UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,008
Published in 7 days
621
Critical in 30 days
378
Actively exploited
421

Latest vulnerabilities

39,008 vulnerabilities
  1. Medium 6.5

    CVE-2023-1965 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to obtain access tokens granted for 3rd party Group SAML SSO logins. This feature isn't enabled by default.

    Published 3 May 2023 · Fixed in 15.9.6, 15.10.5, 15.11.1 · NVD
  2. Medium 5.4

    CVE-2023-1836 · GitLab

    A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. When viewing an XML file in a repository in "raw" mode, it can be made to render as HTML if viewed under specific circumstances

    Published 3 May 2023 · Fixed in 15.9.6, 15.10.5, 15.11.1 · NVD
  3. Medium 4.5

    CVE-2023-1265 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from all users of a GitLab instance.

    Published 3 May 2023 · Fixed in 15.9.6, 15.10.5, 15.11.1 · NVD
  4. Medium 4.3

    CVE-2023-1204 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A user could use an unverified email as a public email and commit email by sending a specifically crafted request on user update settings.

    Published 3 May 2023 · Fixed in 12.9.8, 12.10.7, 13.0.1 · NVD
  5. Medium 6.5

    CVE-2023-0485 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible that a project member demoted to a user role to read project updates by doing a diff with a pre-existing fork.

    Published 3 May 2023 · Fixed in 15.8.5, 15.9.4, 15.11.1 · NVD
  6. Medium 5.4

    CVE-2023-0155 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was possible due to framing arbitrary content on any page allowing user controlled markdown

    Published 3 May 2023 · Fixed in 15.8.5, 15.9.5, 15.10.1 · NVD
  7. Medium 5.3

    CVE-2022-39161 · IBM WebSphere Application Server

    IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenticated user to conduct spoofing attacks. A man-in-the-middle attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive…

    Published 3 May 2023 · NVD
  8. High 7.5

    CVE-2023-29163 · F5 BIG-IP

    When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 3 May 2023 · Fixed in 14.1.5.4, 15.1.8.2, 16.1.3.4 · NVD
  9. Medium 4.3

    CVE-2023-28406 · F5 BIG-IP

    A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 3 May 2023 · Fixed in 15.1.8.2, 16.1.3.4, 17.1.0.1 · NVD
  10. Medium 6.1

    CVE-2023-27378 · F5 BIG-IP

    Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 3 May 2023 · Fixed in 15.1.8.2, 16.1.3.4, 17.1.0.1 · NVD
  11. Medium 5.3

    CVE-2023-24594 · F5 BIG-IP

    When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 3 May 2023 · NVD
  12. Medium 5.9

    CVE-2023-24461 · F5 BIG-IP

    An improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM system.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 3 May 2023 · Fixed in 7.2.4.1 · NVD
  13. Medium 5.9

    CVE-2023-22372 · F5 BIG-IP

    In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows and Mac OS.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 3 May 2023 · Fixed in 7.2.4.1 · NVD
  14. High 7.5

    CVE-2023-31133 · Ghost

    Information disclosure of private API fields

    Published 3 May 2023 · Fixed in 5.46.1 · NVD, Project advisories (GitHub)
  15. Medium 5.3

    CVE-2023-26268 · Apache CouchDB

    Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions: * validate_doc_update * list * filter * filter views (using view functions as filters) * rewrite * update This doesn't affect map/reduce or search (Dreyfus) index functions. Users are recommended to upgrade to a version that is no…

    Published 2 May 2023 · Fixed in 3.2.3, 3.3.2 · NVD
  16. High 7.3

    CVE-2023-30944 · Moodle

    The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database.

    Published 2 May 2023 · Fixed in 3.11.14, 4.0.8, 4.1.3 · NVD
  17. Medium 5.3

    CVE-2023-30943 · Moodle

    The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.

    Published 2 May 2023 · Fixed in 4.1.3 · NVD
  18. Medium 6.5

    CVE-2023-31140 · OpenProject

    User sessions not terminated after activation of 2FA

    Published 2 May 2023 · Fixed in 12.5.4 · NVD, Project advisories (GitHub)
  19. High 7.5

    CVE-2023-30855 · Pimcore

    Path Traversal in AdminBundle/Controller/Reports/CustomReportController.php

    Published 2 May 2023 · Fixed in 10.5.18 · NVD, Project advisories (GitHub)
  20. Low 2.5

    CVE-2023-2197 · HashiCorp Vault

    HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vault’s root key. Fixed in 1.13.2

    Published 1 May 2023 · Fixed in 1.13.2 · NVD
  21. Medium 5.3

    CVE-2023-22503 · Confluence

    Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Rojan Rijal of the Tinder Security Engineering team. The affected versions are before version 7.13.15,…

    Published 1 May 2023 · Fixed in 7.13.15, 7.19.7, 8.2.0 · NVD
  22. High 7.5

    CVE-2023-30861 · Flask

    Possible disclosure of permanent session cookie due to missing Vary: Cookie header

    Published 1 May 2023 · Fixed in 2.2.5 · Project advisories (GitHub)
  23. High 7.5

    CVE-2023-30441 · IBM WebSphere Application Server

    IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188.

    Published 29 Apr 2023 · Fixed in 8.5.5.23 · NVD
  24. High 8.8

    CVE-2023-30854 · AVideo

    AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4.

    Published 28 Apr 2023 · Fixed in 12.4 · NVD
  25. Medium 5.3

    CVE-2023-28821 · Concrete CMS

    Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.

    Published 28 Apr 2023 · Fixed in 9.1.0 · NVD
  26. Medium 5.4

    CVE-2023-28820 · Concrete CMS

    Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.

    Published 28 Apr 2023 · Fixed in 9.1.0 · NVD
  27. Medium 5.4

    CVE-2023-28819 · Concrete CMS

    Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.

    Published 28 Apr 2023 · Fixed in 9.1.0 · NVD
  28. Medium 5.4

    CVE-2023-28477 · Concrete CMS

    Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.

    Published 28 Apr 2023 · Fixed in 9.2.0 · NVD
  29. Medium 5.4

    CVE-2023-28476 · Concrete CMS

    Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files.

    Published 28 Apr 2023 · Fixed in 9.2.0 · NVD
  30. Medium 6.1

    CVE-2023-28475 · Concrete CMS

    Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.

    Published 28 Apr 2023 · Fixed in 9.2.0 · NVD
  31. Medium 5.4

    CVE-2023-28474 · Concrete CMS

    Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.

    Published 28 Apr 2023 · Fixed in 9.2.0 · NVD
  32. Low 3.3

    CVE-2023-28473 · Concrete CMS

    Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section.

    Published 28 Apr 2023 · Fixed in 9.2.0 · NVD
  33. Medium 5.3

    CVE-2023-28472 · Concrete CMS

    Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies.

    Published 28 Apr 2023 · Fixed in 9.2.0 · NVD
  34. Medium 5.4

    CVE-2023-28471 · Concrete CMS

    Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name.

    Published 28 Apr 2023 · Fixed in 9.2.0 · NVD
  35. Critical

    GHSA-83fm-w79m-64r5 · MLflow

    Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs

    Published 28 Apr 2023 · Fixed in 2.3.1 · Project advisories (GitHub)
  36. Medium 5.4

    CVE-2023-2361 · Pimcore

    Cross-site Scripting (XSS) in Documents Link Editor - Prameters, Anchor fields

    Published 28 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  37. High 7.5

    CVE-2023-28882 · ModSecurity

    Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.

    Published 28 Apr 2023 · Fixed in 3.0.9 · NVD
  38. High 7.5

    CVE-2023-2356 · MLflow

    Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.

    Published 28 Apr 2023 · Fixed in 2.3.1 · NVD
  39. Medium 6.1

    CVE-2023-29489 · cPanel & WHM

    An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.

    Published 27 Apr 2023 · Fixed in 11.106.0.18, 11.108.0.13, 11.109.9999.116 · NVD
  40. Medium 4.9

    CVE-2023-30852 · Pimcore

    Arbitrary File Read in Admin JS CSS files

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  41. Medium 6.1

    CVE-2023-24966 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246904.

    Published 27 Apr 2023 · Fixed in 8.5.5.24, 9.0.5.16 · NVD
  42. High 8.8

    CVE-2023-30848 · Pimcore

    SQL Injection in Admin Search Find API

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  43. High 8.8

    CVE-2023-30849 · Pimcore

    SQL Injection in Admin Translations Export API

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  44. High 8.8

    CVE-2023-30850 · Pimcore

    SQL Injection in Admin Translations API

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  45. Medium 5.4

    CVE-2023-2343 · Pimcore

    Cross-site Scripting (XSS) in DataObject Classification Store

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  46. Medium 5.4

    CVE-2023-2342 · Pimcore

    Cross-site Scripting (XSS) in Website Settings name field

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  47. Medium 6.1

    CVE-2023-2341 · Pimcore

    Cross-site Scripting (XSS) in Admin Login too many attempts notice

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  48. Medium 5.4

    CVE-2023-2340 · Pimcore

    Cross-site Scripting (XSS) in DataObject columns grid

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  49. Medium 5.4

    CVE-2023-2339 · Pimcore

    Cross-site Scripting (XSS) in DataObject Any Getter grid operator

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  50. High 8.8

    CVE-2023-2338 · Pimcore

    SQL Injection in AssetController

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.