UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
250
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. High 7.5

    CVE-2023-5226 · GitLab

    An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted branch name to manipulate repository content in the UI.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD
  2. Medium 6.5

    CVE-2023-4912 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 10.5 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to cause a client-side denial of service using malicious crafted mermaid diagram input.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD
  3. Low 3.1

    CVE-2023-4658 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 8.13 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the `Allowed to merge` permission as a guest user, when granted the permission through a group.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD
  4. Medium 4.3

    CVE-2023-4317 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an unprotected branch to a protected branch.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD
  5. Medium 4.3

    CVE-2023-3964 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled in the project settings.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD
  6. Medium 5.3

    CVE-2023-3949 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a public projects' release descriptions via an atom endpoint when release access on the public was set to only project members.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD
  7. Medium 4.3

    CVE-2023-3443 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items.

    Published 1 Dec 2023 · Fixed in 16.4.3, 16.5.3 · NVD
  8. High 8.8

    CVE-2023-6528 · Slider Revolution

    Slider Revolution: Code Injection

    Published 30 Nov 2023 · Fixed in 6.6.19 · NVD, WPVulnerability
  9. High 7.2

    CVE-2023-6449 · Contact Form 7

    Contact Form 7: Unrestricted Upload of File with Dangerous Type

    Published 30 Nov 2023 · Fixed in 5.8.4 · NVD, WPVulnerability
  10. High 7.5

    CVE-2023-40626 · Joomla!

    The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.

    Published 29 Nov 2023 · Fixed in 3.10.14, 4.4.1 · NVD
  11. High 8.2

    CVE-2023-45539 · HAProxy

    HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server.

    Published 28 Nov 2023 · Fixed in 2.8.2 · NVD
  12. High 7.5

    CVE-2023-30590 · Node.js

    The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The…

    Published 28 Nov 2023 · Fixed in 16.20.1, 18.16.1, 20.3.1 · NVD
  13. Medium 5.3

    CVE-2023-30588 · Node.js

    When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that…

    Published 28 Nov 2023 · Fixed in 16.20.1, 18.16.1, 20.3.1 · NVD
  14. High 7.5

    CVE-2023-46589 · Apache Tomcat

    Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request…

    Published 28 Nov 2023 · Fixed in 8.5.96, 9.0.83, 10.1.16 · NVD
  15. High 7.5

    CVE-2023-30585 · Node.js

    A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the "msiexec.exe" process, running under the NT AUTHORITY\SYSTEM context, attempts to read the %USERPROFILE% environment variable from the current user's registry.…

    Published 28 Nov 2023 · Fixed in 16.20.1, 18.16.1, 20.3.1 · NVD
  16. Medium 5.3

    CVE-2023-41134 · Antispam Bee (WordPress plugin)

    Antispam Bee: Authentication Bypass by Spoofing

    Published 27 Nov 2023 · Fixed in 2.11.4 · WPVulnerability
  17. Unrated

    WPV-bf8b4895a76f · Slider Revolution

    Vulnerability in Slider Revolution

    Published 26 Nov 2023 · Fixed in 3.0.96 · WPVulnerability
  18. Medium 4.8

    CVE-2023-40680 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 24 Nov 2023 · Fixed in 21.1 · NVD, WPVulnerability
  19. High 7.5

    CVE-2023-30581 · Node.js

    The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

    Published 23 Nov 2023 · Fixed in 16.20.1, 18.16.1, 20.3.1 · NVD
  20. High 7.5

    CVE-2023-46673 · Elasticsearch

    It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.

    Published 22 Nov 2023 · Fixed in 7.17.14, 8.10.3 · NVD
  21. High 8.8

    CVE-2021-37937 · Elasticsearch

    An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.

    Published 22 Nov 2023 · NVD
  22. Critical 9.8

    CVE-2023-48306 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Enterprise Server, the DNS pin middleware was vulnerable to DNS rebinding allowing an…

    Published 21 Nov 2023 · Fixed in 25.0.11, 26.0.6, 27.1.0 · NVD
  23. Medium 4.4

    CVE-2023-48305 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, when the log level was set to debug, the user_ldap app logged user passwords in plaintext into the log file. If the log file was then leaked or shared in any way the users' passwords…

    Published 21 Nov 2023 · Fixed in 25.0.11, 26.0.6, 27.1.0 · NVD
  24. Medium 4.3

    CVE-2023-48304 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Enterprise Server, an attacker could enable and disable the birthday calendar for any…

    Published 21 Nov 2023 · Fixed in 25.0.11, 26.0.6, 27.1.0 · NVD
  25. Low 2.7

    CVE-2023-48303 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, admins can change authentication details of user configured external storage. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.11, 26.0.6, and 27.1.0 contain a patch for…

    Published 21 Nov 2023 · Fixed in 25.0.11, 26.0.6, 27.1.0 · NVD
  26. Medium 5.4

    CVE-2023-48302 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, when a user is tricked into copy pasting HTML code without markup (Ctrl+Shift+V) the markup will actually render. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.13,…

    Published 21 Nov 2023 · Fixed in 25.0.13, 26.0.8, 27.1.3 · NVD
  27. Medium 5.4

    CVE-2023-48301 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, an attacker could insert links into circles name that would be opened when clicking the circle name in a search filter. Nextcloud Server and Nextcloud Enterprise Server versions…

    Published 21 Nov 2023 · Fixed in 25.0.13, 26.0.8, 27.1.3 · NVD
  28. High 7.1

    CVE-2023-48239 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in version 20.0.0 and prior to versions 20.0.14.16, 21.0.9.13, 22.2.10.15, 23.0.12.12, 24.0.12.8, 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Enterprise Server, a malicious user could update any personal or…

    Published 21 Nov 2023 · Fixed in 25.0.13, 26.0.8, 27.1.3 · NVD
  29. High 8.8

    CVE-2023-47788 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Missing Authorization

    Published 15 Nov 2023 · Fixed in 12.7 · NVD, WPVulnerability
  30. Medium 6.5

    CVE-2023-47777 · WooCommerce

    WooCommerce: Cross-site Scripting

    Published 15 Nov 2023 · Fixed in 8.2.0 · WPVulnerability
  31. Medium 5.4

    CVE-2023-47774 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Improper Restriction of Rendered UI Layers or Frames

    Published 15 Nov 2023 · Fixed in 12.7 · NVD, WPVulnerability
  32. Medium 5.4

    CVE-2023-45050 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Cross-site Scripting

    Published 15 Nov 2023 · Fixed in 12.8-a.3 · NVD, WPVulnerability
  33. Medium 5.5

    CVE-2023-36558 · .NET

    ASP.NET Core Security Feature Bypass Vulnerability

    Published 14 Nov 2023 · Fixed in 6.0.25, 7.0.14 · NVD
  34. High 7.5

    CVE-2023-36038 · .NET

    ASP.NET Core Denial of Service Vulnerability

    Published 14 Nov 2023 · NVD
  35. Critical 9.8

    CVE-2023-36049 · .NET

    .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

    Published 14 Nov 2023 · Fixed in 6.0.25, 7.0.14 · NVD
  36. High 8.8

    CVE-2023-47784 · Slider Revolution

    Slider Revolution: Unrestricted Upload of File with Dangerous Type

    Published 14 Nov 2023 · Fixed in 6.6.16 · NVD, WPVulnerability
  37. Medium 5.4

    CVE-2023-47772 · Slider Revolution

    Slider Revolution: Cross-site Scripting

    Published 14 Nov 2023 · Fixed in 6.6.15 · NVD, WPVulnerability
  38. Critical 9.8

    CVE-2023-47121 · Discourse

    Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, the embedding feature is susceptible to server side request forgery. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable…

    Published 10 Nov 2023 · Fixed in 3.1.3, 3.2.0 · NVD
  39. High 7.5

    CVE-2023-47120 · Discourse

    Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the `stable` branch and versions 3.1.0,beta6 through 3.2.0.beta2 of the `beta` and `tests-passed` branches, Redis memory can be depleted by crafting a site with an abnormally long favicon URL and drafting multiple posts which Onebox it. The issue is patched in version 3.1.3 of the `stable` branch…

    Published 10 Nov 2023 · Fixed in 3.1.3 · NVD
  40. Medium 6.1

    CVE-2023-47119 · Discourse

    Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some links can inject arbitrary HTML tags when rendered through our Onebox engine. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are…

    Published 10 Nov 2023 · Fixed in 3.1.3, 3.2.0 · NVD
  41. Medium 5.4

    CVE-2023-46130 · Discourse

    Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some theme components allow users to add svgs with unlimited `height` attributes, and this can affect the availability of subsequent replies in a topic. Most Discourse instances are unaffected, only instances with the…

    Published 10 Nov 2023 · Fixed in 3.1.3, 3.2.0 · NVD
  42. Low 3.3

    CVE-2023-45816 · Discourse

    Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, there is an edge case where a bookmark reminder is sent and an unread notification is generated, but the underlying bookmarkable (e.g. post, topic, chat message) security has changed, making it so the user can no longer…

    Published 10 Nov 2023 · Fixed in 3.1.3, 3.2.0 · NVD
  43. Medium 5.4

    CVE-2023-45806 · Discourse

    Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, if a user has been quoted and uses a `|` in their full name, they might be able to trigger a bug that generates a lot of duplicate content in all the posts they've been quoted by updating their full name again. Version…

    Published 10 Nov 2023 · Fixed in 3.1.3, 3.2.0 · NVD
  44. High 7.5

    CVE-2023-4379 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated.

    Published 9 Nov 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  45. Medium 5.4

    CVE-2023-47505 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 8 Nov 2023 · Fixed in 3.16.5 · NVD, WPVulnerability
  46. Critical 9.8

    CVE-2023-47504 · Elementor

    Elementor Website Builder – more than just a page builder: Improper Authentication

    Published 8 Nov 2023 · Fixed in 3.16.5 · NVD, WPVulnerability
  47. Medium 5.4

    CVE-2023-5982 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Cross-Site Request Forgery (CSRF)

    Published 7 Nov 2023 · Fixed in 1.23.11 · NVD, WPVulnerability
  48. Medium 6.5

    CVE-2023-4700 · GitLab

    An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to run jobs in protected environments, bypassing any required approvals.

    Published 6 Nov 2023 · Fixed in 16.3.6, 16.4.2 · NVD
  49. Medium 5.3

    CVE-2023-5678 · OpenSSL

    Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH…

    Published 6 Nov 2023 · Fixed in 1.1.1x, 3.0.13, 3.1.5 · NVD
  50. Medium 4.3

    CVE-2023-5963 · GitLab

    An issue has been discovered in GitLab EE with Advanced Search affecting all versions from 13.9 to 16.3.6, 16.4 prior to 16.4.2 and 16.5 prior to 16.5.1 that could allow a denial of service in the Advanced Search function by chaining too many syntax operators.

    Published 6 Nov 2023 · Fixed in 16.4.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.