UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,027
Published in 7 days
640
Critical in 30 days
381
Actively exploited
421

Latest vulnerabilities

39,027 vulnerabilities
  1. Medium 4.3

    CVE-2022-42469 · Fortinet FortiOS

    A permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW Mode may allow an authenticated SSL-VPN user to bypass the policy via bookmarks in the web portal.

    Published 11 Apr 2023 · Fixed in 7.0.11, 7.2.4 · NVD
  2. Critical 9.8

    CVE-2022-41331 · Fortinet FortiProxy

    A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests.

    Published 11 Apr 2023 · Fixed in 2.0.0 · NVD
  3. Medium 6.1

    CVE-2022-41330 · Fortinet FortiProxy, Fortinet FortiOS

    An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11 and before 6.2.12 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.

    Published 11 Apr 2023 · Fixed in 7.0.10, 7.2.2, 7.2.4 · NVD
  4. High 8.8

    CVE-2022-27487 · Fortinet FortiSandbox

    A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and before 3.3.3 allows a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS requests.

    Published 11 Apr 2023 · Fixed in 3.2.4, 4.0.3, 4.2.3 · NVD
  5. Medium 6.5

    CVE-2022-27485 · Fortinet FortiSandbox

    A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0 through 4.0.2, 3.2.0 through 3.2.3, 3.1.x and 3.0.x allows a remote and authenticated attacker with read permission to retrieve arbitrary files from the underlying Linux system via a crafted HTTP request.

    Published 11 Apr 2023 · Fixed in 3.2.4, 4.0.3 · NVD
  6. High 7.3

    CVE-2023-25950 · HAProxy

    HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.

    Published 11 Apr 2023 · NVD
  7. High 7.5

    CVE-2023-29013 · Traefik

    HTTP header parsing could cause a deny of service

    Published 11 Apr 2023 · Fixed in 2.9.10, 2.10.0-rc2 · NVD, Project advisories (GitHub)
  8. Medium 6.5

    CVE-2023-29010 · Budibase

    Budibase is a low code platform for creating internal tools, workflows, and admin panels. Versions prior to 2.4.3 (07 March 2023) are vulnerable to Server-Side Request Forgery. This can lead to an attacker gaining access to a Budibase AWS secret key. Users of Budibase cloud need to take no action. Self-host users who run Budibase on the public internet and are using a cloud provider that allows…

    Published 6 Apr 2023 · Fixed in 2.4.3 · NVD
  9. Medium 4.7

    CVE-2023-29008 · SvelteKit

    Insufficient CSRF protection for CORS requests

    Published 6 Apr 2023 · Fixed in 1.15.2 · Project advisories (GitHub)
  10. Unrated

    WPV-4e7b282ec8a2 · WP Seopress (WordPress plugin)

    Vulnerability in SEOPress – AI SEO Plugin & On-site SEO

    Published 6 Apr 2023 · Fixed in 6.5.0.3 · WPVulnerability
  11. Medium 5.3

    CVE-2023-1787 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A search timeout could be triggered if a specific HTML payload was used in the issue description.

    Published 5 Apr 2023 · Fixed in 15.9.4 · NVD
  12. Medium 5.3

    CVE-2023-1710 · GitLab

    A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 prior to 15.10.1 allows an attacker to view the count of internal notes for a given issue.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  13. Critical 9.8

    CVE-2023-1708 · GitLab

    An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  14. Medium 4.3

    CVE-2023-1417 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group.

    Published 5 Apr 2023 · Fixed in 15.9.4 · NVD
  15. Medium 5.3

    CVE-2023-1167 · GitLab

    Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in MR.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  16. Medium 4.3

    CVE-2023-1071 · GitLab

    An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. Due to improper permissions checks it was possible for an unauthorised user to remove an issue from an epic.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  17. Low 3.8

    CVE-2023-0838 · GitLab

    An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  18. Medium 4.6

    CVE-2023-0450 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1. It was possible to add a branch with an ambiguous name that could be used to social engineer users.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  19. High 7.5

    CVE-2023-1733 · GitLab

    A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.10.1.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  20. Medium 4.9

    CVE-2023-1098 · GitLab

    An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  21. Medium 6.1

    CVE-2023-0523 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. An XSS was possible via a malicious email address for certain instances.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  22. Medium 5.3

    CVE-2023-0319 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1, allowing to read environment names supposed to be restricted to project memebers only.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  23. Medium 6.1

    CVE-2022-3513 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A specially crafted payload could lead to a reflected XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims on self-hosted instances running without strict CSP.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  24. Low 3.7

    CVE-2022-3375 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 11.10 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible to disclose the branch names when attacker has a fork of a project that was switched to private.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  25. Medium 4.8

    CVE-2023-28852 · GLPI

    GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 9.5.13 and 10.0.7, a user with dashboard administration rights may hack the dashboard form to store malicious code that will be executed when other users will use the related dashboard. Versions 9.5.13 and 10.0.7 contain a patch for this issue.

    Published 5 Apr 2023 · Fixed in 9.5.13, 10.0.7 · NVD
  26. Medium 5.4

    CVE-2023-28849 · GLPI

    GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.7, GLPI inventory endpoint can be used to drive a SQL injection attack. It can also be used to store malicious code that could be used to perform XSS attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.7 contains a patch for this issue. As a workaround,…

    Published 5 Apr 2023 · Fixed in 10.0.7 · NVD
  27. High 8.1

    CVE-2023-28838 · GLPI

    GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vulnerability allow users with access rights to statistics or reports to extract all data from database and, in some cases, write a webshell on the server. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, remove `Assistance >…

    Published 5 Apr 2023 · Fixed in 9.5.13, 10.0.7 · NVD
  28. Medium 6.1

    CVE-2023-28639 · GLPI

    GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is fixed in versions 9.5.13 and 10.0.7.

    Published 5 Apr 2023 · Fixed in 9.5.13, 10.0.7 · NVD
  29. Medium 4.8

    CVE-2023-28636 · GLPI

    GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.7, a vulnerability allows an administrator to create a malicious external link. This issue is fixed in versions 9.5.13 and 10.0.7.

    Published 5 Apr 2023 · Fixed in 9.5.13, 10.0.7 · NVD
  30. High 8.8

    CVE-2023-28634 · GLPI

    GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profile could see and generate a Personal token for a Super-Admin. Using such token it is possible to negotiate a GLPI session and hijack the Super-Admin account, resulting in a Privilege Escalation. Versions 9.5.13 and 10.0.7 contain a patch…

    Published 5 Apr 2023 · Fixed in 9.5.13, 10.0.7 · NVD
  31. Medium 5.4

    CVE-2023-28633 · GLPI

    GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue.

    Published 5 Apr 2023 · Fixed in 9.5.13, 10.0.7 · NVD
  32. High 8.1

    CVE-2023-28632 · GLPI

    GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the "forgotten password" feature. By modifying emails, the user can also receive sensitive data through GLPI notifications. Versions 9.5.13 and 10.0.7 contain a patch…

    Published 5 Apr 2023 · Fixed in 9.5.13, 10.0.7 · NVD
  33. High 7.2

    CVE-2023-1669 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Deserialization of Untrusted Data

    Published 5 Apr 2023 · Fixed in 6.5.0.3 · WPVulnerability
  34. Critical 9.3

    CVE-2023-29003 · SvelteKit

    Insufficient Cross-Site Request Forgery Protection

    Published 4 Apr 2023 · Fixed in 1.15.1 · Project advisories (GitHub)
  35. Medium 6.8

    CVE-2023-28842 · Docker Engine

    Encrypted overlay network with a single endpoint is unauthenticated

    Published 4 Apr 2023 · Fixed in 20.10.24, 23.0.3 · NVD, Project advisories (GitHub)
  36. Medium 6.8

    CVE-2023-28841 · Docker Engine

    Encrypted overlay network traffic may be unencrypted

    Published 4 Apr 2023 · Fixed in 20.10.24, 23.0.3 · NVD, Project advisories (GitHub)
  37. High 8.7

    CVE-2023-28840 · Docker Engine

    Encrypted overlay network may be unauthenticated

    Published 4 Apr 2023 · Fixed in 20.10.24, 23.0.3 · NVD, Project advisories (GitHub)
  38. Critical 9.8

    CVE-2021-28235 · etcd

    Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.

    Published 4 Apr 2023 · NVD
  39. Critical 9.6

    CVE-2020-21487 · pfSense

    Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via the RootFolder field of acme_certificates.php.

    Published 4 Apr 2023 · NVD
  40. Medium 6.5

    CVE-2020-19850 · Directus

    An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.

    Published 4 Apr 2023 · NVD
  41. Critical 9.1

    CVE-2023-27487 · Envoy

    Client may fake the header `x-envoy-original-path`

    Published 4 Apr 2023 · Fixed in 1.23.6, 1.24.4, 1.25.3 · NVD, Project advisories (GitHub)
  42. Critical 9.1

    CVE-2023-27491 · Envoy

    Envoy forwards invalid HTTP/2 and HTTP/3 downstream headers

    Published 4 Apr 2023 · Fixed in 1.23.6, 1.24.4, 1.25.3 · NVD, Project advisories (GitHub)
  43. Medium 6.5

    CVE-2023-27492 · Envoy

    Crash when a large request body is processed in Lua filter

    Published 4 Apr 2023 · Fixed in 1.23.6, 1.24.4, 1.25.3 · NVD, Project advisories (GitHub)
  44. Critical 9.1

    CVE-2023-27493 · Envoy

    Envoy doesn't escape HTTP header values

    Published 4 Apr 2023 · Fixed in 1.23.6, 1.24.4, 1.25.3 · NVD, Project advisories (GitHub)
  45. Critical 9.8

    CVE-2023-27488 · Envoy

    gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.

    Published 4 Apr 2023 · Fixed in 1.23.6, 1.24.4, 1.25.3 · NVD, Project advisories (GitHub)
  46. High 7.5

    CVE-2023-27496 · Envoy

    Crash when a redirect url without a state param is received in the oauth filter

    Published 4 Apr 2023 · Fixed in 1.23.6, 1.24.4, 1.25.3 · NVD, Project advisories (GitHub)
  47. Medium 6.5

    CVE-2023-28853 · Mastodon

    Blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database

    Published 4 Apr 2023 · Fixed in 3.5.8, 4.0.4, 4.1.2 · NVD, Project advisories (GitHub)
  48. Unrated

    WPV-1ce4c9d3dd24 · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Published 4 Apr 2023 · Fixed in 5.12.5 · WPVulnerability
  49. Medium 5.9

    CVE-2023-0922 · Samba

    The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.

    Published 3 Apr 2023 · Fixed in 4.16.10, 4.17.7 · NVD
  50. Medium 6.5

    CVE-2023-0614 · Samba

    The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.

    Published 3 Apr 2023 · Fixed in 4.16.10, 4.17.7 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.