UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,008
Published in 7 days
621
Critical in 30 days
378
Actively exploited
421

Latest vulnerabilities

39,008 vulnerabilities
  1. Medium 6.5

    CVE-2023-33305 · Fortinet FortiProxy, Fortinet FortiWeb, Fortinet FortiOS

    A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions,…

    Published 13 Jun 2023 · NVD
  2. Medium 4.3

    CVE-2023-29178 · Fortinet FortiProxy, Fortinet FortiOS

    A access of uninitialized pointer vulnerability [CWE-824] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy 7.2.0 through 7.2.3, FortiProxy 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all…

    Published 13 Jun 2023 · NVD
  3. Medium 4.8

    CVE-2023-29175 · Fortinet FortiProxy, Fortinet FortiOS

    An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all versions, 2.0 all versions, 7.0.0 through 7.0.9, 7.2.0 through 7.2.3 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the vulnerable device and the remote FortiGuard's…

    Published 13 Jun 2023 · Fixed in 7.0.11 · NVD
  4. Critical 9.8Actively exploited

    CVE-2023-27997 · Fortinet FortiProxy, Fortinet FortiOS

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically…

    Published 13 Jun 2023 · NVD
  5. Medium 6.5

    CVE-2023-26207 · Fortinet FortiProxy, Fortinet FortiOS

    An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProxy 7.0.0 through 7.0.10. 7.2.0 through 7.2.1 allows an attacker to read certain passwords in plain text.

    Published 13 Jun 2023 · NVD
  6. High 7.8

    CVE-2023-22639 · Fortinet FortiProxy, Fortinet FortiOS

    A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0…

    Published 13 Jun 2023 · NVD
  7. High 7.8

    CVE-2022-43953 · Fortinet FortiProxy, Fortinet FortiOS

    A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions 6.4, FortiOS all versions 6.2, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7 allows attacker to execute unauthorized code or commands via specially crafted commands.

    Published 13 Jun 2023 · NVD
  8. Low 2.7

    CVE-2022-42474 · Fortinet FortiProxy, Fortinet FortiOS

    A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.12, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiSwitchManager version 7.2.0 through 7.2.1 and before 7.0.1 allows an privileged attacker to delete arbitrary directories from the filesystem through crafted HTTP requests.

    Published 13 Jun 2023 · NVD
  9. Medium 4.4

    CVE-2022-41327 · Fortinet FortiProxy, Fortinet FortiOS

    A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8 allows an authenticated attacker with readonly superadmin privileges to intercept traffic in order to obtain other adminstrators cookies via diagnose CLI commands.

    Published 13 Jun 2023 · NVD
  10. Critical 9.1

    CVE-2023-35036 · MOVEit Transfer

    In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application…

    Published 12 Jun 2023 · Fixed in 2022.0.5, 2022.1.6, 2023.0.2 · NVD
  11. Medium 5.4

    CVE-2023-3192 · Froxlor

    Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.

    Published 11 Jun 2023 · Fixed in 2.1.0 · NVD
  12. Medium 5.4

    CVE-2023-2455 · PostgreSQL

    Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across…

    Published 9 Jun 2023 · Fixed in 13.11, 14.8, 15.3 · NVD
  13. High 7.2

    CVE-2023-2454 · PostgreSQL

    schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.

    Published 9 Jun 2023 · Fixed in 13.11, 14.8, 15.3 · NVD
  14. Medium 5.4

    CVE-2023-2121 · HashiCorp Vault

    Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.

    Published 9 Jun 2023 · Fixed in 1.11.11, 1.12.7, 1.13.3 · NVD
  15. Critical 9.8

    CVE-2023-3173 · Froxlor

    Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.

    Published 9 Jun 2023 · Fixed in 2.0.20 · NVD
  16. High 7.2

    CVE-2023-3172 · Froxlor

    Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.

    Published 9 Jun 2023 · Fixed in 2.0.20 · NVD
  17. High 8.1

    CVE-2023-34962 · Chamilo LMS

    Incorrect access control in Chamilo v1.11.x up to v1.11.18 allows a student to arbitrarily access and modify another student's personal notes.

    Published 8 Jun 2023 · NVD
  18. Medium 6.1

    CVE-2023-34961 · Chamilo LMS

    Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field.

    Published 8 Jun 2023 · NVD
  19. Medium 5.3

    CVE-2023-34959 · Chamilo LMS

    An issue in Chamilo v1.11.* up to v1.11.18 allows attackers to execute a Server-Side Request Forgery (SSRF) and obtain information on the services running on the server via crafted requests in the social and links tools.

    Published 8 Jun 2023 · NVD
  20. Medium 4.3

    CVE-2023-34958 · Chamilo LMS

    Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if they know the document's ID.

    Published 8 Jun 2023 · NVD
  21. Medium 5.5

    CVE-2023-33595 · Python

    CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.

    Published 7 Jun 2023 · NVD
  22. Medium 5.3

    CVE-2023-2589 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker can clone a repository from a public project, from a disallowed IP, even after the top-level group has enabled IP restrictions on the group.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  23. Medium 4.9

    CVE-2023-2485 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  24. High 7.5

    CVE-2023-2199 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  25. High 7.5

    CVE-2023-2198 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  26. Medium 6.1

    CVE-2023-2015 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A reflected XSS was possible when creating new abuse reports which allows attackers to perform arbitrary actions on behalf of victims.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  27. Medium 4.3

    CVE-2023-2013 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  28. Medium 4.3

    CVE-2023-2001 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  29. Medium 4.3

    CVE-2023-1825 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. It was possible to disclose issue notes to an unauthorized user at project export.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  30. Medium 4.3

    CVE-2023-0508 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in the NPM package API.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  31. High 7.5

    CVE-2023-0121 · GitLab

    A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  32. Medium 5.4

    CVE-2023-2442 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.

    Published 7 Jun 2023 · Fixed in 15.11.7, 16.0.2 · NVD
  33. Medium 5.5

    CVE-2023-2157 · ImageMagick

    A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing.

    Published 6 Jun 2023 · Fixed in 7.1.1-9 · NVD
  34. Medium 6.5

    CVE-2023-1621 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to commit to projects even from a restricted IP address.

    Published 6 Jun 2023 · Fixed in 15.10.5, 15.11.1 · NVD
  35. High 8.8

    CVE-2023-33653 · Sitecore Experience Platform

    Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /Applications/Content%20Manager/Execute.aspx?cmd=convert&mode=HTML.

    Published 6 Jun 2023 · NVD
  36. High 8.8

    CVE-2023-33652 · Sitecore Experience Platform

    Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx.

    Published 6 Jun 2023 · NVD
  37. High 7.5

    CVE-2023-33651 · Sitecore Experience Platform

    An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.

    Published 6 Jun 2023 · NVD
  38. Medium 5.3

    CVE-2023-2801 · Grafana

    Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable…

    Published 6 Jun 2023 · Fixed in 9.4.12, 9.5.3 · NVD
  39. Medium 6.4

    CVE-2023-2183 · Grafana

    Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple…

    Published 6 Jun 2023 · Fixed in 9.3.15, 9.4.12, 9.5.3 · NVD
  40. High 7.5

    CVE-2023-2132 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A DollarMathPostFilter Regular Expression Denial of Service in was possible by sending crafted payloads to the preview_markdown endpoint.

    Published 6 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  41. Medium 4.3

    CVE-2023-0921 · GitLab

    A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.

    Published 6 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  42. Critical 9.8Actively exploited

    CVE-2023-34362 · MOVEit Transfer

    In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL),…

    Published 2 Jun 2023 · Fixed in 2022.0.5, 2022.1.6, 2023.0.2 · NVD
  43. High 7.5

    CVE-2023-33960 · OpenProject

    OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Prior to version 12.5.6, even if the entire instance is marked as `Login required` and prevents all truly…

    Published 1 Jun 2023 · Fixed in 12.5.6 · NVD
  44. Medium 4.3

    CVE-2023-32717 · Splunk Enterprise

    On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the {{/services/indexing/preview}} REST endpoint to overwrite search results if they know the search ID (SID) of an existing search job.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  45. Medium 6.5

    CVE-2023-32716 · Splunk Enterprise

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, an attacker can exploit a vulnerability in the {{dump}} SPL command to cause a denial of service by crashing the Splunk daemon.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  46. High 8.1

    CVE-2023-32714 · Splunk Enterprise

    In the Splunk App for Lookup File Editing versions below 4.0.1, a low-privileged user can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk installation directory.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  47. Low 3.1

    CVE-2023-32712 · Splunk Enterprise

    In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files that, when a vulnerable terminal application reads them, can potentially, at worst, result in possible code execution in the vulnerable application. This attack requires a user to use a terminal application that supports the…

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  48. Medium 5.4

    CVE-2023-32711 · Splunk Enterprise

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a Splunk dashboard view lets a low-privileged user exploit a vulnerability in the Bootstrap web framework (CVE-2019-8331) and build a stored cross-site scripting (XSS) payload.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  49. Medium 5.3

    CVE-2023-32710 · Splunk Enterprise

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can perform an unauthorized transfer of data from a search using the ‘copyresults’ command if they know the search ID (SID) of a search job that has recently run.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  50. Medium 4.3

    CVE-2023-32709 · Splunk Enterprise

    In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user’ role can see the hashed version of the initial user name and password for the Splunk instance by using the ‘rest’ SPL command against the ‘conf-user-seed’ REST endpoint.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.