UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,054
Published in 7 days
640
Critical in 30 days
381
Actively exploited
421

Latest vulnerabilities

39,054 vulnerabilities
  1. Medium 5.4

    CVE-2022-46798 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-Site Request Forgery (CSRF)

    Published 6 Feb 2023 · Fixed in 2.5.2 · WPVulnerability
  2. High 8.8

    CVE-2023-0671 · Froxlor

    Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.

    Published 4 Feb 2023 · Fixed in 2.0.10 · NVD
  3. Medium 5.3

    CVE-2023-23615 · Discourse

    Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. As a workaround, disable embeddable comments by deleting all embeddable hosts.

    Published 3 Feb 2023 · NVD
  4. High 7.2

    CVE-2023-24029 · WS_FTP Server

    In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient authorization controls applied on user modification workflows.

    Published 3 Feb 2023 · Fixed in 8.8 · NVD
  5. High 8.1

    CVE-2023-22474 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features…

    Published 3 Feb 2023 · Fixed in 5.4.1 · NVD
  6. Critical 9.8

    CVE-2023-23477 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects. IBM X-Force ID: 245513.

    Published 3 Feb 2023 · NVD
  7. Medium 5.5

    CVE-2021-37519 · Memcached

    Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted authenticattion file.

    Published 3 Feb 2023 · NVD
  8. Critical 9.8

    CVE-2023-25139 · GNU C Library

    sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string.…

    Published 3 Feb 2023 · NVD
  9. Medium 6.5

    CVE-2023-25136 · OpenSSH

    OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

    Published 3 Feb 2023 · NVD
  10. Critical 9.8

    CVE-2023-25135 · vBulletin

    vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.

    Published 3 Feb 2023 · NVD
  11. Medium 4.3

    CVE-2023-23751 · Joomla!

    An issue was discovered in Joomla! 4.0.0 through 4.2.4. A missing ACL check allows non super-admin users to access com_actionlogs.

    Published 1 Feb 2023 · NVD
  12. Medium 6.3

    CVE-2023-23750 · Joomla!

    An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.

    Published 1 Feb 2023 · NVD
  13. High 7.5

    CVE-2023-23555 · F5 BIG-IP

    On BIG-IP Virtual Edition versions 15.1x beginning in 15.1.4 to before 15.1.8 and 14.1.x beginning in 14.1.5 to before 14.1.5.3, and BIG-IP SPK beginning in 1.5.0 to before 1.6.0, when FastL4 profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are…

    Published 1 Feb 2023 · Fixed in 14.1.5.3, 15.1.8 · NVD
  14. High 7.5

    CVE-2023-22842 · F5 BIG-IP

    On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 1 Feb 2023 · Fixed in 14.1.5.3, 15.1.8.1, 16.1.3.3 · NVD
  15. High 7.5

    CVE-2023-22839 · F5 BIG-IP

    On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profile with the Rapid Response Mode setting enabled is configured on a virtual server with hardware SYN cookies enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have…

    Published 1 Feb 2023 · Fixed in 15.1.7, 16.1.3.3, 17.0.0.2 · NVD
  16. High 7.5

    CVE-2023-22664 · F5 BIG-IP

    On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 1 Feb 2023 · Fixed in 16.1.3.3, 17.0.0.2 · NVD
  17. High 7.5

    CVE-2023-22422 · F5 BIG-IP

    On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, when a HTTP profile with the non-default Enforcement options of Enforce HTTP Compliance and Unknown Methods: Reject are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not…

    Published 1 Feb 2023 · Fixed in 16.1.3.3, 17.0.0.2 · NVD
  18. Medium 6.1

    CVE-2023-22418 · F5 BIG-IP

    On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious attacker to build an open redirect URI. Note: Software versions which have reached End of Technical Support…

    Published 1 Feb 2023 · Fixed in 15.1.7, 16.1.3.3, 17.0.0.2 · NVD
  19. High 8.5

    CVE-2023-22374 · F5 BIG-IP

    A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 1 Feb 2023 · NVD
  20. High 7.8

    CVE-2023-22358 · F5 BIG-IP

    In versions beginning with 7.2.2 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 1 Feb 2023 · Fixed in 7.2.3.1, 17.0.0.2 · NVD
  21. High 7.5

    CVE-2023-22341 · F5 BIG-IP

    On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel (TMM) to terminate: * An OAuth Server that references an OAuth Provider * An OAuth profile with the Authorization Endpoint set to '/' * An access profile that references the above OAuth profile…

    Published 1 Feb 2023 · Fixed in 14.1.5.3 · NVD
  22. High 7.5

    CVE-2023-22340 · F5 BIG-IP

    On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type virtual server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 1 Feb 2023 · Fixed in 15.1.8, 16.1.3.3, 17.0.0.2 · NVD
  23. Medium 4.9

    CVE-2023-22326 · F5 BIG-IP

    In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell (tmsh) dig command which may allow an authenticated attacker with resource administrator or administrator role privileges…

    Published 1 Feb 2023 · Fixed in 15.1.8.1, 16.1.3.3, 17.0.0.2 · NVD
  24. High 7.5

    CVE-2023-22323 · F5 BIG-IP

    In BIP-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when OCSP authentication profile is configured on a virtual server, undisclosed requests can cause an increase in CPU resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 1 Feb 2023 · Fixed in 15.1.8.1, 16.1.3.3, 17.0.0.2 · NVD
  25. Medium 5.9

    CVE-2023-22302 · F5 BIG-IP

    In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker’s control exist on the target pool member, undisclosed requests sent to the BIG-IP system can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of…

    Published 1 Feb 2023 · Fixed in 16.1.3.3, 17.0.0.2 · NVD
  26. Medium 6.5

    CVE-2023-22283 · F5 BIG-IP

    On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrative privileges are required to exploit this vulnerability because the victim user needs to run the executable on the system and the attacker requires administrative privileges for modifying the files in the trusted search path. Note:…

    Published 1 Feb 2023 · Fixed in 7.2.3.1, 17.0.0.2 · NVD
  27. Medium 5.4

    CVE-2023-23937 · Pimcore

    Missing file upload type validation in user profile

    Published 1 Feb 2023 · Fixed in 10.5.16 · NVD, Project advisories (GitHub)
  28. High 8.8

    CVE-2022-23498 · Grafana

    Use of Cache Containing Sensitive Information

    Published 1 Feb 2023 · Fixed in 9.2.10, 9.3.4 · NVD, Project advisories (GitHub)
  29. Low

    CVE-2022-24895 · Symfony

    Possible CSRF token fixation

    Published 1 Feb 2023 · Fixed in 6.0.20, 6.1.12, 6.2.6 · Project advisories (GitHub)
  30. Medium

    CVE-2022-24894 · Symfony

    Prevent storing cookie headers in HttpCache

    Published 1 Feb 2023 · Fixed in 6.0.20, 6.1.12, 6.2.6 · Project advisories (GitHub)
  31. High 7.6

    CVE-2023-23888 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Path Traversal

    Published 30 Jan 2023 · Fixed in 1.0.119.1 · WPVulnerability
  32. Medium 5.3

    CVE-2023-0572 · Froxlor

    Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.

    Published 29 Jan 2023 · Fixed in 2.0.10 · NVD
  33. Medium 4.8

    CVE-2023-0566 · Froxlor

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.

    Published 29 Jan 2023 · Fixed in 2.0.10 · NVD
  34. Medium 4.9

    CVE-2023-0565 · Froxlor

    Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.

    Published 29 Jan 2023 · Fixed in 2.0.10 · NVD
  35. High 7.5

    CVE-2023-0564 · Froxlor

    Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.

    Published 29 Jan 2023 · Fixed in 2.0.10 · NVD
  36. Medium 6.3

    CVE-2023-23629 · Metabase

    Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This allows someone with greater access to data to create a dashboard subscription, add people with fewer data privileges, and all recipients of that subscription…

    Published 28 Jan 2023 · Fixed in 1.43.7.1, 1.44.6.1, 1.45.2.1 · NVD
  37. Medium 4.1

    CVE-2023-23628 · Metabase

    Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the settings for a dashboard subscription, and another user has added users to that subscription, the…

    Published 28 Jan 2023 · Fixed in 1.43.7.1, 1.44.6.1, 1.45.2.1 · NVD
  38. Medium 5.3

    CVE-2023-23624 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches, someone can use the `exclude_tag param` to filter out topics and deduce which ones were using a specific hidden tag. This affects any Discourse site using hidden tags in public categories. This issue is patched in version 3.0.1 on the…

    Published 28 Jan 2023 · Fixed in 3.0.1 · NVD
  39. High 7.5

    CVE-2023-23621 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches, a malicious user can cause a regular expression denial of service using a carefully crafted user agent. This issue is patched in version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches.…

    Published 28 Jan 2023 · Fixed in 3.0.1 · NVD
  40. Medium 5.3

    CVE-2023-23620 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, the contents of latest/top routes for restricted tags can be accessed by unauthorized users. This issue is patched in version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches. There are no known workarounds.

    Published 28 Jan 2023 · Fixed in 3.0.1 · NVD
  41. Medium 4.3

    CVE-2023-23616 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, when submitting a membership request, there is no character limit for the reason provided with the request. This could potentially allow a user to flood the database with a large amount of data. However it is unlikely this could be used as part…

    Published 28 Jan 2023 · Fixed in 3.0.1 · NVD
  42. Critical 9.8

    CVE-2023-0232 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Deserialization of Untrusted Data

    Published 28 Jan 2023 · Fixed in 2.5.4 · WPVulnerability
  43. Medium 5.4

    CVE-2023-0231 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 28 Jan 2023 · Fixed in 2.5.4 · WPVulnerability
  44. Medium 5.4

    CVE-2022-23552 · Grafana

    Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized…

    Published 27 Jan 2023 · Fixed in 8.5.16, 9.2.10, 9.3.4 · NVD
  45. Medium 5.3

    CVE-2022-4255 · GitLab

    An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user email id through webhook payload.

    Published 27 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  46. High 7.5

    CVE-2022-4205 · GitLab

    In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash.

    Published 27 Jan 2023 · Fixed in 12.9.8, 15.5.5 · NVD
  47. Medium 5.3

    CVE-2022-4201 · GitLab

    A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.

    Published 27 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  48. Medium 4.3

    CVE-2022-4335 · GitLab

    A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which allows an attacker to connect to a local host.

    Published 27 Jan 2023 · Fixed in 15.4.6, 15.5.5, 15.6.1 · NVD
  49. Medium 5.4

    CVE-2022-48010 · LimeSurvey

    LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenulink?subaction=surveytexts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Welcome-message text fields. NOTE: the vendor indicates that this is not a…

    Published 27 Jan 2023 · NVD
  50. Critical 9.8

    CVE-2022-48008 · LimeSurvey

    An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file.

    Published 27 Jan 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.