UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,062
Published in 7 days
645
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,062 vulnerabilities
  1. Critical 9.8

    CVE-2023-22732 · Shopware

    Insufficient Session Expiration in Administration

    Published 17 Jan 2023 · Fixed in 6.4.18.1 · NVD, Project advisories (GitHub)
  2. High 8.8

    CVE-2023-22731 · Shopware

    Improper Control of Generation of Code in Twig rendered views

    Published 17 Jan 2023 · Fixed in 6.4.18.1 · NVD, Project advisories (GitHub)
  3. High 7.5

    CVE-2023-22730 · Shopware

    Improper Input Validation of Clearance sale in cart

    Published 17 Jan 2023 · Fixed in 6.4.18.1 · NVD, Project advisories (GitHub)
  4. High 7.5

    CVE-2023-22499 · Deno

    Interactive permission prompt spoofing

    Published 17 Jan 2023 · Fixed in 1.29.3 · NVD, Project advisories (GitHub)
  5. Medium 6.1

    CVE-2023-22298 · pgAdmin

    Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.

    Published 17 Jan 2023 · Fixed in 6.14 · NVD
  6. Medium 5.4

    CVE-2023-0323 · Pimcore

    Cross site scripting vulnerability in "title field " in data objects

    Published 16 Jan 2023 · Fixed in 10.5.14 · NVD, Project advisories (GitHub)
  7. Medium 5.3

    CVE-2022-45438 · Apache Superset

    When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

    Published 16 Jan 2023 · NVD
  8. Medium 5.4

    CVE-2022-43721 · Apache Superset

    An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

    Published 16 Jan 2023 · NVD
  9. Medium 5.4

    CVE-2022-43720 · Apache Superset

    An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

    Published 16 Jan 2023 · NVD
  10. High 8.8

    CVE-2022-43719 · Apache Superset

    Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

    Published 16 Jan 2023 · NVD
  11. Medium 5.4

    CVE-2022-43718 · Apache Superset

    Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

    Published 16 Jan 2023 · NVD
  12. Medium 5.4

    CVE-2022-43717 · Apache Superset

    Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

    Published 16 Jan 2023 · NVD
  13. Medium 5.4

    CVE-2022-41703 · Apache Superset

    A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version…

    Published 16 Jan 2023 · NVD
  14. Medium 5.5

    CVE-2023-0316 · Froxlor

    Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0.

    Published 16 Jan 2023 · Fixed in 2.0.0 · NVD
  15. High 8.8

    CVE-2023-0315 · Froxlor

    Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.

    Published 16 Jan 2023 · Fixed in 2.0.8 · NVD
  16. High 7.5

    CVE-2022-46463 · Harbor

    An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's position is that this "is clearly described in the documentation as a feature."

    Published 13 Jan 2023 · NVD
  17. Low

    CVE-2023-0091 · Keycloak

    Lack of validation of access token on client registrations endpoint

    Published 12 Jan 2023 · Fixed in 20.0.3 · Project advisories (GitHub)
  18. Medium 6.5

    CVE-2022-3592 · Samba

    A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's…

    Published 12 Jan 2023 · Fixed in 4.17.2 · NVD
  19. Medium 6.5

    CVE-2022-3437 · Samba

    A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data…

    Published 12 Jan 2023 · Fixed in 4.15.11, 4.16.6, 4.17.2 · NVD
  20. Medium 5.3

    CVE-2022-3341 · FFmpeg

    A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.

    Published 12 Jan 2023 · Fixed in 5.0.3 · NVD
  21. Medium 5.5

    CVE-2022-47927 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data directory that has weak permissions, the SQLite files are created with file mode 0644, i.e., world readable to local users. These files include credentials data.

    Published 12 Jan 2023 · Fixed in 1.35.9, 1.38.5 · NVD
  22. Medium 6.1

    CVE-2023-0042 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab Pages allows redirection to arbitrary protocols.

    Published 12 Jan 2023 · Fixed in 15.5.7, 15.6.4, 15.7.2 · NVD
  23. Medium 4.3

    CVE-2022-4365 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry token by changing the configured URL in the Sentry error tracking settings page.

    Published 12 Jan 2023 · Fixed in 15.5.7, 15.6.4, 15.7.2 · NVD
  24. Low 3.8

    CVE-2022-4342 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak masked webhook secrets by changing target URL of the webhook.

    Published 12 Jan 2023 · Fixed in 15.5.7, 15.6.4, 15.7.2 · NVD
  25. High 7.5

    CVE-2022-4167 · GitLab

    Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them.

    Published 12 Jan 2023 · Fixed in 15.5.7, 15.6.4, 15.7.2 · NVD
  26. Medium 5.3

    CVE-2022-4131 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in how the application parses user agents.

    Published 12 Jan 2023 · Fixed in 15.5.7, 15.6.4, 15.7.2 · NVD
  27. High 8.5

    CVE-2022-4037 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A race condition can lead to verified email forgery and takeover of third-party accounts when using GitLab as an OAuth provider.

    Published 12 Jan 2023 · Fixed in 15.5.7, 15.6.4, 15.7.2 · NVD
  28. Medium 5.3

    CVE-2022-3870 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. GitLab allows unauthenticated users to download user avatars using the victim's user ID, on private instances that restrict public level visibility.

    Published 12 Jan 2023 · Fixed in 15.5.7, 15.6.4, 15.7.2 · NVD
  29. High 7.5

    CVE-2022-3613 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query can cause high resource consumption and may lead to Denial of Service.

    Published 12 Jan 2023 · Fixed in 15.5.7, 15.6.4, 15.7.2 · NVD
  30. Medium 5.4

    CVE-2022-3573 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary JavaScript on the self-hosted instances running without strict CSP.

    Published 12 Jan 2023 · Fixed in 15.5.7, 15.6.4, 15.7.2 · NVD
  31. Medium 5.3

    CVE-2022-3514 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the submodule URL parser.

    Published 12 Jan 2023 · Fixed in 15.5.7, 15.6.4, 15.7.2 · NVD
  32. Medium 5.9

    CVE-2023-22492 · ZITADEL

    RefreshToken invalidation vulnerability

    Published 11 Jan 2023 · Fixed in 2.16.4, 2.17.3 · NVD, Project advisories (GitHub)
  33. Medium 4.3

    CVE-2023-22945 · MediaWiki

    In the GrowthExperiments extension for MediaWiki through 1.39, the growthmanagementorlist API allows blocked users (blocked in ApiManageMentorList) to enroll as mentors or edit any of their mentorship-related properties.

    Published 11 Jan 2023 · NVD
  34. High 7.8

    CVE-2023-21764 · Microsoft Exchange Server

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Published 10 Jan 2023 · NVD
  35. High 7.8

    CVE-2023-21763 · Microsoft Exchange Server

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Published 10 Jan 2023 · NVD
  36. High 8.0

    CVE-2023-21762 · Microsoft Exchange Server

    Microsoft Exchange Server Spoofing Vulnerability

    Published 10 Jan 2023 · NVD
  37. High 7.5

    CVE-2023-21761 · Microsoft Exchange Server

    Microsoft Exchange Server Information Disclosure Vulnerability

    Published 10 Jan 2023 · NVD
  38. High 8.0

    CVE-2023-21745 · Microsoft Exchange Server

    Microsoft Exchange Server Spoofing Vulnerability

    Published 10 Jan 2023 · NVD
  39. High 7.5

    CVE-2023-21538 · .NET

    .NET Denial of Service Vulnerability

    Published 10 Jan 2023 · NVD
  40. Medium 6.1

    CVE-2023-22911 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Widgets does widget replacement in HTML attributes, which can lead to XSS, because widget authors often do not expect that their widget is executed in an HTML attribute context.

    Published 10 Jan 2023 · Fixed in 1.35.9, 1.38.5 · NVD
  41. Medium 5.3

    CVE-2023-22909 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. SpecialMobileHistory allows remote attackers to cause a denial of service because database queries are slow.

    Published 10 Jan 2023 · Fixed in 1.35.9, 1.38.5 · NVD
  42. Critical 9.8

    CVE-2022-0668 · JFrog Artifactory

    JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated user.

    Published 8 Jan 2023 · Fixed in 6.23.41, 7.37.13 · NVD
  43. Medium 6.1

    CVE-2022-45913 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via one of attributes in webmail URLs to execute arbitrary JavaScript code, leading to information disclosure.

    Published 6 Jan 2023 · NVD
  44. Medium 6.1

    CVE-2022-45911 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbitrary JavaScript code in the username field. This occurs before the user logs into the system, which means that even if the attacker executes arbitrary JavaScript, they will not get any sensitive information.

    Published 6 Jan 2023 · NVD
  45. Critical 9.8Actively exploited

    CVE-2022-44877 · Control Web Panel

    login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

    Published 5 Jan 2023 · Fixed in 0.9.8.1147 · NVD
  46. Medium 6.1

    CVE-2023-22455 · Discourse

    Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, tag descriptions, which can be updated by moderators, can be used for cross-site scripting attacks. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy.…

    Published 5 Jan 2023 · Fixed in 2.8.14 · NVD
  47. Medium 6.1

    CVE-2023-22454 · Discourse

    Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, pending post titles can be used for cross-site scripting attacks. Pending posts can be created by unprivileged users when a category has the "require moderator approval of all new topics" setting set. This vulnerability can lead to…

    Published 5 Jan 2023 · Fixed in 2.8.14 · NVD
  48. Medium 5.3

    CVE-2023-22453 · Discourse

    Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, the number of times a user posted in an arbitrary topic is exposed to unauthorized users through the `/u/username.json` endpoint. The issue is patched in version 2.8.14 and 3.0.0.beta16. There is no known workaround.

    Published 5 Jan 2023 · Fixed in 2.8.14 · NVD
  49. High 8.1

    CVE-2022-46177 · Discourse

    Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, when a user requests for a password reset link email, then changes their primary email, the old reset email is still valid. When the old reset email is used to reset the password, the Discourse account's primary email would be…

    Published 5 Jan 2023 · Fixed in 2.8.14 · NVD
  50. Medium 6.5

    CVE-2022-23549 · Discourse

    Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` branches, users can create posts with raw body longer than the `max_length` site setting by including html comments that are not counted toward the character limit. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known…

    Published 5 Jan 2023 · Fixed in 2.8.14 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.