UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,825
Published in 7 days
578
Critical in 30 days
384
Actively exploited
421

Latest vulnerabilities

38,825 vulnerabilities
  1. High 8.0

    CVE-2023-35141 · Jenkins

    In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.

    Published 14 Jun 2023 · Fixed in 2.400, 2.401.1 · NVD
  2. High 7.5

    CVE-2023-34396 · Apache Struts

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater

    Published 14 Jun 2023 · Fixed in 2.5.31, 6.1.2.1 · NVD
  3. Medium 6.5

    CVE-2023-34149 · Apache Struts

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.

    Published 14 Jun 2023 · Fixed in 2.5.31, 6.1.2.1 · NVD
  4. High 7.5

    CVE-2023-33933 · Apache Traffic Server

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions

    Published 14 Jun 2023 · Fixed in 8.1.7, 9.2.1 · NVD
  5. High 7.5

    CVE-2023-30631 · Apache Traffic Server

    Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.  The configuration option proxy.config.http.push_method_enabled didn't function.  However, by default the PUSH method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should…

    Published 14 Jun 2023 · Fixed in 8.1.7, 9.2.1 · NVD
  6. High 7.5

    CVE-2022-47184 · Apache Traffic Server

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0.

    Published 14 Jun 2023 · Fixed in 8.1.7, 9.2.1 · NVD
  7. High 7.3

    CVE-2023-33135 · .NET

    .NET and Visual Studio Elevation of Privilege Vulnerability

    Published 14 Jun 2023 · Fixed in 6.0.18, 7.0.7 · NVD
  8. High 7.3

    CVE-2023-33128 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 14 Jun 2023 · Fixed in 6.0.18, 7.0.7 · NVD
  9. High 7.3

    CVE-2023-33126 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 14 Jun 2023 · Fixed in 6.0.18, 7.0.7 · NVD
  10. Medium 6.5

    CVE-2023-32032 · .NET

    .NET and Visual Studio Elevation of Privilege Vulnerability

    Published 14 Jun 2023 · Fixed in 7.0.7 · NVD
  11. Medium 5.3

    CVE-2023-34250 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, an attacker could use the new topics dismissal endpoint to reveal the number of topics recently created (but not the actual content thereof) in categories they didn't have access to. This issue is patched in version 3.0.4 of the…

    Published 13 Jun 2023 · Fixed in 3.0.4 · NVD
  12. Medium 5.3

    CVE-2023-32301 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, multiple duplicate topics could be created if topic embedding is enabled. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. As a workaround, disable topic…

    Published 13 Jun 2023 · Fixed in 3.0.4 · NVD
  13. Medium 5.3

    CVE-2023-32061 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, the lack of restrictions on the iFrame tag makes it easy for an attacker to exploit the vulnerability and hide subsequent comments from other users. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5…

    Published 13 Jun 2023 · Fixed in 3.0.4 · NVD
  14. Medium 5.3

    CVE-2023-31142 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, if a site has modified their general category permissions, they could be set back to the default. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. A…

    Published 13 Jun 2023 · Fixed in 3.0.4 · NVD
  15. Critical 9.8

    CVE-2023-34944 · Chamilo LMS

    An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file.

    Published 13 Jun 2023 · NVD
  16. High 7.2

    CVE-2023-30179 · Craft CMS

    CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrators can add this Twig code, and (by design) Administrators are allowed to do that by default.

    Published 13 Jun 2023 · NVD
  17. High 7.5

    CVE-2023-33568 · Dolibarr ERP CRM

    An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.

    Published 13 Jun 2023 · Fixed in 16.0.5 · NVD
  18. Medium 6.5

    CVE-2023-33305 · Fortinet FortiProxy, Fortinet FortiWeb, Fortinet FortiOS

    A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions,…

    Published 13 Jun 2023 · NVD
  19. Medium 4.3

    CVE-2023-29178 · Fortinet FortiProxy, Fortinet FortiOS

    A access of uninitialized pointer vulnerability [CWE-824] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy 7.2.0 through 7.2.3, FortiProxy 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all…

    Published 13 Jun 2023 · NVD
  20. Medium 4.8

    CVE-2023-29175 · Fortinet FortiProxy, Fortinet FortiOS

    An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all versions, 2.0 all versions, 7.0.0 through 7.0.9, 7.2.0 through 7.2.3 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the vulnerable device and the remote FortiGuard's…

    Published 13 Jun 2023 · Fixed in 7.0.11 · NVD
  21. Critical 9.8Actively exploited

    CVE-2023-27997 · Fortinet FortiProxy, Fortinet FortiOS

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically…

    Published 13 Jun 2023 · NVD
  22. Medium 6.5

    CVE-2023-26207 · Fortinet FortiProxy, Fortinet FortiOS

    An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProxy 7.0.0 through 7.0.10. 7.2.0 through 7.2.1 allows an attacker to read certain passwords in plain text.

    Published 13 Jun 2023 · NVD
  23. High 7.8

    CVE-2023-22639 · Fortinet FortiProxy, Fortinet FortiOS

    A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0…

    Published 13 Jun 2023 · NVD
  24. High 7.8

    CVE-2022-43953 · Fortinet FortiProxy, Fortinet FortiOS

    A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions 6.4, FortiOS all versions 6.2, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7 allows attacker to execute unauthorized code or commands via specially crafted commands.

    Published 13 Jun 2023 · NVD
  25. Low 2.7

    CVE-2022-42474 · Fortinet FortiProxy, Fortinet FortiOS

    A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.12, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiSwitchManager version 7.2.0 through 7.2.1 and before 7.0.1 allows an privileged attacker to delete arbitrary directories from the filesystem through crafted HTTP requests.

    Published 13 Jun 2023 · NVD
  26. Medium 4.4

    CVE-2022-41327 · Fortinet FortiProxy, Fortinet FortiOS

    A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8 allows an authenticated attacker with readonly superadmin privileges to intercept traffic in order to obtain other adminstrators cookies via diagnose CLI commands.

    Published 13 Jun 2023 · NVD
  27. Critical 9.1

    CVE-2023-35036 · MOVEit Transfer

    In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application…

    Published 12 Jun 2023 · Fixed in 2022.0.5, 2022.1.6, 2023.0.2 · NVD
  28. Medium 5.4

    CVE-2023-3192 · Froxlor

    Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.

    Published 11 Jun 2023 · Fixed in 2.1.0 · NVD
  29. Medium 5.4

    CVE-2023-2455 · PostgreSQL

    Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across…

    Published 9 Jun 2023 · Fixed in 13.11, 14.8, 15.3 · NVD
  30. High 7.2

    CVE-2023-2454 · PostgreSQL

    schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.

    Published 9 Jun 2023 · Fixed in 13.11, 14.8, 15.3 · NVD
  31. Medium 5.4

    CVE-2023-2121 · HashiCorp Vault

    Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.

    Published 9 Jun 2023 · Fixed in 1.11.11, 1.12.7, 1.13.3 · NVD
  32. Critical 9.8

    CVE-2023-3173 · Froxlor

    Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.

    Published 9 Jun 2023 · Fixed in 2.0.20 · NVD
  33. High 7.2

    CVE-2023-3172 · Froxlor

    Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.

    Published 9 Jun 2023 · Fixed in 2.0.20 · NVD
  34. High 8.1

    CVE-2023-34962 · Chamilo LMS

    Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student's personal notes.

    Published 8 Jun 2023 · NVD
  35. Medium 6.1

    CVE-2023-34961 · Chamilo LMS

    Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field.

    Published 8 Jun 2023 · NVD
  36. Medium 5.3

    CVE-2023-34959 · Chamilo LMS

    An issue in Chamilo v1.11.* up to v1.11.18 allows attackers to execute a Server-Side Request Forgery (SSRF) and obtain information on the services running on the server via crafted requests in the social and links tools.

    Published 8 Jun 2023 · NVD
  37. Medium 4.3

    CVE-2023-34958 · Chamilo LMS

    Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if they know the document's ID.

    Published 8 Jun 2023 · NVD
  38. Medium 5.5

    CVE-2023-33595 · Python

    CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.

    Published 7 Jun 2023 · NVD
  39. Medium 5.3

    CVE-2023-2589 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker can clone a repository from a public project, from a disallowed IP, even after the top-level group has enabled IP restrictions on the group.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  40. Medium 4.9

    CVE-2023-2485 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  41. High 7.5

    CVE-2023-2199 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  42. High 7.5

    CVE-2023-2198 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  43. Medium 6.1

    CVE-2023-2015 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A reflected XSS was possible when creating new abuse reports which allows attackers to perform arbitrary actions on behalf of victims.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  44. Medium 4.3

    CVE-2023-2013 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  45. Medium 4.3

    CVE-2023-2001 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  46. Medium 4.3

    CVE-2023-1825 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. It was possible to disclose issue notes to an unauthorized user at project export.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  47. Medium 4.3

    CVE-2023-0508 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in the NPM package API.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  48. High 7.5

    CVE-2023-0121 · GitLab

    A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  49. Medium 5.4

    CVE-2023-2442 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.

    Published 7 Jun 2023 · Fixed in 15.11.7, 16.0.2 · NVD
  50. Medium 5.5

    CVE-2023-2157 · ImageMagick

    A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.

    Published 6 Jun 2023 · Fixed in 7.1.1-9 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.