UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,054
Published in 7 days
640
Critical in 30 days
381
Actively exploited
421

Latest vulnerabilities

39,054 vulnerabilities
  1. High 8.8

    CVE-2023-23917 · Rocket.Chat

    A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may increase the impact of XSS to RCE which is dangerous for self-hosted users as well.

    Published 23 Feb 2023 · Fixed in 5.2.0 · NVD
  2. Medium 6.5

    CVE-2023-23916 · curl

    An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a…

    Published 23 Feb 2023 · Fixed in 7.88.0 · NVD
  3. Medium 6.5

    CVE-2023-23915 · curl

    A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when…

    Published 23 Feb 2023 · Fixed in 7.88.0 · NVD
  4. Critical 9.1

    CVE-2023-23914 · curl

    A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent…

    Published 23 Feb 2023 · Fixed in 7.88.0 · NVD
  5. Medium 6.1

    CVE-2022-48344 · TeamCity

    In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.

    Published 23 Feb 2023 · Fixed in 2022.10.2 · NVD
  6. Medium 6.1

    CVE-2022-48343 · TeamCity

    In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.

    Published 23 Feb 2023 · Fixed in 2022.10.2 · NVD
  7. Critical 9.8

    CVE-2022-48342 · TeamCity

    In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.

    Published 23 Feb 2023 · Fixed in 2022.10.2 · NVD
  8. Medium 6.1

    CVE-2022-29273 · pfSense

    pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.

    Published 22 Feb 2023 · Fixed in 22.05 · NVD
  9. High 7.5

    CVE-2023-25579 · Nextcloud

    Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing the string in the wrong order. The function is used in the `newFile()` and `newFolder()` items, which may allow to creation of paths outside of ones own space and overwriting data from other users with crafted paths. This issue has been…

    Published 22 Feb 2023 · Fixed in 23.0.12, 24.0.8, 25.0.2 · NVD
  10. Medium 5.9

    GHSA-7xv4-ggpj-g48q · Frappe Framework

    Weak authentication when accessing print view using key

    Published 22 Feb 2023 · Fixed in 13.32.0 · Project advisories (GitHub)
  11. High 8.5

    GHSA-f939-v9q6-j3wg · Frappe Framework

    Improper Access Control for Email Templates

    Published 22 Feb 2023 · Fixed in 13.46.3, 14.21.1 · Project advisories (GitHub)
  12. Medium 6.1

    CVE-2022-38779 · Kibana

    An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.

    Published 22 Feb 2023 · Fixed in 7.17.9, 8.6.2 · NVD
  13. High 8.8

    CVE-2023-25812 · MinIO

    Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Governance-Retention: true`. However, this was not honored instead the request will be honored and an object under governance would be…

    Published 21 Feb 2023 · Fixed in 2023-02-17t17-52-43z · NVD
  14. High 8.2

    CVE-2023-23923 · Moodle

    The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

    Published 17 Feb 2023 · Fixed in 3.9.19, 3.11.12, 4.0.6 · NVD
  15. Medium 6.1

    CVE-2023-23922 · Moodle

    The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.

    Published 17 Feb 2023 · Fixed in 4.0.6 · NVD
  16. Medium 6.1

    CVE-2023-23921 · Moodle

    The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.

    Published 17 Feb 2023 · Fixed in 3.9.19, 3.11.12, 4.0.6 · NVD
  17. High 7.5

    CVE-2022-20803 · ClamAV

    A vulnerability in the OLE2 file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device.The vulnerability is due to incorrect use of the realloc function that may result in a double-free. An attacker could exploit this vulnerability by submitting a crafted OLE2 file to be…

    Published 17 Feb 2023 · Fixed in 0.104.3 · NVD
  18. High 7.5

    CVE-2023-24329 · Python

    An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

    Published 17 Feb 2023 · Fixed in 3.9.17, 3.10.12, 3.11.4 · NVD
  19. High 8.8

    CVE-2023-0877 · Froxlor

    Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.

    Published 17 Feb 2023 · Fixed in 2.0.11 · NVD
  20. High 7.8

    CVE-2023-25602 · Fortinet FortiWeb

    A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions 6.2.6 and earlier, FortiWeb versions 6.1.2 and earlier, FortiWeb versions 6.0.7 and earlier, FortiWeb versions 5.9.1 and earlier, FortiWeb 5.8 all versions, FortiWeb 5.7 all versions, FortiWeb 5.6 all versions allows attacker to execute unauthorized code or commands via…

    Published 16 Feb 2023 · Fixed in 6.1.3, 6.2.7, 6.3.18 · NVD
  21. Medium 6.5

    CVE-2023-23784 · Fortinet FortiWeb

    A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to information disclosure via specially crafted web requests.

    Published 16 Feb 2023 · Fixed in 6.3.21, 7.0.3 · NVD
  22. High 7.8

    CVE-2023-23783 · Fortinet FortiWeb

    A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments.

    Published 16 Feb 2023 · Fixed in 6.4.2, 7.0.2 · NVD
  23. High 7.8

    CVE-2023-23782 · Fortinet FortiWeb

    A heap-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb version 6.3.0 through 6.3.19, FortiWeb 6.4 all versions, FortiWeb 6.2 all versions, FortiWeb 6.1 all versions allows attacker to escalation of privilege via specifically crafted arguments to existing commands.

    Published 16 Feb 2023 · Fixed in 6.3.20, 7.0.2 · NVD
  24. High 8.8

    CVE-2023-23781 · Fortinet FortiWeb

    A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below SAML server configuration may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted XML files.

    Published 16 Feb 2023 · Fixed in 6.3.20, 7.0.2 · NVD
  25. High 8.8

    CVE-2023-23780 · Fortinet FortiWeb

    A stack-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, Fortinet FortiWeb version 6.3.6 through 6.3.19, Fortinet FortiWeb 6.4 all versions allows attacker to escalation of privilege via specifically crafted HTTP requests.

    Published 16 Feb 2023 · Fixed in 6.3.20, 7.0.2 · NVD
  26. High 8.8

    CVE-2023-23779 · Fortinet FortiWeb

    Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.

    Published 16 Feb 2023 · NVD
  27. Medium 6.5

    CVE-2023-23778 · Fortinet FortiWeb

    A relative path traversal vulnerability [CWE-23] in FortiWeb version 7.0.1 and below, 6.4 all versions, 6.3 all versions, 6.2 all versions may allow an authenticated user to obtain unauthorized access to files and data via specifically crafted web requests.

    Published 16 Feb 2023 · NVD
  28. Medium 5.4

    CVE-2022-42472 · Fortinet FortiProxy, Fortinet FortiOS

    A improper neutralization of crlf sequences in http headers ('http response splitting') vulnerability in Fortinet FortiOS 7.2.0 through 7.2.2, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.12, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, FortiProxy 2.0.0 through 2.0.10, FortiProxy 1.2 all versions, FortiProxy 01.02…

    Published 16 Feb 2023 · NVD
  29. High 8.1

    CVE-2022-41335 · Fortinet FortiProxy, Fortinet FortiOS

    A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2.0 through 7.2.1, 7.0.0 through 7.0.7 and before 2.0.10, FortiSwitchManager 7.2.0 and before 7.0.0 allows an authenticated attacker to read and write files on the underlying Linux system via crafted HTTP requests.

    Published 16 Feb 2023 · NVD
  30. Medium 6.1

    CVE-2022-41334 · Fortinet FortiOS

    An improper neutralization of input during web page generation [CWE-79] vulnerability in FortiOS versions 7.0.0 to 7.0.7 and 7.2.0 to 7.2.3 may allow a remote, unauthenticated attacker to launch a cross site scripting (XSS) attack via the "redir" parameter of the URL seen when the "Sign in with FortiCloud" button is clicked.

    Published 16 Feb 2023 · NVD
  31. High 7.8

    CVE-2022-40683 · Fortinet FortiWeb

    A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauthorized code or commands via specially crafted commands

    Published 16 Feb 2023 · NVD
  32. High 7.4

    CVE-2022-39948 · Fortinet FortiProxy, Fortinet FortiOS

    An improper certificate validation vulnerability [CWE-295] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions and FortiProxy 7.0.0 through 7.0.6, 2.0 all versions, 1.2 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the FortiOS/FortiProxy device and…

    Published 16 Feb 2023 · Fixed in 7.0.7, 7.0.8, 7.2.4 · NVD
  33. Medium 6.0

    CVE-2022-38378 · Fortinet FortiProxy, Fortinet FortiOS

    An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an attacker that has access to the admin profile section (System subsection Administrator Users) to modify their own profile and upgrade their privileges to Read Write via CLI or GUI commands.

    Published 16 Feb 2023 · Fixed in 7.0.8, 7.2.1, 7.2.2 · NVD
  34. High 7.2

    CVE-2022-33871 · Fortinet FortiWeb

    A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and earlier, 6.4 all versions, version 6.3.19 and earlier may allow a privileged attacker to execute arbitrary code or commands via specifically crafted CLI `execute backup-local rename` and `execute backup-local show` operations.

    Published 16 Feb 2023 · Fixed in 6.3.20 · NVD
  35. High 8.8

    CVE-2022-30306 · Fortinet FortiWeb

    A stack-based buffer overflow vulnerability [CWE-121] in the CA sign functionality of FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted password.

    Published 16 Feb 2023 · Fixed in 6.3.20 · NVD
  36. High 8.8

    CVE-2022-30303 · Fortinet FortiWeb

    An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions may allow an authenticated attacker to execute arbitrary shell code as `root` user via crafted HTTP requests.

    Published 16 Feb 2023 · Fixed in 6.3.20 · NVD
  37. Medium 6.5

    CVE-2022-30300 · Fortinet FortiWeb

    A relative path traversal vulnerability [CWE-23] in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, 6.4 all versions may allow an authenticated attacker to obtain unauthorized access to files and data via specifically crafted HTTP GET requests.

    Published 16 Feb 2023 · Fixed in 6.3.19 · NVD
  38. Medium 4.3

    CVE-2022-30299 · Fortinet FortiWeb

    A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions may allow an authenticated attacker to retrieve specific parts of files from the underlying file system via specially crafted web requests.

    Published 16 Feb 2023 · Fixed in 6.3.20 · NVD
  39. Low 3.3

    CVE-2022-29054 · Fortinet FortiProxy, Fortinet FortiOS

    A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it.

    Published 16 Feb 2023 · Fixed in 7.0.8 · NVD
  40. High 7.5

    CVE-2022-26115 · Fortinet FortiSandbox

    A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords.

    Published 16 Feb 2023 · NVD
  41. Medium 4.3

    CVE-2021-43074 · Fortinet FortiProxy, Fortinet FortiWeb, Fortinet FortiOS

    An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all…

    Published 16 Feb 2023 · Fixed in 7.0.0, 7.0.2, 7.0.4 · NVD
  42. Critical 9.8

    CVE-2021-42761 · Fortinet FortiWeb

    A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session identifier of other users and possibly usurp their session.

    Published 16 Feb 2023 · Fixed in 6.2.7, 6.3.17, 7.0.0 · NVD
  43. Critical 9.8

    CVE-2021-42756 · Fortinet FortiWeb

    Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests.

    Published 16 Feb 2023 · Fixed in 6.1.3, 6.2.7, 6.3.17 · NVD
  44. High 8.5

    CVE-2023-23947 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All Argo CD versions starting with 2.3.0-rc1 and prior to 2.3.17, 2.4.23 2.5.11, and 2.6.2 are vulnerable to an improper authorization bug which allows users who have the ability to update at least one cluster secret to update any cluster secret. The attacker could use this access to escalate privileges (potentially…

    Published 16 Feb 2023 · Fixed in 2.4.23, 2.5.11, 2.6.2 · NVD
  45. Medium 5.4

    CVE-2023-23936 · Node.js

    Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.

    Published 16 Feb 2023 · Fixed in 16.19.1, 18.14.1, 19.6.1 · NVD
  46. Medium 5.3Actively exploited

    CVE-2023-23752 · Joomla!

    An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

    Published 16 Feb 2023 · Fixed in 4.2.8 · NVD
  47. High 7.5

    CVE-2023-0662 · PHP

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space.

    Published 16 Feb 2023 · Fixed in 8.0.28, 8.1.16, 8.2.3 · NVD
  48. High 8.1

    CVE-2023-0568 · PHP

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.

    Published 16 Feb 2023 · Fixed in 8.0.28, 8.1.16, 8.2.3 · NVD
  49. High 7.8

    CVE-2023-25173 · containerd

    Supplementary groups are not set up properly

    Published 16 Feb 2023 · Fixed in 1.5.18, 1.6.18 · NVD, Project advisories (GitHub)
  50. Medium 5.5

    CVE-2023-25153 · containerd

    OCI image importer memory exhaustion

    Published 16 Feb 2023 · Fixed in 1.5.18, 1.6.18 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.