UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,054
Published in 7 days
640
Critical in 30 days
381
Actively exploited
421

Latest vulnerabilities

39,054 vulnerabilities
  1. High 7.8

    CVE-2023-21808 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 14 Feb 2023 · NVD
  2. High 7.2

    CVE-2023-21710 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 14 Feb 2023 · NVD
  3. High 8.8

    CVE-2023-21707 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 14 Feb 2023 · NVD
  4. High 8.8

    CVE-2023-21706 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 14 Feb 2023 · NVD
  5. High 8.8Actively exploited

    CVE-2023-21529 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 14 Feb 2023 · NVD
  6. Critical 9.1

    CVE-2023-25725 · HAProxy

    HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3,…

    Published 14 Feb 2023 · Fixed in 2.5.12, 2.6.9, 2.7.3 · NVD
  7. Medium 4.3

    CVE-2023-22942 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a potential attacker update SSG KV store collections using an HTTP GET request.

    Published 14 Feb 2023 · Fixed in 8.1.13, 8.2.10, 9.0.4 · NVD
  8. High 7.5

    CVE-2023-22941 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd).

    Published 14 Feb 2023 · Fixed in 8.1.13, 8.2.10, 9.0.4 · NVD
  9. Medium 5.7

    CVE-2023-22940 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, aliases of the ‘collect’ search processing language (SPL) command, including ‘summaryindex’, ‘sumindex’, ‘stash’,’ mcollect’, and ‘meventcollect’, were not designated as safeguarded commands. The commands could potentially allow for the exposing of data to a summary index that unprivileged users could access. The vulnerability…

    Published 14 Feb 2023 · Fixed in 8.1.13, 8.2.10, 9.0.4 · NVD
  10. High 8.8

    CVE-2023-22939 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘map’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects instances with Splunk Web enabled.

    Published 14 Feb 2023 · Fixed in 8.1.13, 8.2.10, 9.0.4 · NVD
  11. Medium 4.3

    CVE-2023-22938 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance. The endpoint is now restricted to the ‘splunk-system-user’ account on the local instance.

    Published 14 Feb 2023 · Fixed in 8.1.13, 8.2.10, 9.0.4 · NVD
  12. Medium 4.3

    CVE-2023-22937 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table upload feature let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now be one of the following only: .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gzl.

    Published 14 Feb 2023 · Fixed in 8.1.13, 8.2.10, 9.0.4 · NVD
  13. Medium 6.3

    CVE-2023-22936 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘search_listener’ parameter in a search allows for a blind server-side request forgery (SSRF) by an authenticated user. The initiator of the request cannot see the response without the presence of an additional vulnerability within the environment.

    Published 14 Feb 2023 · Fixed in 8.1.13, 8.2.10, 9.0.4 · NVD
  14. High 8.8

    CVE-2023-22935 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘display.page.search.patterns.sensitivity’ search parameter lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request within their browser and only affects instances with Splunk Web enabled.

    Published 14 Feb 2023 · Fixed in 8.1.13, 8.2.10, 9.0.4 · NVD
  15. High 8.0

    CVE-2023-22934 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets a search bypass SPL safeguards for risky commands using a saved search job. The vulnerability requires an authenticated user to craft the saved job and a higher privileged user to initiate a request within their browser.

    Published 14 Feb 2023 · Fixed in 8.1.13, 8.2.10, 9.0.4 · NVD
  16. Medium 6.1

    CVE-2023-22933 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting (XSS) in an extensible mark-up language (XML) View through the ‘layoutPanel’ attribute in the ‘module’ tag’.

    Published 14 Feb 2023 · Fixed in 8.1.13, 8.2.10, 9.0.4 · NVD
  17. Medium 6.1

    CVE-2023-22932 · Splunk Enterprise

    In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting (XSS) through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0.

    Published 14 Feb 2023 · Fixed in 9.0.4 · NVD
  18. Medium 4.3

    CVE-2023-22931 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions. This feature has been deprecated and disabled by default.

    Published 14 Feb 2023 · Fixed in 8.1.13, 8.2.10 · NVD
  19. Medium 5.4

    CVE-2023-0827 · Pimcore

    Cross Site Scripting (XSS) in Model\DataObject\Data\UrlSlug

    Published 14 Feb 2023 · Fixed in 1.5.17, 10.5.17 · NVD, Project advisories (GitHub)
  20. Medium 5.4

    CVE-2022-46805 · Conditional Payments For Woocommerce (WordPress plugin)

    Conditional Payments for WooCommerce: Cross-Site Request Forgery (CSRF)

    Published 14 Feb 2023 · Fixed in 2.3.2 · WPVulnerability
  21. High 7.5

    CVE-2023-0518 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. It was possible to trigger a DoS attack by uploading a malicious Helm chart.

    Published 13 Feb 2023 · Fixed in 15.6.7, 15.7.6, 15.8.1 · NVD
  22. High 8.1

    CVE-2022-4138 · GitLab

    A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a malicious project.

    Published 13 Feb 2023 · Fixed in 15.6.7, 15.7.6, 15.8.1 · NVD
  23. High 7.5

    CVE-2022-3759 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child pipelines and make a sidekiq job allocate a lot of memory. In GitLab instances where Sidekiq is…

    Published 13 Feb 2023 · Fixed in 15.6.7, 15.7.6, 15.8.1 · NVD
  24. Medium 6.5

    CVE-2022-3411 · GitLab

    A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.

    Published 13 Feb 2023 · Fixed in 15.6.7, 15.7.6, 15.8.1 · NVD
  25. High 8.8

    CVE-2023-25240 · Pimcore

    An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.

    Published 13 Feb 2023 · NVD
  26. Medium 5.3

    CVE-2023-25162 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.0.12 are vulnerable to server-side request forgery (SSRF). Attackers can leverage enclosed alphanumeric payloads to bypass IP filters and gain SSRF, which would allow an attacker to read crucial…

    Published 13 Feb 2023 · Fixed in 23.0.12, 24.0.8 · NVD
  27. Medium 5.3

    CVE-2023-25161 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage overflow, or cost impact when using external email services. Users should upgrade to Nextcloud Server…

    Published 13 Feb 2023 · Fixed in 23.0.12, 24.0.8 · NVD
  28. Medium 5.3

    CVE-2023-25159 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the same platform. Nextcloud Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, Nextcloud Enterprise Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, and Nextcloud Office (Richdocuments) App 6.x prior to 6.3.1 and 7.x prior to…

    Published 13 Feb 2023 · NVD
  29. Medium 6.3

    CVE-2023-25811 · Uptime Kuma

    Persistent XSS through "new status page --> name"

    Published 13 Feb 2023 · Fixed in 1.20.0 · Project advisories (GitHub)
  30. Medium 6.3

    CVE-2023-25810 · Uptime Kuma

    Persistent XSS through description in status page

    Published 13 Feb 2023 · Fixed in 1.20.0 · Project advisories (GitHub)
  31. Medium 5.4

    CVE-2023-25727 · phpMyAdmin

    In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.

    Published 13 Feb 2023 · Fixed in 4.9.11, 5.2.1 · NVD
  32. Medium 5.9

    CVE-2022-43552 · curl

    A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.

    Published 9 Feb 2023 · Fixed in 7.87.0 · NVD
  33. Medium 6.5

    CVE-2023-25163 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error message is visible when a user attempts to create or update an Application via the Argo CD API (and…

    Published 8 Feb 2023 · NVD
  34. Medium 6.5

    CVE-2022-38778 · Kibana

    A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process.

    Published 8 Feb 2023 · Fixed in 7.17.9, 8.6.1 · NVD
  35. Medium 5.7

    CVE-2023-25167 · Discourse

    Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service using a carefully crafted git URL. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this issue.

    Published 8 Feb 2023 · Fixed in 3.0.1 · NVD
  36. High 7.5

    CVE-2023-0401 · OpenSSL

    A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to…

    Published 8 Feb 2023 · NVD
  37. High 7.4

    CVE-2023-0286 · OpenSSL

    There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.…

    Published 8 Feb 2023 · Fixed in 1.0.2zg, 1.1.1t, 3.0.8 · NVD
  38. High 7.5

    CVE-2023-0217 · OpenSSL

    An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not…

    Published 8 Feb 2023 · NVD
  39. High 7.5

    CVE-2023-0216 · OpenSSL

    An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these…

    Published 8 Feb 2023 · NVD
  40. High 7.5

    CVE-2023-0215 · OpenSSL

    The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then…

    Published 8 Feb 2023 · Fixed in 1.0.2zg, 1.1.1t, 3.0.8 · NVD
  41. High 7.5

    CVE-2022-4450 · OpenSSL

    The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file…

    Published 8 Feb 2023 · Fixed in 1.1.1t, 3.0.8 · NVD
  42. Medium 5.9

    CVE-2022-4304 · OpenSSL

    A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For…

    Published 8 Feb 2023 · Fixed in 1.0.2zg, 1.1.1t, 3.0.8 · NVD
  43. Medium 6.1

    CVE-2023-24814 · TYPO3

    Persisted Cross-Site Scripting in Frontend Rendering

    Published 7 Feb 2023 · Fixed in 10.4.36, 11.5.23, 12.2.0 · NVD, Project advisories (GitHub)
  44. Unrated

    WPV-062373c65986 · WP Optimize (WordPress plugin)

    Vulnerability in WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance

    Published 7 Feb 2023 · Fixed in 3.2.12 · WPVulnerability
  45. Medium 6.1

    CVE-2022-28923 · Caddy

    Open Redirect in Caddy

    Published 6 Feb 2023 · Fixed in 2.5.0-beta.1 · NVD, OSV.dev and GitHub
  46. Medium 6.5

    CVE-2022-44268 · ImageMagick

    ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it).

    Published 6 Feb 2023 · NVD
  47. Medium 6.5

    CVE-2022-44267 · ImageMagick

    ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input.

    Published 6 Feb 2023 · NVD
  48. High 7.2Actively exploited

    CVE-2023-0669 · GoAnywhere MFT

    Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

    Published 6 Feb 2023 · Fixed in 7.1.2 · NVD
  49. Critical 9.8

    CVE-2023-0687 · GNU C Library

    A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability…

    Published 6 Feb 2023 · Fixed in 2.38 · NVD
  50. Unrated

    WPV-a7e30dbe1f41 · WP Optimize (WordPress plugin)

    Vulnerability in WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance

    Published 6 Feb 2023 · Fixed in 3.2.12 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.