UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
250
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Medium 5.3

    CVE-2023-44391 · Discourse

    Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when `hide_user_profiles_from_public` is enabled. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 16 Oct 2023 · NVD
  2. High 7.5

    CVE-2023-44388 · Discourse

    Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to temporarily work around this problem by reducing the `client_max_body_size nginx directive`.…

    Published 16 Oct 2023 · NVD
  3. Low 3.7

    CVE-2023-43814 · Discourse

    Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` endpoint to view the content of options in the poll and the number of votes for groups of poll participants. This impacts private polls where the results were intended to only be viewable by authorized users. This issue is patched in the…

    Published 16 Oct 2023 · NVD
  4. Medium 5.4

    CVE-2023-43659 · Discourse

    Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on…

    Published 16 Oct 2023 · NVD
  5. Low 3.1

    CVE-2023-45147 · Discourse

    Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation with the default plugins, this vulnerability has no impact. The problem has been patched in the…

    Published 16 Oct 2023 · NVD
  6. Medium 5.3

    CVE-2023-5561 · WordPress

    WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

    Published 16 Oct 2023 · Fixed in 6.1.4, 6.2.3, 6.3.2 · NVD
  7. High 8.8

    CVE-2023-45151 · Nextcloud

    Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their Nextcloud Server to version 25.0.8, 26.0.3 or 27.0.1. There are no known workarounds for this…

    Published 16 Oct 2023 · Fixed in 25.0.8, 26.0.3 · NVD
  8. Medium 4.3

    CVE-2023-45148 · Nextcloud

    Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgrade should change their config setting `memcache.distributed` to `\OC\Memcache\Redis` and install…

    Published 16 Oct 2023 · Fixed in 24.0.12.7, 25.0.11, 26.0.6 · NVD
  9. Low

    CVE-2023-45143 · Node.js

    undici - Cookie headers are not cleared in cross-domain redirect in undici-fetch

    Published 13 Oct 2023 · Fixed in 18.18.2, 20.8.1 · nodejs
  10. Low

    CVE-2023-39333 · Node.js

    Code injection via WebAssembly export names

    Published 13 Oct 2023 · Fixed in 18.18.2, 20.8.1 · nodejs
  11. Critical 9.8

    CVE-2023-39332 · Node.js

    Path traversal through path stored in Uint8Array

    Published 13 Oct 2023 · Fixed in 20.8.0, 20.8.1 · NVD, nodejs
  12. High 7.5

    CVE-2023-39331 · Node.js

    Permission model improperly protects against path traversal

    Published 13 Oct 2023 · Fixed in 20.8.1 · NVD, nodejs
  13. High 7.5

    CVE-2023-38552 · Node.js

    Integrity checks according to policies can be circumvented

    Published 13 Oct 2023 · Fixed in 18.18.2, 20.8.1 · NVD, nodejs
  14. High 7.5

    CVE-2023-39960 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and…

    Published 13 Oct 2023 · Fixed in 24.0.12.5, 25.0.9, 26.0.4 · NVD
  15. Medium 4.3

    CVE-2023-39999 · WordPress

    Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0…

    Published 13 Oct 2023 · Fixed in 6.3.2 · NVD
  16. Medium 5.4

    CVE-2023-38000 · WordPress

    Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.

    Published 13 Oct 2023 · NVD
  17. Medium 5.3

    CVE-2023-38251 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Resource Consumption vulnerability that could lead in minor application denial-of-service. Exploitation of this issue does not require user interaction.

    Published 13 Oct 2023 · NVD
  18. Medium 6.6

    CVE-2023-38250 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and…

    Published 13 Oct 2023 · NVD
  19. Medium 6.6

    CVE-2023-38249 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and…

    Published 13 Oct 2023 · NVD
  20. Medium 6.6

    CVE-2023-38221 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead in arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction and…

    Published 13 Oct 2023 · NVD
  21. High 7.5

    CVE-2023-38220 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could access unauthorised data. Exploitation of this issue does not require user interaction.

    Published 13 Oct 2023 · NVD
  22. High 8.7

    CVE-2023-38219 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing…

    Published 13 Oct 2023 · NVD
  23. High 8.8

    CVE-2023-38218 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Authorization . An authenticated attacker can exploit this to achieve information exposure and privilege escalation.

    Published 13 Oct 2023 · NVD
  24. Medium 4.9

    CVE-2023-26367 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

    Published 13 Oct 2023 · NVD
  25. Medium 6.8

    CVE-2023-26366 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does…

    Published 13 Oct 2023 · NVD
  26. Medium 5.3

    CVE-2023-45648 · Apache Tomcat

    Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when…

    Published 10 Oct 2023 · Fixed in 8.5.94, 9.0.81, 10.1.14 · NVD
  27. Medium 5.3

    CVE-2023-42795 · Apache Tomcat

    Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Older, EOL…

    Published 10 Oct 2023 · Fixed in 8.5.94, 9.0.81, 10.1.14 · NVD
  28. Medium 5.9

    CVE-2023-42794 · Apache Tomcat

    Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from…

    Published 10 Oct 2023 · Fixed in 8.5.94, 9.0.81 · NVD
  29. High 7.5

    CVE-2023-38171 · .NET

    Microsoft QUIC Denial of Service Vulnerability

    Published 10 Oct 2023 · Fixed in 7.0.12 · NVD
  30. High 7.5

    CVE-2023-36435 · .NET

    Microsoft QUIC Denial of Service Vulnerability

    Published 10 Oct 2023 · NVD
  31. High 7.5Actively exploited

    CVE-2023-44487 · Apache Tomcat, nginx, .NET and 2 more

    nghttp2 - HTTP/2 Rapid Reset

    Published 10 Oct 2023 · Fixed in 7.0.12, 18.18.2, 20.8.1 · NVD, nodejs
  32. Medium 5.3

    CVE-2023-45374 · MediaWiki

    An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It does not check for the anti-CSRF edit token in Special:SportsTeamsManager and Special:UpdateFavoriteTeams.

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  33. Medium 6.1

    CVE-2023-45373 · MediaWiki

    An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. XSS can occur via formatNumNoSeparators.

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  34. Medium 5.3

    CVE-2023-45372 · MediaWiki

    An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  35. High 7.5

    CVE-2023-45371 · MediaWiki

    An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate limit for merging items.

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  36. Medium 5.3

    CVE-2023-45370 · MediaWiki

    An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. SportsTeams: Special:SportsManagerLogo and Special:SportsTeamsManagerLogo do not check for the sportsteamsmanager user right, and thus an attacker may be able to affect pages that are concerned with sports teams.

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  37. Medium 4.3

    CVE-2023-45369 · MediaWiki

    An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. Usernames of hidden users are exposed.

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  38. Medium 6.5

    CVE-2023-45367 · MediaWiki

    An issue was discovered in the CheckUser extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. A user can use a rest.php/checkuser/v0/useragent-clienthints/revision/ URL to store an arbitrary number of rows in cu_useragent_clienthints, leading to a denial of service.

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  39. Medium 5.3

    CVE-2023-45364 · MediaWiki

    An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is leaked due to incorrect permissions being checked. This reveals that a given revision ID belonged to the given page title, and its timestamp, both of which are not supposed to be public information.

    Published 9 Oct 2023 · Fixed in 1.39.5 · NVD
  40. High 7.5

    CVE-2023-45363 · MediaWiki

    An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected to other variants with redirects and converttitles set.

    Published 9 Oct 2023 · Fixed in 1.35.12, 1.39.5 · NVD
  41. Critical 9.8Actively exploited

    CVE-2023-22515 · Confluence

    Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site…

    Published 4 Oct 2023 · Fixed in 8.3.3, 8.4.3, 8.5.2 · NVD
  42. High 7.5

    CVE-2023-5106 · GitLab

    An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports.

    Published 2 Oct 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  43. High 8.8

    CVE-2023-5207 · GitLab

    A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user.

    Published 30 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  44. High 7.5

    CVE-2023-3413 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to read the source code of a project through a fork created before changing visibility to only project members.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  45. Medium 4.3

    CVE-2023-5198 · GitLab

    An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16.4 before 16.4.1. It was possible for a removed project member to write to protected branches using deploy keys.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  46. High 7.1

    CVE-2023-3922 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to a malicious page.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  47. Medium 4.3

    CVE-2023-4532 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI/CD jobs of private projects which they are not a member of.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  48. Medium 4.3

    CVE-2023-3979 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your branch get permission to write to the merge request’s source branch.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  49. Medium 4.3

    CVE-2023-3920 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that a maintainer to create a fork relationship between existing projects contrary to the documentation.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  50. High 7.5

    CVE-2023-3917 · GitLab

    Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.