UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,832
Published in 7 days
585
Critical in 30 days
384
Actively exploited
421

Latest vulnerabilities

38,832 vulnerabilities
  1. Medium 4.3

    CVE-2023-2013 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  2. Medium 4.3

    CVE-2023-2001 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  3. Medium 4.3

    CVE-2023-1825 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. It was possible to disclose issue notes to an unauthorized user at project export.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  4. Medium 4.3

    CVE-2023-0508 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in the NPM package API.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  5. High 7.5

    CVE-2023-0121 · GitLab

    A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  6. Medium 5.4

    CVE-2023-2442 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.

    Published 7 Jun 2023 · Fixed in 15.11.7, 16.0.2 · NVD
  7. Medium 5.5

    CVE-2023-2157 · ImageMagick

    A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.

    Published 6 Jun 2023 · Fixed in 7.1.1-9 · NVD
  8. Medium 6.5

    CVE-2023-1621 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to commit to projects even from a restricted IP address.

    Published 6 Jun 2023 · Fixed in 15.10.5, 15.11.1 · NVD
  9. High 8.8

    CVE-2023-33653 · Sitecore Experience Platform

    Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /Applications/Content%20Manager/Execute.aspx?cmd=convert&mode=HTML.

    Published 6 Jun 2023 · NVD
  10. High 8.8

    CVE-2023-33652 · Sitecore Experience Platform

    Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx.

    Published 6 Jun 2023 · NVD
  11. High 7.5

    CVE-2023-33651 · Sitecore Experience Platform

    An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.

    Published 6 Jun 2023 · NVD
  12. Medium 5.3

    CVE-2023-2801 · Grafana

    Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable…

    Published 6 Jun 2023 · Fixed in 9.4.12, 9.5.3 · NVD
  13. Medium 6.4

    CVE-2023-2183 · Grafana

    Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple…

    Published 6 Jun 2023 · Fixed in 9.3.15, 9.4.12, 9.5.3 · NVD
  14. High 7.5

    CVE-2023-2132 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A DollarMathPostFilter Regular Expression Denial of Service in was possible by sending crafted payloads to the preview_markdown endpoint.

    Published 6 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  15. Medium 4.3

    CVE-2023-0921 · GitLab

    A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.

    Published 6 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  16. Critical 9.8Actively exploited

    CVE-2023-34362 · MOVEit Transfer

    In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL),…

    Published 2 Jun 2023 · Fixed in 2022.0.5, 2022.1.6, 2023.0.2 · NVD
  17. High 7.5

    CVE-2023-33960 · OpenProject

    OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Prior to version 12.5.6, even if the entire instance is marked as `Login required` and prevents all truly…

    Published 1 Jun 2023 · Fixed in 12.5.6 · NVD
  18. Medium 4.3

    CVE-2023-32717 · Splunk Enterprise

    On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the {{/services/indexing/preview}} REST endpoint to overwrite search results if they know the search ID (SID) of an existing search job.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  19. Medium 6.5

    CVE-2023-32716 · Splunk Enterprise

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, an attacker can exploit a vulnerability in the {{dump}} SPL command to cause a denial of service by crashing the Splunk daemon.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  20. High 8.1

    CVE-2023-32714 · Splunk Enterprise

    In the Splunk App for Lookup File Editing versions below 4.0.1, a low-privileged user can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk installation directory.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  21. Low 3.1

    CVE-2023-32712 · Splunk Enterprise

    In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files that, when a vulnerable terminal application reads them, can potentially, at worst, result in possible code execution in the vulnerable application. This attack requires a user to use a terminal application that supports the…

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  22. Medium 5.4

    CVE-2023-32711 · Splunk Enterprise

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a Splunk dashboard view lets a low-privileged user exploit a vulnerability in the Bootstrap web framework (CVE-2019-8331) and build a stored cross-site scripting (XSS) payload.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  23. Medium 5.3

    CVE-2023-32710 · Splunk Enterprise

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can perform an unauthorized transfer of data from a search using the ‘copyresults’ command if they know the search ID (SID) of a search job that has recently run.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  24. Medium 4.3

    CVE-2023-32709 · Splunk Enterprise

    In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user’ role can see the hashed version of the initial user name and password for the Splunk instance by using the ‘rest’ SPL command against the ‘conf-user-seed’ REST endpoint.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  25. High 8.8

    CVE-2023-32708 · Splunk Enterprise

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the ‘rest’ SPL command that lets them potentially access other REST endpoints in the system arbitrarily.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  26. High 8.8

    CVE-2023-32707 · Splunk Enterprise

    In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  27. Medium 6.5

    CVE-2023-32706 · Splunk Enterprise

    On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an unauthenticated attacker can send specially-crafted messages to the XML parser within SAML authentication to cause a denial of service in the Splunk daemon.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  28. High 8.8

    CVE-2023-22648 · Rancher

    Azure AD permission changes are not reflected on active sessions

    Published 1 Jun 2023 · Fixed in 2.6.13, 2.7.4 · NVD, Project advisories (GitHub)
  29. High 8.0

    CVE-2023-22647 · Rancher

    Privilege Escalation via manipulation of Secrets

    Published 1 Jun 2023 · Fixed in 2.6.13, 2.7.4 · NVD, Project advisories (GitHub)
  30. High 8.4

    CVE-2022-43760 · Rancher

    Multiple Cross-Site Scripting (XSS) issues in Rancher UI

    Published 1 Jun 2023 · Fixed in 2.6.13, 2.7.4 · NVD, Project advisories (GitHub)
  31. High 8.8

    CVE-2020-10676 · Rancher

    Users retain access after moving namespaces into projects they don't have access to

    Published 1 Jun 2023 · Fixed in 2.6.13, 2.7.4 · NVD, Project advisories (GitHub)
  32. Medium 5.4

    CVE-2023-34229 · TeamCity

    In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  33. Medium 6.5

    CVE-2023-34228 · TeamCity

    In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  34. High 7.5

    CVE-2023-34227 · TeamCity

    In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  35. Medium 6.1

    CVE-2023-34226 · TeamCity

    In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  36. Medium 5.4

    CVE-2023-34225 · TeamCity

    In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  37. Medium 4.8

    CVE-2023-34224 · TeamCity

    In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  38. Medium 5.3

    CVE-2023-34223 · TeamCity

    In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some cases

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  39. Medium 6.1

    CVE-2023-34222 · TeamCity

    In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  40. Medium 5.4

    CVE-2023-34221 · TeamCity

    In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  41. Medium 5.4

    CVE-2023-34220 · TeamCity

    In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  42. Medium 4.3

    CVE-2023-34219 · TeamCity

    In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  43. Critical 9.8

    CVE-2023-34218 · TeamCity

    In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  44. High 7.8

    CVE-2023-34153 · ImageMagick

    A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.

    Published 30 May 2023 · Fixed in 7.1.1-11 · NVD
  45. Critical 9.8

    CVE-2023-34152 · ImageMagick

    A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured.

    Published 30 May 2023 · Fixed in 7.1.1-11 · NVD
  46. Medium 5.5

    CVE-2023-34151 · ImageMagick

    A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546).

    Published 30 May 2023 · Fixed in 7.1.1-11 · NVD
  47. Medium 6.5

    CVE-2023-32689 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. A malicious user could upload an HTML file to Parse Server via its public API. That HTML file would then be accessible at the internet domain at which Parse…

    Published 30 May 2023 · Fixed in 5.4.4, 6.1.1 · NVD
  48. High 7.5

    CVE-2023-23755 · Joomla!

    An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods.

    Published 30 May 2023 · Fixed in 4.3.2 · NVD
  49. Medium 6.1

    CVE-2023-23754 · Joomla!

    An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen.

    Published 30 May 2023 · Fixed in 4.3.2 · NVD
  50. Critical 9.8

    CVE-2023-33966 · Deno

    Missing "--allow-net" permission check for built-in Node modules

    Published 30 May 2023 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.