UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,054
Published in 7 days
640
Critical in 30 days
381
Actively exploited
421

Latest vulnerabilities

39,054 vulnerabilities
  1. High 8.8

    CVE-2023-27533 · curl

    A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an…

    Published 30 Mar 2023 · NVD
  2. High 7.5

    CVE-2023-28835 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share was using a weak complexity random number generator, so when the sharer did not change it the password could be guessable to an attacker willing to brute force it. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. This issue only…

    Published 30 Mar 2023 · Fixed in 23.0.14, 24.0.10, 25.0.4 · NVD
  3. High 8.8

    CVE-2023-28833 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a file name which was not restricted and could overwrite files in the appdata directory. Administrators may have access to overwrite these files by other means but this method could be exploited by tricking an admin into uploading a…

    Published 30 Mar 2023 · Fixed in 23.0.14, 24.0.10, 25.0.4 · NVD
  4. High 7.5

    CVE-2023-28644 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denial of service. This issue has been addressed and it is recommended that the Nextcloud Server is upgraded to 25.0.3. There are no known workarounds for this vulnerability.

    Published 30 Mar 2023 · Fixed in 25.0.3 · NVD
  5. High 8.8

    CVE-2023-28643 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will replace the first one instead of being renamed to `{name} (2)`. It is recommended that the Nextcloud Server is upgraded to 25.0.3 or 24.0.9. Users unable to upgrade should avoid sharing 2 folders with…

    Published 30 Mar 2023 · Fixed in 24.0.9, 25.0.3 · NVD
  6. High 8.8

    CVE-2023-26482 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defined scripts, in order to generate PDFs, invoking webhooks or running scripts on the server. Due to this combination depending on the…

    Published 30 Mar 2023 · Fixed in 23.0.12.5, 24.0.10, 25.0.4 · NVD
  7. Medium 4.7

    CVE-2023-25000 · HashiCorp Vault

    HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

    Published 30 Mar 2023 · Fixed in 1.11.9, 1.12.5, 1.13.1 · NVD
  8. Medium 6.5

    CVE-2023-0665 · HashiCorp Vault

    HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

    Published 30 Mar 2023 · Fixed in 1.11.9, 1.12.5, 1.13.1 · NVD
  9. Medium 6.7

    CVE-2023-0620 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provided MSSQL database. An attacker may modify these parameters to execute a malicious SQL command. This…

    Published 30 Mar 2023 · Fixed in 1.11.9, 1.12.5, 1.13.1 · NVD
  10. High 7.5

    CVE-2023-0836 · HAProxy

    An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.

    Published 29 Mar 2023 · Fixed in 2.2.27 · NVD
  11. High 8.1

    CVE-2022-48434 · FFmpeg

    libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).

    Published 29 Mar 2023 · Fixed in 5.1.2 · NVD
  12. Medium 5.4

    CVE-2023-1704 · Pimcore

    Cross site scripting XSS in Translation > Edit as HTML

    Published 29 Mar 2023 · Fixed in 10.5.20 · NVD, Project advisories (GitHub)
  13. Medium 5.4

    CVE-2023-1703 · Pimcore

    Cross-site Scripting (XSS) in Composite indices key field

    Published 29 Mar 2023 · Fixed in 10.5.20 · NVD, Project advisories (GitHub)
  14. Medium 5.4

    CVE-2023-1702 · Pimcore

    Cross-site Scripting (XSS) in Predefined Asset Metadata

    Published 29 Mar 2023 · Fixed in 10.5.20 · NVD, Project advisories (GitHub)
  15. Medium 5.4

    CVE-2023-1701 · Pimcore

    Cross-site Scripting (XSS) in Predefined Properties

    Published 29 Mar 2023 · Fixed in 10.5.20 · NVD, Project advisories (GitHub)
  16. High 7.8

    CVE-2023-28642 · runc

    AppArmor/SELinux bypass with symlinked /proc

    Published 29 Mar 2023 · Fixed in 1.1.5 · NVD, Project advisories (GitHub)
  17. Medium 6.3

    CVE-2023-25809 · runc

    rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared

    Published 29 Mar 2023 · Fixed in 1.1.5 · NVD, Project advisories (GitHub)
  18. Medium 6.1

    CVE-2023-28447 · Smarty

    Cross site scripting vulnerability in Javascript escaping

    Published 28 Mar 2023 · Fixed in 3.1.48, 4.3.1 · NVD, Project advisories (GitHub)
  19. Medium 5.3

    CVE-2023-0466 · OpenSSL

    The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was…

    Published 28 Mar 2023 · Fixed in 1.1.1u, 3.0.9, 3.1.1 · NVD
  20. Medium 5.3

    CVE-2023-0465 · OpenSSL

    Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to…

    Published 28 Mar 2023 · Fixed in 1.1.1u, 3.0.9, 3.1.1 · NVD
  21. Unrated

    WPV-5bdf526cbb79 · Elementor Pro (WordPress plugin)

    Vulnerability in Elementor Pro

    Published 28 Mar 2023 · Fixed in 3.11.7 · WPVulnerability
  22. High 8.8

    CVE-2023-3124 · Elementor Pro (WordPress plugin)

    Elementor Pro: Missing Authorization

    Published 28 Mar 2023 · Fixed in 3.11.7 · WPVulnerability
  23. High 8.1

    CVE-2023-25817 · Nextcloud

    Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This issue has been addressed andit is recommended that the Nextcloud Server is upgraded to 24.0.9. There are no known workarounds for this vulnerability.

    Published 27 Mar 2023 · Fixed in 24.0.9 · NVD
  24. Medium 4.3

    CVE-2023-22251 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Incorrect Authorization vulnerability. A low-privileged authenticated attacker could leverage this vulnerability to achieve minor information disclosure.

    Published 27 Mar 2023 · Fixed in 2.4.4 · NVD
  25. Medium 5.3

    CVE-2023-22250 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

    Published 27 Mar 2023 · Fixed in 2.4.4 · NVD
  26. Medium 4.8

    CVE-2023-22249 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 27 Mar 2023 · Fixed in 2.4.4 · NVD
  27. High 7.5

    CVE-2023-22247 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

    Published 27 Mar 2023 · Fixed in 2.4.4 · NVD
  28. Medium 6.5

    CVE-2023-0241 · pgAdmin

    pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.

    Published 27 Mar 2023 · Fixed in 6.19 · NVD
  29. High 7.1

    CVE-2023-25818 · Nextcloud

    Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and then brute force the 62^21 combinations for the password reset token. As of commit `704eb3aa` password reset attempts are now throttled. Note that 62^21 combinations would significant compute resources to brute force. None the less it is…

    Published 27 Mar 2023 · Fixed in 23.0.12.5, 24.0.10, 25.0.4 · NVD
  30. Medium 5.4

    CVE-2022-48428 · TeamCity

    In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible

    Published 27 Mar 2023 · Fixed in 2022.10.3 · NVD
  31. Medium 5.4

    CVE-2022-48427 · TeamCity

    In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible

    Published 27 Mar 2023 · Fixed in 2022.10.3 · NVD
  32. Medium 5.4

    CVE-2022-48426 · TeamCity

    In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible

    Published 27 Mar 2023 · NVD
  33. High 7.5

    CVE-2023-24094 · MikroTik RouterOS

    An issue in the bridge2 component of MikroTik RouterOS v6.40.5 allows attackers to cause a Denial of Service (DoS) via crafted packets.

    Published 27 Mar 2023 · NVD
  34. Medium 4.3

    CVE-2022-41354 · Argo CD

    An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.

    Published 27 Mar 2023 · Fixed in 2.4.28, 2.5.16, 2.6.7 · NVD
  35. Medium 4.3

    CVE-2022-40208 · Moodle

    In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt.

    Published 24 Mar 2023 · Fixed in 3.9.16, 3.11.9, 4.0.3 · NVD
  36. Low 3.3

    CVE-2023-1176 · MLflow

    Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs

    Published 24 Mar 2023 · Fixed in 2.2.1, 2.2.2 · NVD, Project advisories (GitHub)
  37. Critical 9.8

    CVE-2023-1177 · MLflow

    Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs

    Published 24 Mar 2023 · Fixed in 2.2.1 · NVD, Project advisories (GitHub)
  38. High 8.8

    CVE-2023-28446 · Deno

    Interactive `run` permission prompt spoofing via improper ANSI neutralization

    Published 23 Mar 2023 · Fixed in 1.31.2 · NVD, Project advisories (GitHub)
  39. Critical 9.8

    CVE-2023-28445 · Deno

    Improper handling of resizable ArrayBuffer in async built-in functions

    Published 23 Mar 2023 · NVD, Project advisories (GitHub)
  40. Medium 4.3

    CVE-2023-28336 · Moodle

    Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.

    Published 23 Mar 2023 · Fixed in 3.9.20, 3.11.13, 4.0.7 · NVD
  41. High 8.8

    CVE-2023-28335 · Moodle

    The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk.

    Published 23 Mar 2023 · NVD
  42. Medium 4.3

    CVE-2023-28334 · Moodle

    Authenticated users were able to enumerate other users' names via the learning plans page.

    Published 23 Mar 2023 · Fixed in 4.0.7 · NVD
  43. Critical 9.8

    CVE-2023-28333 · Moodle

    The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).

    Published 23 Mar 2023 · Fixed in 3.9.20, 3.11.13, 4.0.7 · NVD
  44. Medium 6.1

    CVE-2023-28332 · Moodle

    If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.

    Published 23 Mar 2023 · Fixed in 3.9.20, 3.11.13, 4.0.7 · NVD
  45. Medium 6.1

    CVE-2023-28331 · Moodle

    Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.

    Published 23 Mar 2023 · Fixed in 3.9.20, 3.11.13, 4.0.7 · NVD
  46. Medium 6.5

    CVE-2023-28330 · Moodle

    Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.

    Published 23 Mar 2023 · Fixed in 3.9.20, 3.11.13, 4.0.7 · NVD
  47. High 8.8

    CVE-2023-28329 · Moodle

    Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).

    Published 23 Mar 2023 · Fixed in 3.9.20, 3.11.13, 4.0.7 · NVD
  48. Medium 4.3

    CVE-2023-1402 · Moodle

    The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.

    Published 23 Mar 2023 · Fixed in 3.9.20, 3.11.13, 4.0.7 · NVD
  49. Medium 4.9

    CVE-2023-26361 · Adobe ColdFusion

    Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in Arbitrary file system read. Exploitation of this issue does not require user interaction, but does require administrator privileges.

    Published 23 Mar 2023 · NVD
  50. High 8.6Actively exploited

    CVE-2023-26360 · Adobe ColdFusion

    Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

    Published 23 Mar 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.