UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,825
Published in 7 days
578
Critical in 30 days
384
Actively exploited
421

Latest vulnerabilities

38,825 vulnerabilities
  1. Medium 6.5

    CVE-2023-33307 · Fortinet FortiProxy, Fortinet FortiOS

    A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter.

    Published 16 Jun 2023 · Fixed in 7.0.11, 7.2.5 · NVD
  2. Medium 6.5

    CVE-2023-33306 · Fortinet FortiProxy, Fortinet FortiOS

    A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allows attacker to denial of sslvpn service via specifically crafted request in bookmark parameter.

    Published 16 Jun 2023 · Fixed in 7.0.11, 7.2.4, 7.2.5 · NVD
  3. Medium 6.5

    CVE-2023-2831 · Mattermost

    Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message containing a large number of escaped characters.

    Published 16 Jun 2023 · NVD
  4. Medium 6.5

    CVE-2023-2797 · Mattermost

    Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a channel.

    Published 16 Jun 2023 · NVD
  5. Medium 6.5

    CVE-2023-2793 · Mattermost

    Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by a linking to a specially crafted webpage in a message.

    Published 16 Jun 2023 · NVD
  6. Medium 6.5

    CVE-2023-2792 · Mattermost

    Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a specially crafted /groupmsg command.

    Published 16 Jun 2023 · NVD
  7. Medium 4.3

    CVE-2023-2785 · Mattermost

    Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files which can result in Denial of Service

    Published 16 Jun 2023 · NVD
  8. Medium 4.3

    CVE-2023-2791 · Mattermost

    When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel post.

    Published 16 Jun 2023 · NVD
  9. Medium 6.5

    CVE-2023-2788 · Mattermost

    Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated.

    Published 16 Jun 2023 · NVD
  10. Medium 6.5

    CVE-2023-2787 · Mattermost

    Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API.

    Published 16 Jun 2023 · NVD
  11. Medium 4.3

    CVE-2023-2786 · Mattermost

    Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually post it by executing channel commands.

    Published 16 Jun 2023 · NVD
  12. Medium 6.5

    CVE-2023-2784 · Mattermost

    Mattermost fails to verify if the requestor is a sysadmin or not, before allowing `install` requests to the Apps allowing a regular user send install requests to the Apps.

    Published 16 Jun 2023 · NVD
  13. Medium 4.3

    CVE-2023-2783 · Mattermost

    Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps.

    Published 16 Jun 2023 · NVD
  14. Medium 5.5

    CVE-2023-2431 · Kubernetes

    A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.

    Published 16 Jun 2023 · Fixed in 1.25.10, 1.26.5, 1.27.2 · NVD
  15. Critical 9.8

    CVE-2023-35708 · MOVEit Transfer

    In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer…

    Published 16 Jun 2023 · Fixed in 2022.0.6, 2022.1.7, 2023.0.3 · NVD
  16. High 7.5

    CVE-2023-23841 · SolarWinds Serv-U

    SolarWinds Serv-U is submitting an HTTP request when changing or updating the attributes for File Share or File request.  Part of the URL of the request discloses sensitive data.

    Published 15 Jun 2023 · Fixed in 15.4 · NVD
  17. High 7.8

    CVE-2023-24032 · Zimbra Collaboration

    In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by passing one of JVM arguments, leading to local privilege escalation (LPE).

    Published 15 Jun 2023 · NVD
  18. Medium 6.1

    CVE-2023-24031 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15. XSS can occur, via one of attributes of the webmail /h/ endpoint, to execute arbitrary JavaScript code, leading to information disclosure.

    Published 15 Jun 2023 · NVD
  19. Medium 6.1

    CVE-2023-24030 · Zimbra Collaboration

    An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 and 8.8.15. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any URL if url sanitisation is bypassed in incoming requests. NOTE: this is similar, but not…

    Published 15 Jun 2023 · NVD
  20. Medium 5.4

    CVE-2023-29322 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 15 Jun 2023 · Fixed in 6.5.17.0 · NVD
  21. Medium 5.4

    CVE-2023-29307 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

    Published 15 Jun 2023 · Fixed in 6.5.17.0 · NVD
  22. Medium 5.4

    CVE-2023-29304 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 15 Jun 2023 · Fixed in 6.5.17.0 · NVD
  23. Medium 5.4

    CVE-2023-29302 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 15 Jun 2023 · Fixed in 6.5.17.0 · NVD
  24. High 7.2

    CVE-2023-29297 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  25. Medium 4.3

    CVE-2023-29296 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to modify a minor functionality of another user's data. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  26. Medium 4.3

    CVE-2023-29295 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  27. Medium 4.3

    CVE-2023-29294 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  28. Low 2.7

    CVE-2023-29293 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An admin privileged attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  29. Medium 4.9

    CVE-2023-29292 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  30. Medium 4.9

    CVE-2023-29291 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  31. Medium 5.3

    CVE-2023-29290 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  32. Medium 6.5

    CVE-2023-29289 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an XML Injection vulnerability. An attacker with low privileges can trigger a specially crafted script to a security feature bypass. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  33. Medium 4.3

    CVE-2023-29288 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A privileged attacker could leverage this vulnerability to modify a minor functionality of another user's data. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  34. Medium 5.3

    CVE-2023-29287 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Information Exposure vulnerability that could lead to a security feature bypass. An attacker could leverage this vulnerability to leak minor user data. Exploitation of this issue does not require user interaction..

    Published 15 Jun 2023 · NVD
  35. High 7.5

    CVE-2023-22248 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to leak another user's data. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  36. High 8.8

    CVE-2023-35030 · Liferay Portal / DXP

    Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

    Published 15 Jun 2023 · Fixed in 7.4.3.77 · NVD
  37. Medium 6.1

    CVE-2023-3193 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

    Published 15 Jun 2023 · Fixed in 7.4.3.74 · NVD
  38. Medium 6.1

    CVE-2023-35029 · Liferay Portal / DXP

    Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

    Published 15 Jun 2023 · Fixed in 7.4.3.77 · NVD
  39. Medium 6.1

    CVE-2023-34452 · Grav

    Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" page has a self-reflected cross-site scripting vulnerability that can be exploited by injecting a script into the "email" parameter of the request. While this vulnerability can potentially allow an attacker to execute arbitrary code on the user's browser, the impact is limited as it requires user…

    Published 14 Jun 2023 · NVD
  40. High 7.2

    CVE-2023-34448 · Grav

    Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code execution. A patch in version 1.74.2…

    Published 14 Jun 2023 · Fixed in 1.7.42 · NVD
  41. High 7.2

    CVE-2023-34253 · Grav

    Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for…

    Published 14 Jun 2023 · Fixed in 1.7.42 · NVD
  42. High 7.2

    CVE-2023-34252 · Grav

    Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a callable argument allows the validation check to be skipped. Consequently, a low privileged attacker…

    Published 14 Jun 2023 · Fixed in 1.7.42 · NVD
  43. High 7.2

    CVE-2023-34251 · Grav

    Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue.

    Published 14 Jun 2023 · Fixed in 1.7.42 · NVD
  44. Medium 5.4

    CVE-2023-0010 · Palo Alto Networks PAN-OS

    A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.

    Published 14 Jun 2023 · NVD
  45. High 8.8

    CVE-2023-32031 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 14 Jun 2023 · NVD
  46. High 7.5

    CVE-2023-29331 · .NET

    .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

    Published 14 Jun 2023 · NVD
  47. High 8.0

    CVE-2023-28310 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 14 Jun 2023 · NVD
  48. High 7.5

    CVE-2023-24936 · .NET

    .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

    Published 14 Jun 2023 · NVD
  49. High 7.8

    CVE-2023-24897 · .NET

    .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

    Published 14 Jun 2023 · NVD
  50. High 7.8

    CVE-2023-24895 · .NET

    .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

    Published 14 Jun 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.