UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,008
Published in 7 days
621
Critical in 30 days
378
Actively exploited
421

Latest vulnerabilities

39,008 vulnerabilities
  1. High 8.8

    CVE-2023-32708 · Splunk Enterprise

    In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the ‘rest’ SPL command that lets them potentially access other REST endpoints in the system arbitrarily.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  2. High 8.8

    CVE-2023-32707 · Splunk Enterprise

    In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  3. Medium 6.5

    CVE-2023-32706 · Splunk Enterprise

    On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an unauthenticated attacker can send specially-crafted messages to the XML parser within SAML authentication to cause a denial of service in the Splunk daemon.

    Published 1 Jun 2023 · Fixed in 8.1.14, 8.2.11, 9.0.5 · NVD
  4. High 8.8

    CVE-2023-22648 · Rancher

    Azure AD permission changes are not reflected on active sessions

    Published 1 Jun 2023 · Fixed in 2.6.13, 2.7.4 · NVD, Project advisories (GitHub)
  5. High 8.0

    CVE-2023-22647 · Rancher

    Privilege Escalation via manipulation of Secrets

    Published 1 Jun 2023 · Fixed in 2.6.13, 2.7.4 · NVD, Project advisories (GitHub)
  6. High 8.4

    CVE-2022-43760 · Rancher

    Multiple Cross-Site Scripting (XSS) issues in Rancher UI

    Published 1 Jun 2023 · Fixed in 2.6.13, 2.7.4 · NVD, Project advisories (GitHub)
  7. High 8.8

    CVE-2020-10676 · Rancher

    Users retain access after moving namespaces into projects they don't have access to

    Published 1 Jun 2023 · Fixed in 2.6.13, 2.7.4 · NVD, Project advisories (GitHub)
  8. Medium 5.4

    CVE-2023-34229 · TeamCity

    In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  9. Medium 6.5

    CVE-2023-34228 · TeamCity

    In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  10. High 7.5

    CVE-2023-34227 · TeamCity

    In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  11. Medium 6.1

    CVE-2023-34226 · TeamCity

    In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  12. Medium 5.4

    CVE-2023-34225 · TeamCity

    In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  13. Medium 4.8

    CVE-2023-34224 · TeamCity

    In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  14. Medium 5.3

    CVE-2023-34223 · TeamCity

    In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some cases

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  15. Medium 6.1

    CVE-2023-34222 · TeamCity

    In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  16. Medium 5.4

    CVE-2023-34221 · TeamCity

    In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  17. Medium 5.4

    CVE-2023-34220 · TeamCity

    In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  18. Medium 4.3

    CVE-2023-34219 · TeamCity

    In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  19. Critical 9.8

    CVE-2023-34218 · TeamCity

    In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible

    Published 31 May 2023 · Fixed in 2023.05 · NVD
  20. High 7.8

    CVE-2023-34153 · ImageMagick

    A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.

    Published 30 May 2023 · Fixed in 7.1.1-11 · NVD
  21. Critical 9.8

    CVE-2023-34152 · ImageMagick

    A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured.

    Published 30 May 2023 · Fixed in 7.1.1-11 · NVD
  22. Medium 5.5

    CVE-2023-34151 · ImageMagick

    A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546).

    Published 30 May 2023 · Fixed in 7.1.1-11 · NVD
  23. Medium 6.5

    CVE-2023-32689 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. A malicious user could upload an HTML file to Parse Server via its public API. That HTML file would then be accessible at the internet domain at which Parse…

    Published 30 May 2023 · Fixed in 5.4.4, 6.1.1 · NVD
  24. High 7.5

    CVE-2023-23755 · Joomla!

    An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods.

    Published 30 May 2023 · Fixed in 4.3.2 · NVD
  25. Medium 6.1

    CVE-2023-23754 · Joomla!

    An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen.

    Published 30 May 2023 · Fixed in 4.3.2 · NVD
  26. Critical 9.8

    CVE-2023-33966 · Deno

    Missing "--allow-net" permission check for built-in Node modules

    Published 30 May 2023 · NVD, Project advisories (GitHub)
  27. Medium 6.5

    CVE-2023-2650 · OpenSSL

    Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An…

    Published 30 May 2023 · Fixed in 1.1.1u, 3.0.9, 3.1.1 · NVD
  28. High 8.8

    CVE-2023-2984 · Pimcore

    Pre-Auth Path traversal in pimcore_log parameter

    Published 30 May 2023 · Fixed in 10.5.22 · NVD, Project advisories (GitHub)
  29. High 8.8

    CVE-2023-2983 · Pimcore

    Privilege Defined With Unsafe Actions

    Published 30 May 2023 · Fixed in 10.5.23 · NVD, Project advisories (GitHub)
  30. Unrated

    WPV-158ffac30063 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 30 May 2023 · Fixed in 12.1.1 · WPVulnerability
  31. High 8.8

    CVE-2023-2996 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Improper Input Validation

    Published 30 May 2023 · Fixed in 12.1.1 · NVD, WPVulnerability
  32. High 8.8

    CVE-2023-30253 · Dolibarr ERP CRM

    Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.

    Published 29 May 2023 · Fixed in 17.0.1 · NVD
  33. Medium 4.3

    CVE-2022-41766 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. Upon an action=rollback operation, the alreadyrolled message can leak a user name (when the user has been revision deleted/suppressed).

    Published 29 May 2023 · Fixed in 1.35.8, 1.37.5, 1.38.3 · NVD
  34. Medium 5.3

    CVE-2023-2808 · Mattermost

    Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link preview on a disallowed domain using a specially crafted link.

    Published 29 May 2023 · Fixed in 7.1.9, 7.8.4, 7.9.3 · NVD
  35. Medium 5.4

    CVE-2023-28785 · Yoast SEO

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.9 versions.

    Published 28 May 2023 · NVD
  36. Medium 6.1

    CVE-2023-33195 · Craft CMS

    Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.

    Published 27 May 2023 · Fixed in 4.4.6 · NVD
  37. Medium 6.5

    CVE-2023-32319 · Nextcloud

    Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the provided user name was not an email address. Users from version 24.0.0 onward are affected. This issue has been addressed in releases 24.0.11, 25.0.5 and 26.0.0. Users are advised to upgrade. There are…

    Published 26 May 2023 · Fixed in 24.0.11, 25.0.5 · NVD
  38. Medium 5.4

    CVE-2023-33196 · Craft CMS

    Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.

    Published 26 May 2023 · Fixed in 4.4.7 · NVD
  39. Medium 4.8

    CVE-2023-33194 · Craft CMS

    Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.

    Published 26 May 2023 · Fixed in 3.8.6, 4.4.6 · NVD
  40. High 7.5

    CVE-2023-2825 · GitLab

    An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.

    Published 26 May 2023 · NVD
  41. Low 3.7

    CVE-2023-28322 · curl

    An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to…

    Published 26 May 2023 · Fixed in 8.1.0 · NVD
  42. Medium 5.9

    CVE-2023-28321 · curl

    An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts…

    Published 26 May 2023 · Fixed in 8.1.0 · NVD
  43. Medium 5.9

    CVE-2023-28320 · curl

    A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded…

    Published 26 May 2023 · Fixed in 8.1.0 · NVD
  44. High 7.5

    CVE-2023-28319 · curl

    A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or…

    Published 26 May 2023 · Fixed in 8.1.0 · NVD
  45. Medium 5.4

    CVE-2023-33197 · Craft CMS

    Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.

    Published 26 May 2023 · Fixed in 4.4.6 · NVD
  46. Medium 6.7

    CVE-2023-32318 · Nextcloud

    Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account the previous session would be continued and the attacker would be authenticated as the previously logged in user.…

    Published 26 May 2023 · Fixed in 25.0.6 · NVD
  47. Medium 5.4

    CVE-2023-2817 · Craft CMS

    A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively.

    Published 26 May 2023 · NVD
  48. Medium 6.5

    CVE-2023-22504 · Confluence

    Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability in the attachments feature.

    Published 25 May 2023 · Fixed in 7.13.17, 7.19.9, 8.2.2 · NVD
  49. High 7.5

    CVE-2023-33950 · Liferay Portal / DXP

    Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs.

    Published 24 May 2023 · NVD
  50. High 7.5

    CVE-2023-33949 · Liferay Portal / DXP

    In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don't control. The portal property `company.security.strangers.verify` should be set to true.

    Published 24 May 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.