UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
250
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Critical 9.0

    CVE-2024-22206 · @clerk/nextjs

    @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

    Published 12 Jan 2024 · Fixed in 4.29.3 · OSV.dev and GitHub
  2. Critical 9.8Actively exploited

    CVE-2023-7028 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

    Published 12 Jan 2024 · Fixed in 16.5.6, 16.6.4, 16.7.2 · NVD
  3. Medium 5.3

    CVE-2023-6955 · GitLab

    A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.

    Published 12 Jan 2024 · Fixed in 16.5.6, 16.6.4 · NVD
  4. High 8.8

    CVE-2023-5356 · GitLab

    Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute slash commands as another user.

    Published 12 Jan 2024 · Fixed in 16.5.6, 16.6.4 · NVD
  5. Medium 5.3

    CVE-2023-4812 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding changes to a previously approved merge request.

    Published 12 Jan 2024 · Fixed in 16.5.5, 16.6.4 · NVD
  6. Medium 5.3

    CVE-2023-2030 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits.

    Published 12 Jan 2024 · Fixed in 16.5.6, 16.6.4 · NVD
  7. Medium 6.1

    CVE-2024-23179 · MediaWiki

    An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special:GlobalBlock?uselang=x-xss URI, i18n-based XSS can occur via the parentheses message. This affects subtitle links in buildSubtitleLinks.

    Published 12 Jan 2024 · Fixed in 1.40.2 · NVD
  8. Medium 5.4

    CVE-2024-23178 · MediaWiki

    An issue was discovered in the Phonos extension in MediaWiki before 1.40.2. PhonosButton.js allows i18n-based XSS via the phonos-purge-needed-error message.

    Published 12 Jan 2024 · Fixed in 1.40.2 · NVD
  9. Medium 6.1

    CVE-2024-23177 · MediaWiki

    An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2. XSS can occur via the Special:PageStatistics page parameter.

    Published 12 Jan 2024 · Fixed in 1.40.2 · NVD
  10. Medium 5.4

    CVE-2024-23174 · MediaWiki

    An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via the rev-deleted-user, pagetriage-tags-quickfilter-label, pagetriage-triage, pagetriage-filter-date-range-format-placeholder, pagetriage-filter-date-range-to, pagetriage-filter-date-range-from, pagetriage-filter-date-range-heading,…

    Published 12 Jan 2024 · Fixed in 1.35.14, 1.39.6, 1.40.2 · NVD
  11. Medium 6.1

    CVE-2024-23173 · MediaWiki

    An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php.

    Published 12 Jan 2024 · Fixed in 1.35.14, 1.39.6, 1.40.2 · NVD
  12. Medium 5.4

    CVE-2024-23172 · MediaWiki

    An issue was discovered in the CheckUser extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via message definitions. e.g., in SpecialCheckUserLog.

    Published 12 Jan 2024 · Fixed in 1.35.14, 1.39.6, 1.40.2 · NVD
  13. Medium 5.4

    CVE-2024-23171 · MediaWiki

    An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:EventDetails page allows XSS via the x-xss language setting for internationalization (i18n).

    Published 12 Jan 2024 · Fixed in 1.35.14, 1.39.6, 1.40.2 · NVD
  14. Unrated

    WPV-95e6a6f56398 · WooCommerce

    Vulnerability in WooCommerce

    Published 12 Jan 2024 · Fixed in 8.4.0 · WPVulnerability
  15. Medium 4.3

    CVE-2023-6630 · Contact Form 7

    The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any…

    Published 11 Jan 2024 · NVD
  16. High 8.1

    CVE-2023-41056 · Redis

    Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and 7.2.4.

    Published 10 Jan 2024 · Fixed in 7.0.15, 7.2.4 · NVD
  17. Medium 6.8

    CVE-2024-21319 · .NET

    Microsoft Identity Denial of service vulnerability

    Published 9 Jan 2024 · Fixed in 6.0.26, 7.0.15, 8.0.1 · NVD
  18. High 7.5

    CVE-2024-20672 · .NET

    .NET Denial of Service Vulnerability

    Published 9 Jan 2024 · Fixed in 6.0.26, 7.0.15 · NVD
  19. Critical 9.8

    CVE-2024-0057 · .NET

    NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

    Published 9 Jan 2024 · Fixed in 6.0.26, 7.0.15 · NVD
  20. High 8.7

    CVE-2024-0056 · .NET

    Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

    Published 9 Jan 2024 · Fixed in 6.0.26, 7.0.15 · NVD
  21. Medium 6.5

    CVE-2023-6129 · OpenSSL

    Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent…

    Published 9 Jan 2024 · NVD
  22. High 8.8

    CVE-2023-52222 · WooCommerce

    WooCommerce: Cross-Site Request Forgery (CSRF)

    Published 5 Jan 2024 · Fixed in 8.3.0 · NVD, WPVulnerability
  23. Medium 4.8

    CVE-2023-6290 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 26 Dec 2023 · Fixed in 7.3 · WPVulnerability
  24. High 7.0

    CVE-2023-51767 · OpenSSH

    OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who…

    Published 24 Dec 2023 · NVD
  25. Critical 9.8

    CVE-2023-49792 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a (reverse) proxy is configured as trusted proxy the server could be tricked into reading a wrong remote address for an attacker, allowing…

    Published 22 Dec 2023 · Fixed in 25.0.13.4, 26.0.9, 27.1.4 · NVD
  26. Medium 5.4

    CVE-2023-49791 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an active session of another user via another way, they could delete and modify workflows by sending…

    Published 22 Dec 2023 · Fixed in 25.0.13.4, 26.0.9, 27.1.4 · NVD
  27. Medium 6.1

    CVE-2023-51704 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group-*-member messages can result in XSS on Special:log/rights.

    Published 22 Dec 2023 · Fixed in 1.35.14, 1.39.6, 1.40.2 · NVD
  28. Medium 6.5

    CVE-2023-51385 · OpenSSH

    In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

    Published 18 Dec 2023 · Fixed in 9.6 · NVD
  29. Medium 5.5

    CVE-2023-51384 · OpenSSH

    In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.

    Published 18 Dec 2023 · Fixed in 9.6 · NVD
  30. Medium 5.9

    CVE-2023-48795 · Erlang/OTP, OpenSSH

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This…

    Published 18 Dec 2023 · Fixed in 24.3.4.15, 25.3.2.8, 26.2.1 · NVD
  31. High 8.8

    CVE-2023-3907 · GitLab

    A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner

    Published 17 Dec 2023 · Fixed in 16.4.4, 16.5.4, 16.6.2 · NVD
  32. High 8.1

    CVE-2023-6680 · GitLab

    An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication. Smartcard authentication is an experimental feature and has to be manually enabled by an administrator.

    Published 15 Dec 2023 · Fixed in 16.4.4, 16.5.4, 16.6.2 · NVD
  33. Medium 6.5

    CVE-2023-6051 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pulled from a specific tag.

    Published 15 Dec 2023 · Fixed in 16.4.4, 16.5.4, 16.6.2 · NVD
  34. Medium 5.7

    CVE-2023-5512 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when specific HTML encoding is used for file names leading for incorrect representation in the UI.

    Published 15 Dec 2023 · Fixed in 16.4.4, 16.5.4, 16.6.2 · NVD
  35. Medium 4.3

    CVE-2023-5061 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may have been possible for developers to override predefined CI variables via the REST API.

    Published 15 Dec 2023 · Fixed in 16.4.4, 16.5.4, 16.6.2 · NVD
  36. High 7.5

    CVE-2023-3904 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issue boards.

    Published 15 Dec 2023 · Fixed in 16.4.4, 16.5.4, 16.6.2 · NVD
  37. Low 3.5

    CVE-2023-3511 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 8.17 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible for auditor users to fork and submit merge requests to private projects they're not a member of.

    Published 15 Dec 2023 · Fixed in 16.4.4, 16.5.4, 16.6.2 · NVD
  38. Medium 5.3

    CVE-2023-46219 · curl

    When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.

    Published 12 Dec 2023 · Fixed in 8.5.0 · NVD
  39. Medium 4.4

    CVE-2023-5870 · PostgreSQL

    A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to…

    Published 10 Dec 2023 · Fixed in 13.13, 14.10, 15.5 · NVD
  40. High 8.8

    CVE-2023-5869 · PostgreSQL

    A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing…

    Published 10 Dec 2023 · Fixed in 13.13, 14.10, 15.5 · NVD
  41. Medium 4.3

    CVE-2023-5868 · PostgreSQL

    A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output…

    Published 10 Dec 2023 · Fixed in 13.13, 14.10, 15.5 · NVD
  42. Medium 4.9

    CVE-2023-6507 · Python

    An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the…

    Published 8 Dec 2023 · NVD
  43. Medium 6.5

    CVE-2023-46218 · curl

    This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List…

    Published 7 Dec 2023 · NVD
  44. High 8.8

    CVE-2023-22522 · Confluence

    This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the…

    Published 6 Dec 2023 · Fixed in 8.4.5, 8.5.4, 8.6.2 · NVD
  45. High 7.5

    CVE-2023-5761 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): SQL Injection

    Published 6 Dec 2023 · Fixed in 1.5.0 · WPVulnerability
  46. High 8.8

    CVE-2023-48777 · Elementor

    Elementor Website Builder – more than just a page builder: Unrestricted Upload of File with Dangerous Type

    Published 6 Dec 2023 · Fixed in 3.18.2 · NVD, WPVulnerability
  47. High 7.8

    CVE-2023-46674 · Elasticsearch

    An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.

    Published 5 Dec 2023 · Fixed in 7.17.11, 8.9.0 · NVD
  48. High 8.1

    CVE-2023-5332 · GitLab

    Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.

    Published 4 Dec 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  49. Medium 5.4

    CVE-2023-6033 · GitLab

    Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3, 16.6.1 · NVD
  50. High 7.5

    CVE-2023-5995 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the policy bot to gain access to internal projects.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.