UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,018
Published in 7 days
631
Critical in 30 days
377
Actively exploited
421

Latest vulnerabilities

39,018 vulnerabilities
  1. Medium 4.9

    CVE-2023-21933 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 18 Apr 2023 · NVD
  2. High 7.5

    CVE-2023-21931 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical…

    Published 18 Apr 2023 · NVD
  3. High 7.4

    CVE-2023-21930 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java…

    Published 18 Apr 2023 · Fixed in 8 · NVD
  4. Medium 5.5

    CVE-2023-21929 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 18 Apr 2023 · NVD
  5. Medium 4.9

    CVE-2023-21920 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Apr 2023 · NVD
  6. Medium 4.9

    CVE-2023-21919 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 18 Apr 2023 · NVD
  7. Medium 4.9

    CVE-2023-21917 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Apr 2023 · NVD
  8. Medium 4.9

    CVE-2023-21913 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Apr 2023 · NVD
  9. High 7.5

    CVE-2023-21912 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.41 and prior and 8.0.30 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 18 Apr 2023 · NVD
  10. Medium 4.9

    CVE-2023-21911 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 18 Apr 2023 · NVD
  11. Medium 4.9Actively exploited

    CVE-2023-22894 · Strapi

    Leaking sensitive user information by filtering on private fields

    Published 18 Apr 2023 · Fixed in 4.8.0 · NVD, Project advisories (GitHub)
  12. High 8.8

    CVE-2023-30539 · Nextcloud

    Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are system tag based files access control or files retention rules. It is recommended that the Nextcloud Server is upgraded to 24.0.11 or 25.0.5, the Nextcloud Enterprise Server to 21.0.9.11, 22.2.10.11,…

    Published 17 Apr 2023 · Fixed in 23.0.12.6, 24.0.11, 25.0.5 · NVD
  13. Medium 4.3

    CVE-2023-27525 · Apache Superset

    An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1

    Published 17 Apr 2023 · NVD
  14. Medium 6.5

    CVE-2023-25504 · Apache Superset

    A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in Apache Superset versions up to and including 2.0.1.

    Published 17 Apr 2023 · NVD
  15. High 7.5

    CVE-2023-1831 · Mattermost

    Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).

    Published 17 Apr 2023 · Fixed in 7.7.3, 7.8.2 · NVD
  16. High 8.8

    CVE-2023-2017 · Shopware

    Improper Control of Generation of Code in Twig rendered views

    Published 17 Apr 2023 · Fixed in 6.4.20.1 · NVD, Project advisories (GitHub)
  17. Critical 9.8

    CVE-2021-33990 · Liferay Portal / DXP

    Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference link only shows frmfolders.html is accessible and does not demonstrate how an unauthorized user can upload a file.

    Published 16 Apr 2023 · NVD
  18. Medium 6.5

    CVE-2019-14944 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command-line flags. This sometimes leads to privilege escalation or remote code execution.

    Published 16 Apr 2023 · Fixed in 11.11.8, 12.0.6, 12.1.6 · NVD
  19. Medium 5.9

    CVE-2019-14942 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages (which have access control) could be sent over cleartext HTTP.

    Published 16 Apr 2023 · Fixed in 11.11.8, 12.0.6, 12.1.6 · NVD
  20. Medium 5.4

    CVE-2018-17537 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. blog-viewer has stored XSS during repository browsing, if package.json exists. .

    Published 16 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  21. Medium 5.4

    CVE-2018-17536 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the merge request page via project import.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  22. High 7.5

    CVE-2018-17455 · GitLab

    An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the "merge request approvals" feature.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  23. Medium 5.4

    CVE-2018-17454 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the issue details screen.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  24. Medium 5.3

    CVE-2018-17453 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers may have been able to obtain sensitive access-token data from Sentry logs via the GRPC::Unknown exception.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  25. Critical 9.8

    CVE-2018-17452 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  26. High 8.8

    CVE-2018-17451 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Cross Site Request Forgery (CSRF) in the Slack integration for issuing slash commands.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  27. Medium 4.3

    CVE-2018-17450 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via the Kubernetes integration, leading (for example) to disclosure of a GCP service token.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  28. High 7.5

    CVE-2018-17449 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Remote attackers could obtain sensitive information about issues, comments, and project titles via events API insecure direct object reference.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  29. High 7.5

    CVE-2018-15472 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The diff formatter using rouge can block for a long time in Sidekiq jobs without any timeout.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  30. Medium 4.3

    CVE-2021-30153 · MediaWiki

    An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. (It shouldn't because they are hidden.) This is related to ApiVisualEditor.

    Published 15 Apr 2023 · Fixed in 1.31.13, 1.35.2 · NVD
  31. High 7.5

    CVE-2022-47501 · Apache OFBiz

    Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a  pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.

    Published 14 Apr 2023 · Fixed in 18.12.07 · NVD
  32. High 8.8

    CVE-2023-2034 · Froxlor

    Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.

    Published 14 Apr 2023 · Fixed in 2.0.14 · NVD
  33. Medium 5.5

    CVE-2023-1906 · ImageMagick

    A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.

    Published 12 Apr 2023 · Fixed in 6.9.12-84 · NVD
  34. Medium 4.9

    CVE-2023-0005 · Palo Alto Networks PAN-OS

    A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device configuration and encrypted API keys.

    Published 12 Apr 2023 · Fixed in 10.0.12, 10.1.8, 10.2.3 · NVD
  35. Medium 6.5

    CVE-2023-0004 · Palo Alto Networks PAN-OS

    A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system with elevated privileges. These files can include logs and system components that impact the integrity and availability of PAN-OS software.

    Published 12 Apr 2023 · Fixed in 9.1.15, 10.0.11, 10.1.6 · NVD
  36. Medium 5.4

    CVE-2022-47053 · DNN Platform

    An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG file.

    Published 12 Apr 2023 · NVD
  37. High 7.8

    CVE-2023-28260 · .NET

    .NET DLL Hijacking Remote Code Execution Vulnerability

    Published 11 Apr 2023 · Fixed in 6.0.16, 7.0.5 · NVD
  38. Medium 5.4

    CVE-2023-22641 · Fortinet FortiProxy, Fortinet FortiOS

    A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1,…

    Published 11 Apr 2023 · Fixed in 7.0.11, 7.2.3, 7.2.4 · NVD
  39. Medium 6.1

    CVE-2022-43955 · Fortinet FortiWeb

    An improper neutralization of input during web page generation [CWE-79] in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow an unauthenticated and remote attacker to perform a reflected cross site scripting attack (XSS) via injecting malicious payload in log entries used to build report.

    Published 11 Apr 2023 · Fixed in 6.3.22, 7.0.4 · NVD
  40. High 7.8

    CVE-2022-43948 · Fortinet FortiWeb

    A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version 7.1.0 through 7.1.1, FortiADC version 7.0.0 through 7.0.3, FortiADC 6.2 all versions, FortiADC 6.1 all versions, FortiADC 6.0 all versions, FortiADC 5.4 all versions, FortiADC 5.3 all versions, FortiADC 5.2 all versions, FortiADC 5.1 all…

    Published 11 Apr 2023 · Fixed in 7.0.4 · NVD
  41. High 8.8

    CVE-2022-43947 · Fortinet FortiProxy, Fortinet FortiOS

    An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 administrative interface allows an attacker with a valid user account to perform brute-force attacks on other user accounts via injecting valid login sessions.

    Published 11 Apr 2023 · Fixed in 7.0.11, 7.2.2, 7.2.4 · NVD
  42. Medium 4.3

    CVE-2022-42469 · Fortinet FortiOS

    A permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW Mode may allow an authenticated SSL-VPN user to bypass the policy via bookmarks in the web portal.

    Published 11 Apr 2023 · Fixed in 7.0.11, 7.2.4 · NVD
  43. Critical 9.8

    CVE-2022-41331 · Fortinet FortiProxy

    A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests.

    Published 11 Apr 2023 · Fixed in 2.0.0 · NVD
  44. Medium 6.1

    CVE-2022-41330 · Fortinet FortiProxy, Fortinet FortiOS

    An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11 and before 6.2.12 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.

    Published 11 Apr 2023 · Fixed in 7.0.10, 7.2.2, 7.2.4 · NVD
  45. High 8.8

    CVE-2022-27487 · Fortinet FortiSandbox

    A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and before 3.3.3 allows a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS requests.

    Published 11 Apr 2023 · Fixed in 3.2.4, 4.0.3, 4.2.3 · NVD
  46. Medium 6.5

    CVE-2022-27485 · Fortinet FortiSandbox

    A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0 through 4.0.2, 3.2.0 through 3.2.3, 3.1.x and 3.0.x allows a remote and authenticated attacker with read permission to retrieve arbitrary files from the underlying Linux system via a crafted HTTP request.

    Published 11 Apr 2023 · Fixed in 3.2.4, 4.0.3 · NVD
  47. High 7.3

    CVE-2023-25950 · HAProxy

    HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.

    Published 11 Apr 2023 · NVD
  48. High 7.5

    CVE-2023-29013 · Traefik

    HTTP header parsing could cause a deny of service

    Published 11 Apr 2023 · Fixed in 2.9.10, 2.10.0-rc2 · NVD, Project advisories (GitHub)
  49. Medium 6.5

    CVE-2023-29010 · Budibase

    Budibase is a low code platform for creating internal tools, workflows, and admin panels. Versions prior to 2.4.3 (07 March 2023) are vulnerable to Server-Side Request Forgery. This can lead to an attacker gaining access to a Budibase AWS secret key. Users of Budibase cloud need to take no action. Self-host users who run Budibase on the public internet and are using a cloud provider that allows…

    Published 6 Apr 2023 · Fixed in 2.4.3 · NVD
  50. Medium 4.7

    CVE-2023-29008 · SvelteKit

    Insufficient CSRF protection for CORS requests

    Published 6 Apr 2023 · Fixed in 1.15.2 · Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.