UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,054
Published in 7 days
640
Critical in 30 days
381
Actively exploited
421

Latest vulnerabilities

39,054 vulnerabilities
  1. Critical 9.8Actively exploited

    CVE-2023-26359 · Adobe ColdFusion

    Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

    Published 23 Mar 2023 · NVD
  2. Medium 5.5

    CVE-2023-1289 · ImageMagick

    A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be…

    Published 23 Mar 2023 · Fixed in 7.1.1-0 · NVD
  3. Medium 5.5

    CVE-2023-28443 · Directus

    CWE-532: Insertion of Sensitive Information into Log File

    Published 23 Mar 2023 · Fixed in 9.23.3 · NVD, Project advisories (GitHub)
  4. High 7.5

    CVE-2023-20107 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the deterministic random bit generator (DRBG), also known as pseudorandom number generator (PRNG), in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover…

    Published 23 Mar 2023 · Fixed in 9.12.1 · NVD
  5. Medium 5.9

    CVE-2023-20081 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the IPv6 DHCP (DHCPv6) client module of Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense (FTD) Software, Cisco IOS Software, and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of DHCPv6 messages. An…

    Published 23 Mar 2023 · NVD
  6. Medium 4.8

    CVE-2023-1410 · Grafana

    Grafana is an open-source platform for monitoring and observability.  Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized. An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin…

    Published 23 Mar 2023 · Fixed in 8.5.22, 9.2.15, 9.3.11 · NVD
  7. High 8.8Actively exploited

    CVE-2023-28434 · MinIO

    Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched…

    Published 22 Mar 2023 · Fixed in 2023-03-20t20-16-18z · NVD
  8. High 8.8

    CVE-2023-28433 · MinIO

    Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can…

    Published 22 Mar 2023 · Fixed in 2023-03-20t20-16-18z · NVD
  9. High 7.5Actively exploited

    CVE-2023-28432 · MinIO

    Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to…

    Published 22 Mar 2023 · Fixed in 2023-03-20t20-16-18z · NVD
  10. High 7.8

    CVE-2023-25820 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud Server versions 25.0.x prior to 25.0.5 and versions 24.0.x prior to 24.0.10 as well as Nextcloud Enterprise Server versions 25.0.x prior to 25.0.4, 24.0.x prior to 24.0.10, 23.0.x prior to 23.0.12.5,…

    Published 22 Mar 2023 · Fixed in 23.0.12.5, 24.0.10, 25.0.4 · NVD
  11. Medium 5.3

    CVE-2023-22271 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a Weak Cryptography for Passwords vulnerability that can lead to a security feature bypass. A low-privileged attacker can exploit this in order to decrypt a user's password. The attack complexity is high since a successful exploitation requires to already have in possession this encrypted secret.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  12. Medium 5.4

    CVE-2023-22269 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  13. Medium 5.4

    CVE-2023-22266 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  14. Medium 5.4

    CVE-2023-22265 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  15. Medium 5.4

    CVE-2023-22264 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  16. Medium 5.4

    CVE-2023-22263 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  17. Medium 5.4

    CVE-2023-22262 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  18. Medium 5.4

    CVE-2023-22261 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  19. Medium 5.4

    CVE-2023-22260 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  20. Medium 5.4

    CVE-2023-22259 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  21. Medium 5.4

    CVE-2023-22258 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  22. Medium 5.4

    CVE-2023-22257 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  23. Medium 5.4

    CVE-2023-22256 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  24. Medium 5.4

    CVE-2023-22254 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  25. Medium 5.4

    CVE-2023-22253 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  26. Medium 5.4

    CVE-2023-22252 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  27. Medium 5.4

    CVE-2023-21616 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  28. Medium 5.4

    CVE-2023-21615 · Adobe Experience Manager

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 22 Mar 2023 · Fixed in 6.5.16.0 · NVD
  29. High 7.5

    CVE-2023-0464 · OpenSSL

    A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy…

    Published 22 Mar 2023 · Fixed in 1.1.1u, 3.0.9, 3.1.1 · NVD
  30. High 8.8

    CVE-2023-1578 · Pimcore

    RCE vulnerability in Search function

    Published 22 Mar 2023 · Fixed in 10.5.19 · NVD, Project advisories (GitHub)
  31. Medium 4.3

    CVE-2023-28708 · Apache Tomcat

    When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.…

    Published 22 Mar 2023 · Fixed in 8.5.86, 9.0.72, 10.1.6 · NVD
  32. Medium 4.3

    CVE-2023-1562 · Mattermost

    Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of a board owner.

    Published 22 Mar 2023 · Fixed in 7.5.0 · NVD
  33. High 8.0

    CVE-2023-28438 · Pimcore

    Improper quoting of filters & path traversal in Custom Reports

    Published 22 Mar 2023 · Fixed in 10.5.19 · NVD, Project advisories (GitHub)
  34. High 8.8

    CVE-2022-46800 · LiteSpeed Cache

    LiteSpeed Cache: Cross-Site Request Forgery (CSRF)

    Published 22 Mar 2023 · Fixed in 5.3.1 · NVD, WPVulnerability
  35. Medium 6.5

    CVE-2022-42334 · Xen

    x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected guests themselves, the…

    Published 21 Mar 2023 · NVD
  36. High 8.6

    CVE-2022-42333 · Xen

    x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected guests themselves, the…

    Published 21 Mar 2023 · NVD
  37. High 7.8

    CVE-2022-42332 · Xen

    x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Shadow mode maintains a pool of memory used for both shadow page tables as well as auxiliary data structures. To migrate or snapshot guests, Xen additionally runs them in so called…

    Published 21 Mar 2023 · NVD
  38. Medium 5.5

    CVE-2022-42331 · Xen

    x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one entrypath performs its speculation-safety actions too late. In some configurations, there is an unprotected RET instruction which can be attacked with a variety of speculative attacks.

    Published 21 Mar 2023 · NVD
  39. Medium 5.5

    CVE-2023-28425 · Redis

    Specially crafted MSETNX command can lead to denial-of-service

    Published 20 Mar 2023 · Fixed in 7.0.10 · NVD, Project advisories (GitHub)
  40. Medium 6.1

    CVE-2023-28429 · Pimcore

    Cross-site Scripting (XSS) in DataObject tooltip field

    Published 20 Mar 2023 · Fixed in 10.5.19 · NVD, Project advisories (GitHub)
  41. Medium 5.4

    CVE-2023-1515 · Pimcore

    Cross-site Scripting (XSS) in Redirects

    Published 20 Mar 2023 · Fixed in 10.5.19 · NVD, Project advisories (GitHub)
  42. Medium 4.8

    CVE-2023-1517 · Pimcore

    Cross site scripting vulnerability in Schedule tab of Documents

    Published 20 Mar 2023 · Fixed in 10.5.19 · NVD, Project advisories (GitHub)
  43. High 8.8

    CVE-2023-27253 · pfSense

    A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.

    Published 17 Mar 2023 · NVD
  44. High 8.1

    CVE-2023-28112 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the Discourse server to private IP addresses. This affects any site running the `tests-passed` or `beta`…

    Published 17 Mar 2023 · Fixed in 3.1.0 · NVD
  45. High 7.5

    CVE-2023-28111 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, attackers are able to bypass Discourse's server-side request forgery (SSRF) protection for private IPv4 addresses by using a IPv4-mapped IPv6 address. The issue is patched in the latest beta and tests-passed version of Discourse. version 3.1.0.beta3 of the `beta` and…

    Published 17 Mar 2023 · Fixed in 3.1.0 · NVD
  46. Medium 4.9

    CVE-2023-28107 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.0.2 of the `stable` branch and version 3.1.0.beta3 of the `beta` and `tests-passed` branches, a user logged as an administrator can request backups multiple times, which will eat up all the connections to the DB. If this is done on a site using multisite, then it can affect the whole cluster. The vulnerability is patched in…

    Published 17 Mar 2023 · Fixed in 3.1.0 · NVD
  47. Medium 5.4

    CVE-2023-25172 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this…

    Published 17 Mar 2023 · Fixed in 3.0.1, 3.1.0 · NVD
  48. Medium 6.1

    CVE-2023-26040 · Discourse

    Discourse is an open-source discussion platform. Between versions 3.1.0.beta2 and 3.1.0.beta3 of the `tests-passed` branch, editing or responding to a chat message containing malicious content could lead to a cross-site scripting attack. This issue is patched in version 3.1.0.beta3 of the `tests-passed` branch. There are no known workarounds.

    Published 17 Mar 2023 · NVD
  49. Medium 4.3

    CVE-2023-23622 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, the count of topics displayed for a tag is a count of all regular topics regardless of whether the topic is in a read restricted category or not. As a result, any users can technically poll a sensitive tag to determine if a new topic is…

    Published 17 Mar 2023 · Fixed in 3.0.0 · NVD
  50. Critical 9.8

    CVE-2023-28531 · OpenSSH

    ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

    Published 17 Mar 2023 · Fixed in 9.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.