UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,002
Published in 7 days
687
Critical in 30 days
387
Actively exploited
421

Latest vulnerabilities

39,002 vulnerabilities
  1. High 7.2

    CVE-2023-29297 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  2. Medium 4.3

    CVE-2023-29296 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to modify a minor functionality of another user's data. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  3. Medium 4.3

    CVE-2023-29295 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  4. Medium 4.3

    CVE-2023-29294 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  5. Low 2.7

    CVE-2023-29293 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An admin privileged attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  6. Medium 4.9

    CVE-2023-29292 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  7. Medium 4.9

    CVE-2023-29291 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  8. Medium 5.3

    CVE-2023-29290 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  9. Medium 6.5

    CVE-2023-29289 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an XML Injection vulnerability. An attacker with low privileges can trigger a specially crafted script to a security feature bypass. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  10. Medium 4.3

    CVE-2023-29288 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A privileged attacker could leverage this vulnerability to modify a minor functionality of another user's data. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  11. Medium 5.3

    CVE-2023-29287 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Information Exposure vulnerability that could lead to a security feature bypass. An attacker could leverage this vulnerability to leak minor user data. Exploitation of this issue does not require user interaction..

    Published 15 Jun 2023 · NVD
  12. High 7.5

    CVE-2023-22248 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to leak another user's data. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  13. High 8.8

    CVE-2023-35030 · Liferay Portal / DXP

    Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

    Published 15 Jun 2023 · Fixed in 7.4.3.77 · NVD
  14. Medium 6.1

    CVE-2023-3193 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

    Published 15 Jun 2023 · Fixed in 7.4.3.74 · NVD
  15. Medium 6.1

    CVE-2023-35029 · Liferay Portal / DXP

    Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

    Published 15 Jun 2023 · Fixed in 7.4.3.77 · NVD
  16. Medium 6.1

    CVE-2023-34452 · Grav

    Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" page has a self-reflected cross-site scripting vulnerability that can be exploited by injecting a script into the "email" parameter of the request. While this vulnerability can potentially allow an attacker to execute arbitrary code on the user's browser, the impact is limited as it requires user…

    Published 14 Jun 2023 · NVD
  17. High 7.2

    CVE-2023-34448 · Grav

    Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code execution. A patch in version 1.74.2…

    Published 14 Jun 2023 · Fixed in 1.7.42 · NVD
  18. High 7.2

    CVE-2023-34253 · Grav

    Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for…

    Published 14 Jun 2023 · Fixed in 1.7.42 · NVD
  19. High 7.2

    CVE-2023-34252 · Grav

    Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a callable argument allows the validation check to be skipped. Consequently, a low privileged attacker…

    Published 14 Jun 2023 · Fixed in 1.7.42 · NVD
  20. High 7.2

    CVE-2023-34251 · Grav

    Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue.

    Published 14 Jun 2023 · Fixed in 1.7.42 · NVD
  21. Medium 5.4

    CVE-2023-0010 · Palo Alto Networks PAN-OS

    A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.

    Published 14 Jun 2023 · NVD
  22. High 8.8

    CVE-2023-32031 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 14 Jun 2023 · NVD
  23. High 7.5

    CVE-2023-29331 · .NET

    .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

    Published 14 Jun 2023 · NVD
  24. High 8.0

    CVE-2023-28310 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 14 Jun 2023 · NVD
  25. High 7.5

    CVE-2023-24936 · .NET

    .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

    Published 14 Jun 2023 · NVD
  26. High 7.8

    CVE-2023-24897 · .NET

    .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

    Published 14 Jun 2023 · NVD
  27. High 7.8

    CVE-2023-24895 · .NET

    .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

    Published 14 Jun 2023 · NVD
  28. High 8.0

    CVE-2023-35141 · Jenkins

    In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.

    Published 14 Jun 2023 · Fixed in 2.400, 2.401.1 · NVD
  29. High 7.5

    CVE-2023-34396 · Apache Struts

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater

    Published 14 Jun 2023 · Fixed in 2.5.31, 6.1.2.1 · NVD
  30. Medium 6.5

    CVE-2023-34149 · Apache Struts

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.

    Published 14 Jun 2023 · Fixed in 2.5.31, 6.1.2.1 · NVD
  31. High 7.5

    CVE-2023-33933 · Apache Traffic Server

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions

    Published 14 Jun 2023 · Fixed in 8.1.7, 9.2.1 · NVD
  32. High 7.5

    CVE-2023-30631 · Apache Traffic Server

    Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.  The configuration option proxy.config.http.push_method_enabled didn't function.  However, by default the PUSH method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should…

    Published 14 Jun 2023 · Fixed in 8.1.7, 9.2.1 · NVD
  33. High 7.5

    CVE-2022-47184 · Apache Traffic Server

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0.

    Published 14 Jun 2023 · Fixed in 8.1.7, 9.2.1 · NVD
  34. High 7.3

    CVE-2023-33135 · .NET

    .NET and Visual Studio Elevation of Privilege Vulnerability

    Published 14 Jun 2023 · Fixed in 6.0.18, 7.0.7 · NVD
  35. High 7.3

    CVE-2023-33128 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 14 Jun 2023 · Fixed in 6.0.18, 7.0.7 · NVD
  36. High 7.3

    CVE-2023-33126 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 14 Jun 2023 · Fixed in 6.0.18, 7.0.7 · NVD
  37. Medium 6.5

    CVE-2023-32032 · .NET

    .NET and Visual Studio Elevation of Privilege Vulnerability

    Published 14 Jun 2023 · Fixed in 7.0.7 · NVD
  38. Medium 5.3

    CVE-2023-34250 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, an attacker could use the new topics dismissal endpoint to reveal the number of topics recently created (but not the actual content thereof) in categories they didn't have access to. This issue is patched in version 3.0.4 of the…

    Published 13 Jun 2023 · Fixed in 3.0.4 · NVD
  39. Medium 5.3

    CVE-2023-32301 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, multiple duplicate topics could be created if topic embedding is enabled. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. As a workaround, disable topic…

    Published 13 Jun 2023 · Fixed in 3.0.4 · NVD
  40. Medium 5.3

    CVE-2023-32061 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, the lack of restrictions on the iFrame tag makes it easy for an attacker to exploit the vulnerability and hide subsequent comments from other users. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5…

    Published 13 Jun 2023 · Fixed in 3.0.4 · NVD
  41. Medium 5.3

    CVE-2023-31142 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, if a site has modified their general category permissions, they could be set back to the default. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. A…

    Published 13 Jun 2023 · Fixed in 3.0.4 · NVD
  42. Critical 9.8

    CVE-2023-34944 · Chamilo LMS

    An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file.

    Published 13 Jun 2023 · NVD
  43. High 7.2

    CVE-2023-30179 · Craft CMS

    CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrators can add this Twig code, and (by design) Administrators are allowed to do that by default.

    Published 13 Jun 2023 · NVD
  44. High 7.5

    CVE-2023-33568 · Dolibarr ERP CRM

    An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.

    Published 13 Jun 2023 · Fixed in 16.0.5 · NVD
  45. Medium 6.5

    CVE-2023-33305 · Fortinet FortiProxy, Fortinet FortiWeb, Fortinet FortiOS

    A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions,…

    Published 13 Jun 2023 · NVD
  46. Medium 4.3

    CVE-2023-29178 · Fortinet FortiProxy, Fortinet FortiOS

    A access of uninitialized pointer vulnerability [CWE-824] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy 7.2.0 through 7.2.3, FortiProxy 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all…

    Published 13 Jun 2023 · NVD
  47. Medium 4.8

    CVE-2023-29175 · Fortinet FortiProxy, Fortinet FortiOS

    An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all versions, 2.0 all versions, 7.0.0 through 7.0.9, 7.2.0 through 7.2.3 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the vulnerable device and the remote FortiGuard's…

    Published 13 Jun 2023 · Fixed in 7.0.11 · NVD
  48. Critical 9.8Actively exploited

    CVE-2023-27997 · Fortinet FortiProxy, Fortinet FortiOS

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically…

    Published 13 Jun 2023 · NVD
  49. Medium 6.5

    CVE-2023-26207 · Fortinet FortiProxy, Fortinet FortiOS

    An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProxy 7.0.0 through 7.0.10. 7.2.0 through 7.2.1 allows an attacker to read certain passwords in plain text.

    Published 13 Jun 2023 · NVD
  50. High 7.8

    CVE-2023-22639 · Fortinet FortiProxy, Fortinet FortiOS

    A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0…

    Published 13 Jun 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.