Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,054
- Published in 7 days
- 640
- Critical in 30 days
- 381
- Actively exploited
- 421
Latest vulnerabilities
39,054 vulnerabilities- High 7.2
CVE-2023-22770 · HPE ArubaOS
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - High 7.2
CVE-2023-22769 · HPE ArubaOS
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - High 7.2
CVE-2023-22768 · HPE ArubaOS
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - High 7.2
CVE-2023-22767 · HPE ArubaOS
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - High 7.2
CVE-2023-22766 · HPE ArubaOS
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - High 7.2
CVE-2023-22765 · HPE ArubaOS
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - High 7.2
CVE-2023-22764 · HPE ArubaOS
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - High 7.2
CVE-2023-22763 · HPE ArubaOS
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - High 7.2
CVE-2023-22762 · HPE ArubaOS
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - High 7.2
CVE-2023-22761 · HPE ArubaOS
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.
Published 1 Mar 2023 · NVD - High 7.2
CVE-2023-22760 · HPE ArubaOS
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.
Published 1 Mar 2023 · NVD - High 7.2
CVE-2023-22759 · HPE ArubaOS
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.
Published 1 Mar 2023 · NVD - High 7.2
CVE-2023-22758 · HPE ArubaOS
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.
Published 1 Mar 2023 · NVD - Critical 9.8
CVE-2023-22757 · HPE ArubaOS
There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - Critical 9.8
CVE-2023-22756 · HPE ArubaOS
There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - Critical 9.8
CVE-2023-22755 · HPE ArubaOS
There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - Critical 9.8
CVE-2023-22754 · HPE ArubaOS
There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - Critical 9.8
CVE-2023-22753 · HPE ArubaOS
There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - Critical 9.8
CVE-2023-22752 · HPE ArubaOS
There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - Critical 9.8
CVE-2023-22751 · HPE ArubaOS
There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - Critical 9.8
CVE-2023-22750 · HPE ArubaOS
There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - Critical 9.8
CVE-2023-22749 · HPE ArubaOS
There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - Critical 9.8
CVE-2023-22748 · HPE ArubaOS
There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - Critical 9.8
CVE-2023-22747 · HPE ArubaOS
There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Published 1 Mar 2023 · NVD - Medium 5.3
CVE-2023-20052 · ClamAV
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to enabling XML entity substitution that may result in…
Published 1 Mar 2023 · NVD - Critical 9.8
CVE-2023-20032 · ClamAV
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow…
Published 1 Mar 2023 · NVD - Medium 6.2
CVE-2023-0567 · PHP
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.
Published 1 Mar 2023 · Fixed in 8.0.28, 8.1.16, 8.2.3 · NVD - Critical 9.8
CVE-2023-27372 · SPIP
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
Published 28 Feb 2023 · Fixed in 3.2.18, 4.0.10, 4.1.8 · NVD - High 7.2
CVE-2023-27320 · sudo
Sudo before 1.9.13p2 has a double free in the per-command chroot feature.
Published 28 Feb 2023 · Fixed in 1.9.13 · NVD - Critical 9.8
CVE-2023-24258 · SPIP
SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter. This vulnerability allows attackers to execute arbitrary code via a crafted POST request.
Published 27 Feb 2023 · NVD - Low 2.7
CVE-2023-27266 · Mattermost
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
Published 27 Feb 2023 · Fixed in 7.7.0 · NVD - Low 2.7
CVE-2023-27265 · Mattermost
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
Published 27 Feb 2023 · Fixed in 7.7.0 · NVD - Medium 6.5
CVE-2023-27264 · Mattermost
A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbookID] API.
Published 27 Feb 2023 · NVD - Medium 6.5
CVE-2023-27263 · Mattermost
A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are not a member of.
Published 27 Feb 2023 · NVD - Medium 5.4
CVE-2023-1067 · Pimcore
Cross Site Scripting (XSS) in GDPR data extractor
Published 27 Feb 2023 · Fixed in 10.5.18 · NVD, Project advisories (GitHub) - Medium
CVE-2022-1274 · Keycloak
HTML Injection in Keycloak Admin REST API
Published 27 Feb 2023 · Fixed in 20.0.5 · Project advisories (GitHub) - Medium
CVE-2022-1438 · Keycloak
XSS on impersonation under specific circumstances
Published 27 Feb 2023 · Fixed in 20.0.5 · Project advisories (GitHub) - High
CVE-2022-4137 · Keycloak
Reflected XSS on OpenID connect login service
Published 27 Feb 2023 · Fixed in 20.0.5 · Project advisories (GitHub) - Low 3.3
CVE-2023-22636 · Fortinet FortiWeb
An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow a local attacker to access confidential configuration files via a crafted http request.
Published 27 Feb 2023 · NVD - Critical 9.8
CVE-2022-2024 · Gogs
OS Command Injection in repo editor on case-insensitive file systems
Published 25 Feb 2023 · Fixed in 0.12.11 · NVD, Project advisories (GitHub) - High 7.5
CVE-2023-26103 · Deno
Regular Expression Denial of Service in Deno.upgradeWebSocket API
Published 25 Feb 2023 · Fixed in 1.31.0 · NVD, Project advisories (GitHub) - High 8.8
CVE-2023-1033 · Froxlor
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11.
Published 25 Feb 2023 · Fixed in 2.0.11 · NVD - High 7.5
CVE-2023-25821 · Nextcloud
Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access Control. Secure view for internal shares can be circumvented if reshare permissions are also given. This issue is patched in versions 24.0.7 and 25.0.1. No workaround is available.
Published 25 Feb 2023 · Fixed in 24.0.7 · NVD - Medium 6.5
CVE-2023-25816 · Nextcloud
Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consumption. A user can configure a very long password, consuming more resources on password validation than desired. This issue is patched in 25.0.3 No workaround is available.
Published 25 Feb 2023 · Fixed in 25.0.3 · NVD - Medium 4.9
CVE-2022-4203 · OpenSSL
A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. The read buffer overrun might…
Published 24 Feb 2023 · Fixed in 3.0.8 · NVD - Medium 5.4
CVE-2023-0586 · All in One SEO
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting
Published 24 Feb 2023 · Fixed in 4.3.0 · WPVulnerability - Medium 4.8
CVE-2023-0585 · All in One SEO
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting
Published 24 Feb 2023 · Fixed in 4.3.0 · WPVulnerability - Medium 4.2
CVE-2023-23920 · Node.js
An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.
Published 23 Feb 2023 · Fixed in 16.19.1, 18.14.1, 19.6.1 · NVD - High 7.5
CVE-2023-23919 · Node.js
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.
Published 23 Feb 2023 · Fixed in 16.19.1, 18.14.1, 19.2.0 · NVD - High 7.5
CVE-2023-23918 · Node.js
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
Published 23 Feb 2023 · Fixed in 16.19.1, 18.14.1, 19.6.1 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.