Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,054
- Published in 7 days
- 640
- Critical in 30 days
- 381
- Actively exploited
- 421
Latest vulnerabilities
39,054 vulnerabilities- Medium 4.3
CVE-2023-23935 · Discourse
Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the `stable` branch and versions 3.1.0.beta2 and prior on the `beta` and `tests-passed` branches, the count of personal messages displayed for a tag is a count of all personal messages regardless of whether the personal message is visible to a given user. As a result, any users can technically poll a sensitive tag to…
Published 16 Mar 2023 · Fixed in 3.0.1 · NVD - High 7.8
CVE-2023-28108 · Pimcore
Improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model
Published 16 Mar 2023 · Fixed in 10.5.19 · NVD, Project advisories (GitHub) - Medium 4.8
CVE-2023-28106 · Pimcore
Cross-site Scripting (XSS) in UrlSlug Data type
Published 16 Mar 2023 · Fixed in 10.5.19 · NVD, Project advisories (GitHub) - Medium 5.4
CVE-2023-1429 · Pimcore
Cross-site Scripting (XSS) in Document Types
Published 16 Mar 2023 · Fixed in 10.5.19 · NVD, Project advisories (GitHub) - Medium 5.3
CVE-2023-28487 · sudo
Sudo before 1.9.13 does not escape control characters in sudoreplay output.
Published 16 Mar 2023 · Fixed in 1.9.13 · NVD - Medium 5.3
CVE-2023-28486 · sudo
Sudo before 1.9.13 does not escape control characters in log messages.
Published 16 Mar 2023 · Fixed in 1.9.13 · NVD - Unrated
WPV-e92602f78438 · UpdraftPlus
Vulnerability in UpdraftPlus: WP Backup & Migration Plugin
Published 16 Mar 2023 · WPVulnerability - Unrated
WPV-8057ee50410d · UpdraftPlus
Vulnerability in UpdraftPlus: WP Backup & Migration Plugin
Published 16 Mar 2023 · WPVulnerability - Unrated
WPV-555fd61b91e3 · UpdraftPlus
Vulnerability in UpdraftPlus: WP Backup & Migration Plugin
Published 16 Mar 2023 · WPVulnerability - Medium 6.1
CVE-2023-1421 · Mattermost
A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a crafted link with a malicious state parameter.
Published 15 Mar 2023 · Fixed in 7.7.0 · NVD - Medium 5.3
CVE-2023-25695 · Apache Airflow
Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2.
Published 15 Mar 2023 · Fixed in 2.5.2 · NVD - High 7.2
CVE-2023-26262 · Sitecore Experience Platform
An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content management (CM) server.
Published 14 Mar 2023 · Fixed in 10.3 · NVD - Medium 6.5
CVE-2023-27589 · MinIO
Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with `consoleAdmin` permissions can potentially create a user that matches the root credential `accessKey`. Once this user is created successfully, the root credential ceases to work appropriately. The issue is patched in RELEASE.2023-03-13T19-46-17Z.…
Published 14 Mar 2023 · Fixed in 2023-03-13t19-46-17z · NVD - High 8.8
CVE-2023-25170 · PrestaShop
Possible CSRF token fixation
Published 13 Mar 2023 · Fixed in 8.0.1 · NVD, Project advisories (GitHub) - High 8.1
CVE-2023-24999 · HashiCorp Vault
HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.
Published 11 Mar 2023 · Fixed in 1.10.11, 1.11.8, 1.12.4 · NVD - High 7.5Actively exploited
CVE-2023-27532 · Veeam Backup & Replication
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
Published 10 Mar 2023 · Fixed in 11.0.1.1261 · NVD - High 7.5
CVE-2023-23911 · Rocket.Chat
An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of a chat room by a user changing the group key of a chat room.
Published 10 Mar 2023 · Fixed in 6.0.0 · NVD - Medium 5.3
CVE-2023-27904 · Jenkins
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.
Published 10 Mar 2023 · Fixed in 2.375.4, 2.394 · NVD - Medium 4.4
CVE-2023-27903 · Jenkins
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used.
Published 10 Mar 2023 · Fixed in 2.375.4, 2.394 · NVD - Medium 4.3
CVE-2023-27902 · Jenkins
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission to access their contents.
Published 10 Mar 2023 · Fixed in 2.375.4, 2.394 · NVD - High 7.5
CVE-2023-27901 · Jenkins
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service.
Published 10 Mar 2023 · Fixed in 2.375.4, 2.394 · NVD - High 7.5
CVE-2023-27900 · Jenkins
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service.
Published 10 Mar 2023 · Fixed in 2.375.4, 2.394 · NVD - High 7.0
CVE-2023-27899 · Jenkins
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a plugin for installation, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used, potentially resulting in arbitrary code execution.
Published 10 Mar 2023 · Fixed in 2.375.4, 2.394 · NVD - Critical 9.6
CVE-2023-27898 · Jenkins
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have…
Published 10 Mar 2023 · Fixed in 2.375.4, 2.394 · NVD - High 7.5
CVE-2023-26464 · Apache Log4j
** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service…
Published 10 Mar 2023 · Fixed in 2.0 · NVD - Medium 4.8
CVE-2023-1312 · Pimcore
Reflected XSS in Application Logger module
Published 10 Mar 2023 · Fixed in 10.5.19 · NVD, Project advisories (GitHub) - Critical 9.8
CVE-2023-1307 · Froxlor
Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.
Published 10 Mar 2023 · Fixed in 2.0.13 · NVD - Medium 5.4
CVE-2022-3758 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Due to improper permissions checks an unauthorised user was able to read, add or edit a users private snippet.
Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD - Medium 5.3
CVE-2023-1072 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible to trigger a resource depletion attack due to improper filtering for number of requests to read commits details.
Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD - Medium 5.4
CVE-2023-0050 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.
Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD - High 7.3
CVE-2022-4331 · GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. If a group with SAML SSO enabled is transferred to a new namespace as a child group, it's possible previously removed malicious maintainer or owner of the child group can still gain access to the group via…
Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD - Medium 5.3
CVE-2023-0223 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Non-project members could retrieve release descriptions via the API, even if the release visibility is restricted to project members only in the project settings.
Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD - Medium 4.3
CVE-2022-4289 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users.
Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD - Medium 6.1
CVE-2022-3381 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 10.0 to 15.7.8, 15.8 prior to 15.8.4 and 15.9 prior to 15.9.2. A crafted URL could be used to redirect users to arbitrary sites
Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD - Low 2.7
CVE-2023-1084 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A malicious project Maintainer may create a Project Access Token with Owner level privileges using a crafted request.
Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD - Low 3.8
CVE-2023-0483 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible for a project maintainer to extract a Datadog integration API key by modifying the site.
Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD - Medium 4.3
CVE-2022-4462 · GitLab
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. This vulnerability could allow a user to unmask the Discord Webhook URL through viewing the raw API response.
Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD - Medium 4.8
CVE-2023-1286 · Pimcore
Cross-site Scripting (XSS) - stored in Print Documents
Published 9 Mar 2023 · Fixed in 10.5.19 · NVD, Project advisories (GitHub) - Unrated
WPV-f024881a8f30 · UpdraftPlus
Vulnerability in UpdraftPlus: WP Backup & Migration Plugin
Published 9 Mar 2023 · Fixed in 1.23.1 · WPVulnerability - Unrated
WPV-2924c420eb27 · UpdraftPlus
Vulnerability in UpdraftPlus: WP Backup & Migration Plugin
Published 9 Mar 2023 · Fixed in 1.23.1 · WPVulnerability - Medium 6.1
CVE-2022-4007 · GitLab
A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 prior to 15.9.2 A cross-site scripting vulnerability was found in the title field of work items that allowed attackers to perform arbitrary actions on behalf of victims at client side.
Published 8 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD - Unrated
WPV-b12b946beb1d · UpdraftPlus
Vulnerability in UpdraftPlus: WP Backup & Migration Plugin
Published 8 Mar 2023 · Fixed in 1.23.1 · WPVulnerability - Medium 6.5
CVE-2022-45861 · Fortinet FortiProxy, Fortinet FortiOS
An access of uninitialized pointer vulnerability [CWE-824] in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through 7.2.1, version 7.0.0 through 7.0.7 and before 2.0.11 allows a remote authenticated attacker to crash the sslvpn daemon via an HTTP GET request.
Published 7 Mar 2023 · NVD - High 8.2
CVE-2022-42476 · Fortinet FortiProxy, Fortinet FortiOS
A relative path traversal vulnerability [CWE-23] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.12, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, FortiProxy 2.0.0 through 2.0.11, FortiProxy 1.2 all versions, FortiProxy 01.02 all versions, FortiProxy 1.1 all versions, FortiProxy 01.01…
Published 7 Mar 2023 · NVD - Medium 5.3
CVE-2022-41329 · Fortinet FortiProxy, Fortinet FortiOS
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiOS version 7.2.0 through 7.2.3 and 7.0.0 through 7.0.9 allows an unauthenticated attackers to obtain sensitive logging informations on the device via crafted HTTP GET requests.
Published 7 Mar 2023 · NVD - High 7.1Actively exploited
CVE-2022-41328 · Fortinet FortiOS
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.
Published 7 Mar 2023 · Fixed in 6.4.12, 7.0.10, 7.2.4 · NVD - High 8.8
CVE-2022-39951 · Fortinet FortiWeb
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Published 7 Mar 2023 · NVD - Medium 5.5
CVE-2022-22297 · Fortinet FortiWeb
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder version 6.4.0 through 6.4.3, FortiRecorder all versions 6.0, FortiRecorder all versions 2.7 may…
Published 7 Mar 2023 · NVD - High 7.5
CVE-2023-27522 · Apache HTTP Server
HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.
Published 7 Mar 2023 · Fixed in 2.4.56 · NVD - Critical 9.8
CVE-2023-25690 · Apache HTTP Server
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using…
Published 7 Mar 2023 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.