UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,008
Published in 7 days
621
Critical in 30 days
378
Actively exploited
421

Latest vulnerabilities

39,008 vulnerabilities
  1. High 7.8

    CVE-2021-25749 · Kubernetes

    Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.

    Published 24 May 2023 · Fixed in 1.22.14, 1.23.11, 1.24.5 · NVD
  2. Medium 6.5

    CVE-2021-25748 · Ingress NGINX Controller

    A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the `spec.rules[].http.paths[].path` field of an Ingress object (in the `networking.k8s.io` or `extensions` API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access…

    Published 24 May 2023 · Fixed in 1.2.1 · NVD
  3. High 7.5

    CVE-2023-33948 · Liferay Portal / DXP

    The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.

    Published 24 May 2023 · NVD
  4. Medium 4.3

    CVE-2023-33947 · Liferay Portal / DXP

    The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition.

    Published 24 May 2023 · NVD
  5. Medium 4.3

    CVE-2023-33946 · Liferay Portal / DXP

    The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.

    Published 24 May 2023 · NVD
  6. High 8.1

    CVE-2023-33945 · Liferay Portal / DXP

    SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must…

    Published 24 May 2023 · NVD
  7. Medium 6.1

    CVE-2023-33944 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.

    Published 24 May 2023 · NVD
  8. Medium 5.4

    CVE-2023-33943 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's (1) First Name, (2) Middle Name, (3) Last Name, or (4) Job Title text field.

    Published 24 May 2023 · NVD
  9. Medium 5.4

    CVE-2023-33942 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's `Title` field.

    Published 24 May 2023 · NVD
  10. Medium 6.1

    CVE-2023-33941 · Liferay Portal / DXP

    Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter.

    Published 24 May 2023 · NVD
  11. Medium 5.4

    CVE-2023-33940 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.

    Published 24 May 2023 · NVD
  12. Medium 5.4

    CVE-2023-33939 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label.

    Published 24 May 2023 · NVD
  13. Medium 6.1

    CVE-2023-33938 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object's `Name` field.

    Published 24 May 2023 · NVD
  14. Medium 5.4

    CVE-2023-33937 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack 5 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form's `name` field.

    Published 24 May 2023 · NVD
  15. Critical 9.8

    CVE-2023-27068 · Sitecore Experience Platform

    Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationResult.aspx.

    Published 23 May 2023 · Fixed in 10.2 · NVD
  16. High 7.5

    CVE-2023-27067 · Sitecore Experience Platform

    Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to download.aspx

    Published 22 May 2023 · NVD
  17. Medium 6.5

    CVE-2023-27066 · Sitecore Experience Platform

    Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle.

    Published 22 May 2023 · NVD
  18. High 7.5

    CVE-2023-32067 · c-ares

    0-byte UDP payload Denial of Service

    Published 22 May 2023 · Fixed in 1.19.1 · NVD, Project advisories (GitHub)
  19. Medium 6.4

    CVE-2023-31130 · c-ares

    Buffer Underwrite in ares_inet_net_pton()

    Published 22 May 2023 · Fixed in 1.19.1 · NVD, Project advisories (GitHub)
  20. Medium 6.5

    CVE-2023-31147 · c-ares

    Insufficient randomness in generation of DNS query IDs

    Published 22 May 2023 · Fixed in 1.19.1 · NVD, Project advisories (GitHub)
  21. Low 3.7

    CVE-2023-31124 · c-ares

    AutoTools does not set CARES_RANDOM_FILE during cross compilation

    Published 22 May 2023 · Fixed in 1.19.1 · NVD, Project advisories (GitHub)
  22. High 7.5

    CVE-2023-28709 · Apache Tomcat

    The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded…

    Published 22 May 2023 · NVD
  23. Medium 4.3

    CVE-2023-33922 · Elementor

    Elementor Website Builder – more than just a page builder: Missing Authorization

    Published 22 May 2023 · Fixed in 3.13.3 · NVD, WPVulnerability
  24. High 8.8

    CVE-2023-2359 · Slider Revolution

    Slider Revolution: Code Injection

    Published 22 May 2023 · Fixed in 6.6.13 · NVD, WPVulnerability
  25. Medium 6.1

    CVE-2023-28467 · MyBB

    User CP email persistent XSS

    Published 21 May 2023 · Fixed in 1.8.34 · NVD, Project advisories (GitHub)
  26. High 7.2

    CVE-2023-32679 · Craft CMS

    Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead to Remote Code Execution. If the name parameter value is not empty string('') in the View.php's doesTemplateExist() -> resolveTemplate() -> _resolveTemplateInternal() -> _resolveTemplate() function, it returns directly without extension verification, so that arbitrary…

    Published 19 May 2023 · Fixed in 4.4.6 · NVD
  27. Critical 9.6

    CVE-2023-32680 · Metabase

    Metabase is an open source business analytics engine. To edit SQL Snippets, Metabase should have required people to be in at least one group with native query editing permissions to a database–but affected versions of Metabase didn't enforce that requirement. This lack of enforcement meant that: Anyone–including people in sandboxed groups–could edit SQL snippets. They could edit snippets via the…

    Published 18 May 2023 · Fixed in 1.44.7, 1.45.4, 1.46.3 · NVD
  28. High 7.5

    CVE-2023-31655 · Redis

    redis v7.0.10 was discovered to contain a segmentation violation. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

    Published 18 May 2023 · NVD
  29. High 7.2

    CVE-2019-25137 · Umbraco CMS

    Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx.

    Published 18 May 2023 · NVD
  30. Medium 6.1

    CVE-2023-32960 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Cross-Site Request Forgery (CSRF)

    Published 18 May 2023 · Fixed in 1.23.4 · NVD, WPVulnerability
  31. Critical 9.8

    CVE-2023-2780 · MLflow

    Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.

    Published 17 May 2023 · Fixed in 2.3.1 · NVD
  32. Medium 5.4

    CVE-2023-2745 · WordPress

    WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

    Published 17 May 2023 · Fixed in 5.9.6, 6.0.4, 6.1.2 · NVD
  33. Low 3.3

    CVE-2022-42336 · Xen

    Mishandling of guest SSBD selection on AMD hardware The current logic to set SSBD on AMD Family 17h and Hygon Family 18h processors requires that the setting of SSBD is coordinated at a core level, as the setting is shared between threads. Logic was introduced to keep track of how many threads require SSBD active in order to coordinate it, such logic relies on using a per-core counter of threads…

    Published 17 May 2023 · NVD
  34. Medium 5.4

    CVE-2021-27131 · Moodle

    Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer" parameter in /admin/settings.php. This vulnerability is leading an attacker to steal admin and all user account cookies by storing the malicious XSS payload in Header and Footer. NOTE: this is disputed by the vendor because…

    Published 16 May 2023 · NVD
  35. Medium 5.4

    CVE-2023-2730 · Pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.

    Published 16 May 2023 · Fixed in 10.3.3 · NVD
  36. Medium 4.8

    CVE-2023-2584 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Cross-site Scripting

    Published 16 May 2023 · Fixed in 9.3.7 · WPVulnerability
  37. Medium 6.5

    CVE-2023-2181 · GitLab

    An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A malicious developer could use a git feature called refs/replace to smuggle content into a merge request which would not be visible during review in the UI.

    Published 12 May 2023 · Fixed in 15.9.8, 15.10.7, 15.11.3 · NVD
  38. High 8.8

    CVE-2023-32073 · AVideo

    WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3.

    Published 12 May 2023 · NVD
  39. High 8.8

    CVE-2023-30130 · Craft CMS

    An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.

    Published 12 May 2023 · NVD
  40. High 8.8

    CVE-2023-2515 · Mattermost

    Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin

    Published 12 May 2023 · Fixed in 7.7.4, 7.8.3, 7.9.2 · NVD
  41. High 7.5

    CVE-2023-2514 · Mattermost

    Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization.

    Published 12 May 2023 · NVD
  42. High 7.5

    CVE-2023-2666 · Froxlor

    Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.

    Published 12 May 2023 · Fixed in 2.0.16 · NVD
  43. Unrated

    WPV-cbb5cf9fe805 · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 12 May 2023 · Fixed in 3.13.2 · WPVulnerability
  44. Unrated

    WPV-8a6080fb9ce2 · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 12 May 2023 · Fixed in 3.13.2 · WPVulnerability
  45. Medium 5.3

    CVE-2023-28359 · Rocket.Chat

    A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat. This can be exploited by unauthenticated users when there is at least one custom emoji uploaded to the Rocket.Chat instance. The vulnerability causes a delay in the server response, with the potential for limited impact.

    Published 11 May 2023 · Fixed in 6.0.0 · NVD
  46. Medium 6.1

    CVE-2023-28358 · Rocket.Chat

    A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of malicious tags. This can be exploited on servers with content security policy disabled possible leading to some issues attacks like account takeover.

    Published 11 May 2023 · Fixed in 6.0.0 · NVD
  47. Medium 4.3

    CVE-2023-28357 · Rocket.Chat

    A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a member of a channel that they do not have access to.

    Published 11 May 2023 · Fixed in 6.0.0 · NVD
  48. High 7.5

    CVE-2023-28356 · Rocket.Chat

    A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enter a hot loop on one of the processes, consuming ~120% CPU and rendering the service unresponsive.

    Published 11 May 2023 · Fixed in 6.0.0 · NVD
  49. Medium 6.5

    CVE-2023-28325 · Rocket.Chat

    An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room.

    Published 11 May 2023 · Fixed in 6.0.0 · NVD
  50. Medium 4.3

    CVE-2023-32082 · etcd

    etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no…

    Published 11 May 2023 · Fixed in 3.4.26, 3.5.9 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.