4 Jul 2023 · Fixed in 1.22.1 · Project advisories (GitHub)
  42. High 8.8

    CVE-2023-36821 · Uptime Kuma

    Authenticated remote code execution via malicious plugin installation

    Published 4 Jul 2023 · Fixed in 1.22.1 · Project advisories (GitHub)
  43. Medium 6.1

    CVE-2023-1119 · WP Optimize (WordPress plugin)

    WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance: Cross-site Scripting

    Published 4 Jul 2023 · Fixed in 3.2.13 · WPVulnerability
  44. Medium 6.5

    CVE-2023-2728 · Kubernetes

    Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the…

    Published 3 Jul 2023 · NVD
  45. Medium 6.5

    CVE-2023-2727 · Kubernetes

    Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

    Published 3 Jul 2023 · NVD
  46. High 7.5

    CVE-2023-30589 · Node.js

    The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16,…

    Published 1 Jul 2023 · Fixed in 16.20.1, 18.16.1, 20.3.1 · NVD
  47. High 7.5

    CVE-2023-30586 · Node.js

    A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for…

    Published 1 Jul 2023 · Fixed in 20.3.1 · NVD
  48. Medium 5.3

    CVE-2023-37305 · MediaWiki

    An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/Page/PageContentHandler.php and includes/Page/PageDisplayHandler.php, hidden users can be exposed via public interfaces.

    Published 30 Jun 2023 · NVD
  49. Medium 5.4

    CVE-2023-37304 · MediaWiki

    An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3. includes/DoubleWiki.php allows XSS via the column alignment feature.

    Published 30 Jun 2023 · NVD
  50. Critical 9.8

    CVE-2023-37303 · MediaWiki

    An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails after a temporary browser hang and a DBQueryDisconnectedError error message.

    Published 30 Jun 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.