Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,002
- Published in 7 days
- 687
- Critical in 30 days
- 387
- Actively exploited
- 421
Latest vulnerabilities
39,002 vulnerabilities- High 8.8
CVE-2023-35928 · Nextcloud
Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until…
Published 23 Jun 2023 · Fixed in 24.0.12.2, 25.0.7, 26.0.2 · NVD - High 8.1
CVE-2023-35927 · Nextcloud
NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, when two server are…
Published 23 Jun 2023 · Fixed in 24.0.12.2, 25.0.7, 26.0.2 · NVD - Critical 9.1
CVE-2023-35172 · Nextcloud
NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, an attacker can…
Published 23 Jun 2023 · Fixed in 24.0.12.2, 25.0.7, 26.0.2 · NVD - Medium 6.1
CVE-2023-35171 · Nextcloud
NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker's site. Nextcloud Server and Nextcloud Enterprise Server 26.0.2 contain a patch for this issue. No known…
Published 23 Jun 2023 · Fixed in 26.0.2 · NVD - Critical 9.8
CVE-2023-3128 · Grafana
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
Published 22 Jun 2023 · Fixed in 9.3.16, 9.4.13, 9.5.4 · NVD - High 7.5
CVE-2023-35133 · Moodle
An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
Published 22 Jun 2023 · Fixed in 3.11.15, 4.0.9, 4.1.4 · NVD - Medium 6.3
CVE-2023-35132 · Moodle
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
Published 22 Jun 2023 · Fixed in 3.11.15, 4.0.9, 4.1.4 · NVD - Medium 6.1
CVE-2023-35131 · Moodle
Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.
Published 22 Jun 2023 · Fixed in 3.11.15, 4.0.9, 4.1.4 · NVD - High 7.5
CVE-2023-32320 · Nextcloud
Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were executed even if the amount of faulty requests succeeded the limit by the time the response was sent to the client. This allowed someone to send as many requests the server could handle in parallel to bruteforce protected details instead of…
Published 22 Jun 2023 · Fixed in 24.0.12.2, 25.0.7, 26.0.2 · NVD - High 7.5
CVE-2023-20896 · VMware vCenter Server
The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds read by sending a specially crafted packet leading to denial-of-service of certain services (vmcad, vmdird, and vmafdd).
Published 22 Jun 2023 · Fixed in 7.0 · NVD - Critical 9.8
CVE-2023-20895 · VMware vCenter Server
The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication.
Published 22 Jun 2023 · Fixed in 7.0 · NVD - Critical 9.8
CVE-2023-20894 · VMware vCenter Server
The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to memory corruption.
Published 22 Jun 2023 · Fixed in 7.0 · NVD - Critical 9.8
CVE-2023-20893 · VMware vCenter Server
The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server.
Published 22 Jun 2023 · Fixed in 7.0 · NVD - Critical 9.8
CVE-2023-20892 · VMware vCenter Server
The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server.
Published 22 Jun 2023 · Fixed in 7.0 · NVD - High 7.5
CVE-2023-2911 · BIND 9
If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and…
Published 21 Jun 2023 · NVD - High 7.5
CVE-2023-2829 · BIND 9
A `named` instance configured to run as a DNSSEC-validating recursive resolver with the Aggressive Use of DNSSEC-Validated Cache (RFC 8198) option (`synth-from-dnssec`) enabled can be remotely terminated using a zone with a malformed NSEC record. This issue affects BIND 9 versions 9.16.8-S1 through 9.16.41-S1 and 9.18.11-S1 through 9.18.15-S1.
Published 21 Jun 2023 · NVD - High 7.5
CVE-2023-2828 · BIND 9
Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache…
Published 21 Jun 2023 · NVD - High 7.5
CVE-2023-34981 · Apache Tomcat
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
Published 21 Jun 2023 · NVD - High 7.2
CVE-2020-20491 · OpenCart
SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via the Fba plugin function in upload/admin/index.php.
Published 20 Jun 2023 · NVD - Medium 6.1
CVE-2023-33495 · Craft CMS
Craft CMS through 4.4.9 is vulnerable to HTML Injection.
Published 20 Jun 2023 · NVD - Medium 5.4
CVE-2023-35050 · Elementor Pro (WordPress plugin)
Elementor Pro: Missing Authorization
Published 20 Jun 2023 · Fixed in 3.13.1 · WPVulnerability - Medium 6.1
CVE-2023-30500 · WPForms, WPForms Lite
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting
Published 20 Jun 2023 · Fixed in 1.8.1.3 · NVD, WPVulnerability - Medium 6.5
CVE-2023-35005 · Apache Airflow
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are…
Published 19 Jun 2023 · Fixed in 2.6.2 · NVD - Critical 9.8
CVE-2023-35813 · Sitecore Experience Platform
Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.
Published 17 Jun 2023 · NVD - Medium 5.5
CVE-2023-3195 · ImageMagick
A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service.
Published 16 Jun 2023 · Fixed in 6.9.12-26, 7.1.1-10 · NVD - Medium 5.5
CVE-2023-34475 · ImageMagick
A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c. An attacker could trick user to open a specially crafted file to convert, triggering an heap-use-after-free write error, allowing an application to crash, resulting in a denial of service.
Published 16 Jun 2023 · Fixed in 7.1.1-10 · NVD - Medium 5.5
CVE-2023-34474 · ImageMagick
A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could trick the user in opening specially crafted file, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.
Published 16 Jun 2023 · Fixed in 7.1.1-10 · NVD - Medium 6.5
CVE-2023-33307 · Fortinet FortiProxy, Fortinet FortiOS
A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter.
Published 16 Jun 2023 · Fixed in 7.0.11, 7.2.5 · NVD - Medium 6.5
CVE-2023-33306 · Fortinet FortiProxy, Fortinet FortiOS
A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allows attacker to denial of sslvpn service via specifically crafted request in bookmark parameter.
Published 16 Jun 2023 · Fixed in 7.0.11, 7.2.4, 7.2.5 · NVD - Medium 6.5
CVE-2023-2831 · Mattermost
Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message containing a large number of escaped characters.
Published 16 Jun 2023 · NVD - Medium 6.5
CVE-2023-2797 · Mattermost
Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a channel.
Published 16 Jun 2023 · NVD - Medium 6.5
CVE-2023-2793 · Mattermost
Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-service by a linking to a specially crafted webpage in a message.
Published 16 Jun 2023 · NVD - Medium 6.5
CVE-2023-2792 · Mattermost
Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a specially crafted /groupmsg command.
Published 16 Jun 2023 · NVD - Medium 4.3
CVE-2023-2785 · Mattermost
Mattermost fails to properly truncate the postgres error log message of a search query failure allowing an attacker to cause the creation of large log files which can result in Denial of Service
Published 16 Jun 2023 · NVD - Medium 4.3
CVE-2023-2791 · Mattermost
When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel post.
Published 16 Jun 2023 · NVD - Medium 6.5
CVE-2023-2788 · Mattermost
Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated.
Published 16 Jun 2023 · NVD - Medium 6.5
CVE-2023-2787 · Mattermost
Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API.
Published 16 Jun 2023 · NVD - Medium 4.3
CVE-2023-2786 · Mattermost
Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually post it by executing channel commands.
Published 16 Jun 2023 · NVD - Medium 6.5
CVE-2023-2784 · Mattermost
Mattermost fails to verify if the requestor is a sysadmin or not, before allowing `install` requests to the Apps allowing a regular user send install requests to the Apps.
Published 16 Jun 2023 · NVD - Medium 4.3
CVE-2023-2783 · Mattermost
Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps.
Published 16 Jun 2023 · NVD - Medium 5.5
CVE-2023-2431 · Kubernetes
A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.
Published 16 Jun 2023 · Fixed in 1.25.10, 1.26.5, 1.27.2 · NVD - Critical 9.8
CVE-2023-35708 · MOVEit Transfer
In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer…
Published 16 Jun 2023 · Fixed in 2022.0.6, 2022.1.7, 2023.0.3 · NVD - High 7.5
CVE-2023-23841 · SolarWinds Serv-U
SolarWinds Serv-U is submitting an HTTP request when changing or updating the attributes for File Share or File request. Part of the URL of the request discloses sensitive data.
Published 15 Jun 2023 · Fixed in 15.4 · NVD - High 7.8
CVE-2023-24032 · Zimbra Collaboration
In Zimbra Collaboration Suite through 9.0 and 8.8.15, an attacker (who has initial user access to a Zimbra server instance) can execute commands as root by passing one of JVM arguments, leading to local privilege escalation (LPE).
Published 15 Jun 2023 · NVD - Medium 6.1
CVE-2023-24031 · Zimbra Collaboration
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15. XSS can occur, via one of attributes of the webmail /h/ endpoint, to execute arbitrary JavaScript code, leading to information disclosure.
Published 15 Jun 2023 · NVD - Medium 6.1
CVE-2023-24030 · Zimbra Collaboration
An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0 and 8.8.15. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any URL if url sanitisation is bypassed in incoming requests. NOTE: this is similar, but not…
Published 15 Jun 2023 · NVD - Medium 5.4
CVE-2023-29322 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Jun 2023 · Fixed in 6.5.17.0 · NVD - Medium 5.4
CVE-2023-29307 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
Published 15 Jun 2023 · Fixed in 6.5.17.0 · NVD - Medium 5.4
CVE-2023-29304 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Jun 2023 · Fixed in 6.5.17.0 · NVD - Medium 5.4
CVE-2023-29302 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 15 Jun 2023 · Fixed in 6.5.17.0 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.