UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,825
Published in 7 days
578
Critical in 30 days
384
Actively exploited
421

Latest vulnerabilities

38,825 vulnerabilities
  1. Medium 6.1

    CVE-2023-37302 · MediaWiki

    An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).

    Published 30 Jun 2023 · NVD
  2. Medium 5.3

    CVE-2023-37301 · MediaWiki

    An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur.

    Published 30 Jun 2023 · NVD
  3. Medium 5.3

    CVE-2023-37300 · MediaWiki

    An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.

    Published 30 Jun 2023 · NVD
  4. Medium 6.1

    CVE-2023-3479 · Hestia Control Panel

    Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.

    Published 30 Jun 2023 · Fixed in 1.7.8 · NVD
  5. Medium 6.1

    CVE-2023-37256 · MediaWiki

    An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. It allows one to store javascript: URLs in URL fields, and automatically links these URLs.

    Published 29 Jun 2023 · NVD
  6. Medium 6.1

    CVE-2023-37255 · MediaWiki

    An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the "get edits" type is vulnerable to HTML injection through the User-Agent HTTP request header.

    Published 29 Jun 2023 · NVD
  7. Medium 6.1

    CVE-2023-37254 · MediaWiki

    An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. XSS can occur in Special:CargoQuery via a crafted page item when using the default format.

    Published 29 Jun 2023 · NVD
  8. Medium 6.1

    CVE-2023-37251 · MediaWiki

    An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3. The googleanalyticstrackurl parser function does not properly escape JavaScript in the onclick handler and does not prevent use of javascript: URLs.

    Published 29 Jun 2023 · NVD
  9. Medium 6.5

    CVE-2015-1313 · TeamCity

    JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after an initial unauthenticated request.

    Published 29 Jun 2023 · Fixed in 9.0.2 · NVD
  10. Critical 9.8

    CVE-2023-36475 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.

    Published 28 Jun 2023 · Fixed in 5.5.2, 6.2.1 · NVD
  11. Medium 6.5

    CVE-2023-2232 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.10 before 16.1, leading to a ReDoS vulnerability in the Jira prefix

    Published 28 Jun 2023 · Fixed in 16.1 · NVD
  12. Medium 5.3

    CVE-2022-4143 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.7 before 15.8.5, from 15.9 before 15.9.4, and from 15.10 before 15.10.1 that allows for crafted, unapproved MRs to be introduced and merged without authorization

    Published 28 Jun 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  13. High 7.5

    CVE-2023-20006 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to…

    Published 28 Jun 2023 · NVD
  14. Medium

    CVE-2023-2585 · Keycloak

    Client Spoofing within the Keycloak Device Authorisation Grant

    Published 28 Jun 2023 · Fixed in 21.1.2 · Project advisories (GitHub)
  15. Low

    CVE-2023-1664 · Keycloak

    Untrusted Certificate Validation

    Published 28 Jun 2023 · Fixed in 21.1.2 · Project advisories (GitHub)
  16. Low

    CVE-2022-4361 · Keycloak

    Cross-site scripting when validating URI-schemes on SAML and OIDC

    Published 28 Jun 2023 · Fixed in 21.1.2 · Project advisories (GitHub)
  17. High 7.1

    CVE-2023-2422 · Keycloak

    Improper Client Certificate Validation for OAuth/OpenID clients

    Published 28 Jun 2023 · Fixed in 21.1.2 · Project advisories (GitHub)
  18. Medium 5.3

    CVE-2023-34099 · Shopware

    Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.

    Published 27 Jun 2023 · NVD
  19. Medium 5.3

    CVE-2023-34098 · Shopware

    Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript could be read in production environments (`themes/package-lock.json`). With this information, the specific Shopware version in a deployment might be determined by an attacker, which could be used for further attacks. Users are advised to update to…

    Published 27 Jun 2023 · Fixed in 5.7.18 · NVD
  20. Medium 6.1

    CVE-2023-36675 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.

    Published 26 Jun 2023 · Fixed in 1.35.11, 1.38.7, 1.39.4 · NVD
  21. High 7.8

    CVE-2023-36664 · Ghostscript

    Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).

    Published 25 Jun 2023 · Fixed in 10.01.2 · NVD
  22. High 7.5

    CVE-2023-36632 · Python

    The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API…

    Published 25 Jun 2023 · NVD
  23. Medium 5.5

    CVE-2015-20109 · GNU C Library

    end_pattern (called from internal_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash), as demonstrated by use of the fnmatch library function with the **(!() pattern. NOTE: this is not the same as CVE-2015-8984; also, some Linux distributions have fixed CVE-2015-8984 but have not fixed this…

    Published 25 Jun 2023 · Fixed in 2.22 · NVD
  24. High 8.8

    CVE-2023-35928 · Nextcloud

    Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until…

    Published 23 Jun 2023 · Fixed in 24.0.12.2, 25.0.7, 26.0.2 · NVD
  25. High 8.1

    CVE-2023-35927 · Nextcloud

    NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, when two server are…

    Published 23 Jun 2023 · Fixed in 24.0.12.2, 25.0.7, 26.0.2 · NVD
  26. Critical 9.1

    CVE-2023-35172 · Nextcloud

    NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, an attacker can…

    Published 23 Jun 2023 · Fixed in 24.0.12.2, 25.0.7, 26.0.2 · NVD
  27. Medium 6.1

    CVE-2023-35171 · Nextcloud

    NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker's site. Nextcloud Server and Nextcloud Enterprise Server 26.0.2 contain a patch for this issue. No known…

    Published 23 Jun 2023 · Fixed in 26.0.2 · NVD
  28. Critical 9.8

    CVE-2023-3128 · Grafana

    Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

    Published 22 Jun 2023 · Fixed in 9.3.16, 9.4.13, 9.5.4 · NVD
  29. High 7.5

    CVE-2023-35133 · Moodle

    An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

    Published 22 Jun 2023 · Fixed in 3.11.15, 4.0.9, 4.1.4 · NVD
  30. Medium 6.3

    CVE-2023-35132 · Moodle

    A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

    Published 22 Jun 2023 · Fixed in 3.11.15, 4.0.9, 4.1.4 · NVD
  31. Medium 6.1

    CVE-2023-35131 · Moodle

    Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.

    Published 22 Jun 2023 · Fixed in 3.11.15, 4.0.9, 4.1.4 · NVD
  32. High 7.5

    CVE-2023-32320 · Nextcloud

    Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were executed even if the amount of faulty requests succeeded the limit by the time the response was sent to the client. This allowed someone to send as many requests the server could handle in parallel to bruteforce protected details instead of…

    Published 22 Jun 2023 · Fixed in 24.0.12.2, 25.0.7, 26.0.2 · NVD
  33. High 7.5

    CVE-2023-20896 · VMware vCenter Server

    The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds read by sending a specially crafted packet leading to denial-of-service of certain services (vmcad, vmdird, and vmafdd).

    Published 22 Jun 2023 · Fixed in 7.0 · NVD
  34. Critical 9.8

    CVE-2023-20895 · VMware vCenter Server

    The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication.

    Published 22 Jun 2023 · Fixed in 7.0 · NVD
  35. Critical 9.8

    CVE-2023-20894 · VMware vCenter Server

    The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to memory corruption.

    Published 22 Jun 2023 · Fixed in 7.0 · NVD
  36. Critical 9.8

    CVE-2023-20893 · VMware vCenter Server

    The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server.

    Published 22 Jun 2023 · Fixed in 7.0 · NVD
  37. Critical 9.8

    CVE-2023-20892 · VMware vCenter Server

    The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server.

    Published 22 Jun 2023 · Fixed in 7.0 · NVD
  38. High 7.5

    CVE-2023-2911 · BIND 9

    If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and…

    Published 21 Jun 2023 · NVD
  39. High 7.5

    CVE-2023-2829 · BIND 9

    A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a malformed NSEC record. This issue affects BIND 9 versions 9.16.8-S1 through 9.16.41-S1 and 9.18.11-S1 through 9.18.15-S1.

    Published 21 Jun 2023 · NVD
  40. High 7.5

    CVE-2023-2828 · BIND 9

    Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache…

    Published 21 Jun 2023 · NVD
  41. High 7.5

    CVE-2023-34981 · Apache Tomcat

    A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

    Published 21 Jun 2023 · NVD
  42. High 7.2

    CVE-2020-20491 · OpenCart

    SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via the Fba plugin function in upload/admin/index.php.

    Published 20 Jun 2023 · NVD
  43. Medium 6.1

    CVE-2023-33495 · Craft CMS

    Craft CMS through 4.4.9 is vulnerable to HTML Injection.

    Published 20 Jun 2023 · NVD
  44. Medium 5.4

    CVE-2023-35050 · Elementor Pro (WordPress plugin)

    Elementor Pro: Missing Authorization

    Published 20 Jun 2023 · Fixed in 3.13.1 · WPVulnerability
  45. Medium 6.1

    CVE-2023-30500 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 20 Jun 2023 · Fixed in 1.8.1.3 · NVD, WPVulnerability
  46. Medium 6.5

    CVE-2023-35005 · Apache Airflow

    In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are…

    Published 19 Jun 2023 · Fixed in 2.6.2 · NVD
  47. Critical 9.8

    CVE-2023-35813 · Sitecore Experience Platform

    Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.

    Published 17 Jun 2023 · NVD
  48. Medium 5.5

    CVE-2023-3195 · ImageMagick

    A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service.

    Published 16 Jun 2023 · Fixed in 6.9.12-26, 7.1.1-10 · NVD
  49. Medium 5.5

    CVE-2023-34475 · ImageMagick

    A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c. An attacker could trick user to open a specially crafted file to convert, triggering an heap-use-after-free write error, allowing an application to crash, resulting in a denial of service.

    Published 16 Jun 2023 · Fixed in 7.1.1-10 · NVD
  50. Medium 5.5

    CVE-2023-34474 · ImageMagick

    A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could trick the user in opening specially crafted file, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.

    Published 16 Jun 2023 · Fixed in 7.1.1-10 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.