Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,008
- Published in 7 days
- 621
- Critical in 30 days
- 378
- Actively exploited
- 421
Latest vulnerabilities
39,008 vulnerabilities- Medium 6.3
CVE-2023-27554 · IBM WebSphere Application Server
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249185.
Published 11 May 2023 · Fixed in 8.5.5.24, 9.0.5.16 · NVD - High 7.5
CVE-2023-30172 · MLflow
A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.
Published 11 May 2023 · Fixed in 2.0.1 · NVD - Medium 4.4
CVE-2023-0008 · Palo Alto Networks PAN-OS
A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition.
Published 10 May 2023 · Fixed in 10.0.12, 10.1.10, 10.2.4 · NVD - Medium 4.8
CVE-2023-0007 · Palo Alto Networks PAN-OS
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrator’s browser when viewed.
Published 10 May 2023 · Fixed in 9.0.17, 9.1.16, 10.0.7 · NVD - High 7.5
CVE-2023-27564 · n8n
The n8n package 0.218.0 for Node.js allows Information Disclosure.
Published 10 May 2023 · NVD - High 8.8
CVE-2023-27563 · n8n
The n8n package 0.218.0 for Node.js allows Escalation of Privileges.
Published 10 May 2023 · NVD - Medium 6.5
CVE-2023-27562 · n8n
The n8n package 0.218.0 for Node.js allows Directory Traversal.
Published 10 May 2023 · NVD - Medium 4.8
CVE-2023-2630 · Pimcore
Cross-site Scripting (XSS) in Admin Translations
Published 10 May 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub) - Medium 5.4
CVE-2023-2615 · Pimcore
Cross-site Scripting (XSS) in Predefined Properties delete
Published 10 May 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub) - Medium 5.4
CVE-2023-2614 · Pimcore
Cross-site Scripting (XSS) in name field of Custom Reports
Published 10 May 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub) - Medium 5.4
CVE-2023-2616 · Pimcore
Cross-site Scripting (XSS) in Static Routes name field
Published 10 May 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub) - Medium 5.4
CVE-2023-31807 · Chamilo LMS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes function.
Published 9 May 2023 · NVD - Medium 5.4
CVE-2023-31806 · Chamilo LMS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function.
Published 9 May 2023 · NVD - Medium 4.8
CVE-2023-31805 · Chamilo LMS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage function.
Published 9 May 2023 · NVD - Medium 5.4
CVE-2023-31804 · Chamilo LMS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category parameters.
Published 9 May 2023 · NVD - Medium 4.8
CVE-2023-31803 · Chamilo LMS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequencing parameters.
Published 9 May 2023 · NVD - Medium 5.4
CVE-2023-31802 · Chamilo LMS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url parameters.
Published 9 May 2023 · NVD - Medium 6.1
CVE-2023-31801 · Chamilo LMS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter.
Published 9 May 2023 · NVD - Medium 5.4
CVE-2023-31800 · Chamilo LMS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter.
Published 9 May 2023 · NVD - Medium 4.8
CVE-2023-31799 · Chamilo LMS
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter.
Published 9 May 2023 · NVD - Medium 6.1
CVE-2023-31144 · Craft CMS
Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.
Published 9 May 2023 · NVD - High 7.5
CVE-2021-31239 · SQLite
An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.
Published 9 May 2023 · NVD - Medium 6.5
CVE-2023-2478 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all versions starting from 15.11 before 15.11.2. Under certain conditions, a malicious unauthorized GitLab user may use a GraphQL endpoint to attach a malicious runner to any project.
Published 8 May 2023 · Fixed in 15.9.7, 15.10.6, 15.11.2 · NVD - Medium 5.4
CVE-2023-30860 · AVideo
WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert malicious scripts. Since any USER including the ADMIN can see the meeting room that was created by…
Published 8 May 2023 · Fixed in 12.4 · NVD - Medium 4.8
CVE-2023-22791 · HPE ArubaOS
A vulnerability exists in Aruba InstantOS and ArubaOS 10 where an edge-case combination of network configuration, a specific WLAN environment and an attacker already possessing valid user credentials on that WLAN can lead to sensitive information being disclosed via the WLAN. The scenarios in which this disclosure of potentially sensitive information can occur are complex and depend on factors…
Published 8 May 2023 · NVD - High 8.8
CVE-2023-22790 · HPE ArubaOS
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 8 May 2023 · NVD - High 8.8
CVE-2023-22789 · HPE ArubaOS
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 8 May 2023 · NVD - High 8.8
CVE-2023-22788 · HPE ArubaOS
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 8 May 2023 · NVD - High 7.5
CVE-2023-22787 · HPE ArubaOS
An unauthenticated Denial of Service (DoS) vulnerability exists in a service accessed via the PAPI protocol provided by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.
Published 8 May 2023 · NVD - Critical 9.8
CVE-2023-22786 · HPE ArubaOS
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating…
Published 8 May 2023 · NVD - Critical 9.8
CVE-2023-22785 · HPE ArubaOS
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating…
Published 8 May 2023 · NVD - Critical 9.8
CVE-2023-22784 · HPE ArubaOS
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating…
Published 8 May 2023 · NVD - Critical 9.8
CVE-2023-22783 · HPE ArubaOS
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating…
Published 8 May 2023 · NVD - Critical 9.8
CVE-2023-22782 · HPE ArubaOS
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating…
Published 8 May 2023 · NVD - Critical 9.8
CVE-2023-22781 · HPE ArubaOS
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating…
Published 8 May 2023 · NVD - Critical 9.8
CVE-2023-22780 · HPE ArubaOS
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating…
Published 8 May 2023 · NVD - Critical 9.8
CVE-2023-22779 · HPE ArubaOS
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating…
Published 8 May 2023 · NVD - Critical 9.8
CVE-2023-25754 · Apache Airflow
Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0.
Published 8 May 2023 · Fixed in 2.6.0 · NVD - Medium 5.4
CVE-2023-29247 · Apache Airflow
Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0.
Published 8 May 2023 · Fixed in 2.6.0 · NVD - High 7.5
CVE-2023-32235 · Ghost
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.
Published 5 May 2023 · Fixed in 5.42.1 · NVD - High 8.8
CVE-2023-31415 · Kibana
Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.
Published 4 May 2023 · NVD - High 8.8
CVE-2023-31414 · Kibana
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.
Published 4 May 2023 · NVD - Medium 6.1
CVE-2023-30777 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)
Advanced Custom Field Pro: Cross-site Scripting
Published 4 May 2023 · Fixed in 6.1.6 · NVD, WPVulnerability - High 8.8
CVE-2023-2182 · GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users thus leading to privilege escalation for those users.
Published 3 May 2023 · Fixed in 15.10.5 · NVD - High 8.8
CVE-2023-22640 · Fortinet FortiProxy, Fortinet FortiOS
A out-of-bounds write vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.10, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.13, FortiOS 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1…
Published 3 May 2023 · Fixed in 6.4.12, 7.0.11, 7.2.4 · NVD - Medium 5.7
CVE-2023-1178 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a release containing a ref to another commit.
Published 3 May 2023 · Fixed in 15.9.6, 15.10.5, 15.11.1 · NVD - High 8.1
CVE-2023-0805 · GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to have access to the public projects of a public group even after being banned from the public group by the owner.
Published 3 May 2023 · Fixed in 15.9.6, 15.10.5, 15.11.1 · NVD - High 8.0
CVE-2023-0756 · GitLab
An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The main branch of a repository with a specially crafted name allows an attacker to create repositories with malicious code, victims who clone or download these repositories will execute arbitrary code on their systems.
Published 3 May 2023 · Fixed in 15.9.6, 15.10.5, 15.11.1 · NVD - Medium 4.3
CVE-2022-4376 · GitLab
An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions, an attacker may be able to map a private email of a GitLab user to their GitLab account on an instance.
Published 3 May 2023 · Fixed in 15.9.6, 15.10.5, 15.11.1 · NVD - Medium 4.3
CVE-2023-2069 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with the role of developer could use the import project feature to leak CI/CD variables.
Published 3 May 2023 · Fixed in 12.9.8, 12.10.7, 13.0.1 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.