UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,008
Published in 7 days
621
Critical in 30 days
378
Actively exploited
421

Latest vulnerabilities

39,008 vulnerabilities
  1. Medium 6.5

    CVE-2023-2336 · Pimcore

    Path Traversal in Asset "import from server" option

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  2. Medium 4.8

    CVE-2023-2332 · Pimcore

    Cross-site Scripting (XSS) in Conditions tab of Pricing Rules

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  3. Medium 5.4

    CVE-2023-2328 · Pimcore

    Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  4. Medium 5.4

    CVE-2023-2327 · Pimcore

    Cross-site Scripting (XSS) in DataObject Class date fields

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  5. Medium 5.4

    CVE-2023-2323 · Pimcore

    Cross-site Scripting (XSS) in Ecommerce Pricing Rules name field

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  6. Medium 5.4

    CVE-2023-2322 · Pimcore

    Cross-site Scripting (XSS) in Document Properties Parameter

    Published 27 Apr 2023 · Fixed in 10.5.21 · NVD, Project advisories (GitHub)
  7. Medium 6.5

    CVE-2023-31250 · Drupal

    The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.

    Published 26 Apr 2023 · Fixed in 9.4.14, 9.5.8, 10.0.8 · NVD
  8. Medium 6.5

    CVE-2022-25278 · Drupal

    Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.

    Published 26 Apr 2023 · Fixed in 9.3.19, 9.4.3 · NVD
  9. High 7.2

    CVE-2022-25277 · Drupal

    Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of…

    Published 26 Apr 2023 · Fixed in 9.3.19, 9.4.3 · NVD
  10. Medium 6.1

    CVE-2022-25276 · Drupal

    The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

    Published 26 Apr 2023 · Fixed in 9.3.19, 9.4.3 · NVD
  11. High 7.5

    CVE-2023-1387 · Grafana

    Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked…

    Published 26 Apr 2023 · Fixed in 9.2.17, 9.3.13, 9.4.9 · NVD
  12. High 7.5

    CVE-2022-25275 · Drupal

    In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this…

    Published 26 Apr 2023 · Fixed in 7.91, 9.3.19, 9.4.3 · NVD
  13. Medium 5.4

    CVE-2022-25274 · Drupal

    Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual items of node and media content. This vulnerability only affects sites using Drupal's revision system.

    Published 26 Apr 2023 · Fixed in 9.3.12 · NVD
  14. High 7.5

    CVE-2022-25273 · Drupal

    Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.

    Published 26 Apr 2023 · Fixed in 9.2.18, 9.3.12 · NVD
  15. Medium 6.5

    CVE-2023-30843 · Payload CMS

    Hidden fields can be leaked on readable collections

    Published 26 Apr 2023 · Fixed in 1.7.0 · NVD, Project advisories (GitHub)
  16. Medium 4.3

    CVE-2023-22728 · Silverstripe CMS

    Missing permission check of canView in GridFieldPrintButton

    Published 26 Apr 2023 · Fixed in 4.12.5 · NVD, Project advisories (GitHub)
  17. Medium 6.1

    CVE-2023-22729 · Silverstripe CMS

    Open redirect vulnerability on CMSSecurity relogin screen

    Published 26 Apr 2023 · Fixed in 4.12.5 · NVD, Project advisories (GitHub)
  18. High 8.1

    CVE-2021-45111 · Odoo

    Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of demonstration data, including user accounts with known credentials.

    Published 25 Apr 2023 · NVD
  19. Medium 6.1

    CVE-2021-45071 · Odoo

    Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via crafted uploaded file names.

    Published 25 Apr 2023 · NVD
  20. Medium 6.1

    CVE-2021-44775 · Odoo

    Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.

    Published 25 Apr 2023 · NVD
  21. Critical 9.1

    CVE-2021-44547 · Odoo

    A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading to privilege escalation.

    Published 25 Apr 2023 · NVD
  22. Medium 6.8

    CVE-2021-44476 · Odoo

    A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the server, including sensitive configuration files.

    Published 25 Apr 2023 · NVD
  23. Medium 4.3

    CVE-2021-44465 · Odoo

    Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe to receive future notifications and comments related to arbitrary business records in the system, via crafted RPC requests.

    Published 25 Apr 2023 · NVD
  24. Medium 6.1

    CVE-2021-44461 · Odoo

    Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting journal entries to inject arbitrary web script in the browser of a victim.

    Published 25 Apr 2023 · NVD
  25. Medium 6.5

    CVE-2021-44460 · Odoo

    Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the deactivated account and any permission it still holds, via crafted RPC requests.

    Published 25 Apr 2023 · NVD
  26. Medium 6.1

    CVE-2021-26947 · Odoo

    Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via a crafted link.

    Published 25 Apr 2023 · NVD
  27. Medium 6.1

    CVE-2021-26263 · Odoo

    Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.

    Published 25 Apr 2023 · NVD
  28. High 7.5

    CVE-2021-23203 · Odoo

    Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests.

    Published 25 Apr 2023 · NVD
  29. High 8.7

    CVE-2021-23186 · Odoo

    A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and modify database contents of other tenants, in a multi-tenant system.

    Published 25 Apr 2023 · NVD
  30. High 7.5

    CVE-2021-23178 · Odoo

    Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online payments with a tokenized payment method that belongs to another user, causing the victim's payment method to be charged instead.

    Published 25 Apr 2023 · NVD
  31. Medium 6.5

    CVE-2021-23176 · Odoo

    Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to extract accounting information via crafted RPC packets.

    Published 25 Apr 2023 · NVD
  32. High 8.7

    CVE-2021-23166 · Odoo

    A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server.

    Published 25 Apr 2023 · NVD
  33. Medium 6.1

    CVE-2023-30177 · Craft CMS

    CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.

    Published 25 Apr 2023 · NVD
  34. High 7.5

    CVE-2023-28847 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior to 25.0.5; as well as Nextcloud Server Enterprise 23.0.0 prior to 23.0.12.6, 24.0.0 prior to 24.0.11, and 25.0.0 prior to 25.0.5; an attacker is not restricted in verifying passwords of share links so they can just start brute forcing the…

    Published 25 Apr 2023 · Fixed in 23.0.12.6, 24.0.11, 25.0.5 · NVD
  35. High 7.5Actively exploited

    CVE-2023-29552 · VMware ESXi

    The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

    Published 25 Apr 2023 · Fixed in 7.0 · NVD
  36. Medium 6.1

    CVE-2023-25314 · AVideo

    Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user.

    Published 25 Apr 2023 · Fixed in 12.4 · NVD
  37. Critical 9.8

    CVE-2023-25313 · AVideo

    OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.

    Published 25 Apr 2023 · Fixed in 12.4 · NVD
  38. Critical 9.9

    CVE-2023-30838 · PrestaShop

    Possible XSS injection through Validate::isCleanHTML method

    Published 25 Apr 2023 · Fixed in 1.7.8.9, 8.0.4 · NVD, Project advisories (GitHub)
  39. Medium 6.5

    CVE-2023-30545 · PrestaShop

    Arbitrary file read

    Published 25 Apr 2023 · Fixed in 1.7.8.9, 8.0.4 · NVD, Project advisories (GitHub)
  40. High 8.8

    CVE-2023-30839 · PrestaShop

    SQL filter bypass leading to arbitrary write requests using "SQL Manager"

    Published 25 Apr 2023 · Fixed in 1.7.8.9, 8.0.4 · NVD, Project advisories (GitHub)
  41. Medium 4.3

    CVE-2023-2281 · Mattermost

    When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team.

    Published 25 Apr 2023 · Fixed in 7.9.0 · NVD
  42. High 7.8

    CVE-2022-42335 · Xen

    x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an…

    Published 25 Apr 2023 · NVD
  43. Medium 6.5

    CVE-2023-29200 · Contao

    Directory traversal in the file manager

    Published 25 Apr 2023 · Fixed in 4.9.40, 4.13.21, 5.1.4 · NVD, Project advisories (GitHub)
  44. Medium 6.5

    CVE-2023-29469 · libxml2

    An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

    Published 24 Apr 2023 · Fixed in 2.10.4 · NVD
  45. Medium 6.5

    CVE-2023-28484 · libxml2

    In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.

    Published 24 Apr 2023 · Fixed in 2.10.4 · NVD
  46. Critical 9.9

    CVE-2023-22651 · Rancher

    Rancher Webhook is misconfigured during upgrade process

    Published 24 Apr 2023 · NVD, Project advisories (GitHub)
  47. Medium 6.5

    CVE-2023-30776 · Apache Superset

    An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1.

    Published 24 Apr 2023 · NVD
  48. Critical 9.8Actively exploited

    CVE-2023-27524 · Apache Superset

    Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations…

    Published 24 Apr 2023 · NVD
  49. Medium 4.8

    CVE-2023-31045 · Backdrop CMS

    A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. NOTE: the vendor disputes the security…

    Published 24 Apr 2023 · Fixed in 1.24.2 · NVD
  50. Unrated

    WPV-224ebf13e69c · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 24 Apr 2023 · Fixed in 3.12.2 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.