UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,054
Published in 7 days
640
Critical in 30 days
381
Actively exploited
421

Latest vulnerabilities

39,054 vulnerabilities
  1. Medium 4.3

    CVE-2023-27481 · Directus

    Extract password hashes through export querying

    Published 7 Mar 2023 · Fixed in 9.16.0 · NVD, Project advisories (GitHub)
  2. High 8.6

    CVE-2022-4904 · c-ares

    A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

    Published 6 Mar 2023 · Fixed in 1.19.0 · NVD
  3. Critical 9.8

    CVE-2022-45141 · Samba

    Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).

    Published 6 Mar 2023 · Fixed in 4.15.13, 4.16.8 · NVD
  4. Medium 5.3

    CVE-2021-36403 · Moodle

    In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.

    Published 6 Mar 2023 · Fixed in 3.9.8, 3.10.5, 3.11.1 · NVD
  5. Medium 5.3

    CVE-2021-36402 · Moodle

    In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.

    Published 6 Mar 2023 · Fixed in 3.9.8, 3.10.5, 3.11.1 · NVD
  6. Medium 5.9

    CVE-2021-20251 · Samba

    A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met.

    Published 6 Mar 2023 · Fixed in 4.16.8, 4.17.4 · NVD
  7. Medium 4.8

    CVE-2021-36401 · Moodle

    In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk.

    Published 6 Mar 2023 · Fixed in 3.9.8, 3.10.5, 3.11.1 · NVD
  8. Medium 5.3

    CVE-2021-36400 · Moodle

    In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.

    Published 6 Mar 2023 · Fixed in 3.9.8, 3.10.5, 3.11.1 · NVD
  9. Medium 5.4

    CVE-2021-36399 · Moodle

    In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.

    Published 6 Mar 2023 · NVD
  10. Medium 5.4

    CVE-2021-36398 · Moodle

    In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.

    Published 6 Mar 2023 · NVD
  11. Medium 5.3

    CVE-2021-36397 · Moodle

    In Moodle, insufficient capability checks meant message deletions were not limited to the current user.

    Published 6 Mar 2023 · Fixed in 3.9.8, 3.10.5, 3.11.1 · NVD
  12. High 7.5

    CVE-2021-36396 · Moodle

    In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.

    Published 6 Mar 2023 · Fixed in 3.9.8, 3.10.5, 3.11.1 · NVD
  13. High 7.5

    CVE-2021-36395 · Moodle

    In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.

    Published 6 Mar 2023 · Fixed in 3.9.8, 3.10.5, 3.11.1 · NVD
  14. Critical 9.8

    CVE-2021-36394 · Moodle

    In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.

    Published 6 Mar 2023 · Fixed in 3.9.8, 3.10.5, 3.11.1 · NVD
  15. Critical 9.8

    CVE-2021-36393 · Moodle

    In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.

    Published 6 Mar 2023 · Fixed in 3.9.8, 3.10.5, 3.11.1 · NVD
  16. Critical 9.8

    CVE-2021-36392 · Moodle

    In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.

    Published 6 Mar 2023 · Fixed in 3.9.8, 3.10.5, 3.11.1 · NVD
  17. Medium 4.3

    CVE-2022-48364 · Mastodon

    The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the appeal of a user whose status update was marked as sensitive.

    Published 6 Mar 2023 · Fixed in 3.5.3 · NVD
  18. High 7.5

    CVE-2023-27474 · Directus

    HTML Injection in Password Reset email to custom Reset URL

    Published 6 Mar 2023 · Fixed in 9.23.0 · Project advisories (GitHub)
  19. Medium 5.4

    CVE-2023-0823 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 6 Mar 2023 · Fixed in 2.4.7 · WPVulnerability
  20. Medium 5.7

    CVE-2023-26510 · Ghost

    Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security policy in which a contributor's draft can only be read by editors until published by an editor. NOTE: the vendor's position is that this behavior has no security impact.

    Published 5 Mar 2023 · NVD
  21. Medium 5.3

    CVE-2023-25819 · Discourse

    Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the `tests-passed` or `beta` branches >= 3.1.0.beta2. The issue is patched in the latest `beta` and `tests-passed` version of Discourse.

    Published 4 Mar 2023 · Fixed in 3.1.0 · NVD
  22. Medium 5.4

    CVE-2023-23927 · Craft CMS

    Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7.

    Published 3 Mar 2023 · Fixed in 4.3.7 · NVD
  23. High 7.0

    CVE-2023-27561 · runc

    runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.

    Published 3 Mar 2023 · Fixed in 1.1.5 · NVD
  24. High 7.5

    CVE-2023-26492 · Directus

    SSRF On File Import

    Published 3 Mar 2023 · Fixed in 9.23.0 · NVD, Project advisories (GitHub)
  25. Low 3.7

    CVE-2022-41862 · PostgreSQL

    In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.

    Published 3 Mar 2023 · Fixed in 13.10, 14.7, 15.2 · NVD
  26. Unrated

    WPV-3b3b87c1baae · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 3 Mar 2023 · Fixed in 20.2.1 · WPVulnerability
  27. High 8.8

    CVE-2023-1101 · SonicWall SonicOS

    SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes.

    Published 2 Mar 2023 · Fixed in 7.0.1-5111 · NVD
  28. High 7.5

    CVE-2023-0656 · SonicWall SonicOS

    A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash.

    Published 2 Mar 2023 · NVD
  29. Medium 6.5

    CVE-2023-26481 · authentik

    Insufficient user check in FlowTokens by Email stage

    Published 2 Mar 2023 · Fixed in 2022.12.3, 2023.1.3, 2023.2.3 · NVD, Project advisories (GitHub)
  30. High 8.7

    CVE-2023-0264 · Keycloak

    User impersonation via stolen UUID code

    Published 2 Mar 2023 · Fixed in 21.0.1 · Project advisories (GitHub)
  31. Medium 6.5

    CVE-2023-25155 · Redis

    Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9.

    Published 2 Mar 2023 · Fixed in 6.0.18, 6.2.11, 7.0.9 · NVD
  32. Medium 5.4

    CVE-2023-22462 · Grafana

    Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due to React's render cycle that will pass though the…

    Published 2 Mar 2023 · Fixed in 9.2.10, 9.3.4 · NVD
  33. Unrated

    WPV-ce051045a72f · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 2 Mar 2023 · Fixed in 20.2.1 · WPVulnerability
  34. Medium 6.5

    CVE-2023-24400 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 2 Mar 2023 · Fixed in 2.4.7 · WPVulnerability
  35. High 8.8

    CVE-2022-3294 · Kubernetes

    Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates…

    Published 1 Mar 2023 · Fixed in 1.23.14, 1.24.8, 1.25.4 · NVD
  36. Medium 6.5

    CVE-2022-3162 · Kubernetes

    Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those…

    Published 1 Mar 2023 · NVD
  37. Medium 5.4

    CVE-2023-0594 · Grafana

    Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded. An attacker needs to have the…

    Published 1 Mar 2023 · Fixed in 8.5.21, 9.2.13, 9.3.8 · NVD
  38. Medium 5.4

    CVE-2023-0507 · Grafana

    Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible due to map attributions weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker…

    Published 1 Mar 2023 · Fixed in 8.5.21, 9.2.13, 9.3.8 · NVD
  39. Medium 5.5

    CVE-2022-36021 · Redis

    Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.

    Published 1 Mar 2023 · Fixed in 6.0.18, 6.2.11, 7.0.9 · NVD
  40. Medium 5.4

    CVE-2023-1117 · Pimcore

    Cross Site Scripting (XSS) in image/video thumbnail config

    Published 1 Mar 2023 · Fixed in 10.5.18 · NVD, Project advisories (GitHub)
  41. Medium 5.4

    CVE-2023-1116 · Pimcore

    Cross Site Scripting (XSS) in Email Blacklist

    Published 1 Mar 2023 · Fixed in 10.5.18 · NVD, Project advisories (GitHub)
  42. Medium 5.4

    CVE-2023-1115 · Pimcore

    Cross Site Scripting (XSS) in Documents Link Editable

    Published 1 Mar 2023 · Fixed in 10.5.18 · NVD, Project advisories (GitHub)
  43. Medium 4.8

    CVE-2023-22778 · HPE ArubaOS

    A vulnerability in the ArubaOS web management interface could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

    Published 1 Mar 2023 · NVD
  44. Medium 6.5

    CVE-2023-22777 · HPE ArubaOS

    An authenticated information disclosure vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system.

    Published 1 Mar 2023 · NVD
  45. Medium 4.9

    CVE-2023-22776 · HPE ArubaOS

    An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files.

    Published 1 Mar 2023 · NVD
  46. Medium 6.5

    CVE-2023-22775 · HPE ArubaOS

    A vulnerability exists which allows an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation could allow access to data beyond what is authorized by the users existing privilege level.

    Published 1 Mar 2023 · NVD
  47. Medium 6.5

    CVE-2023-22774 · HPE ArubaOS

    Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.

    Published 1 Mar 2023 · NVD
  48. Medium 6.5

    CVE-2023-22773 · HPE ArubaOS

    Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.

    Published 1 Mar 2023 · NVD
  49. Medium 6.5

    CVE-2023-22772 · HPE ArubaOS

    An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to delete arbitrary files in the underlying operating system.

    Published 1 Mar 2023 · NVD
  50. Low 2.4

    CVE-2023-22771 · HPE ArubaOS

    An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impacted account

    Published 1 Mar 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.