UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
250
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Medium 5.3

    CVE-2023-3914 · GitLab

    A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects. A service account is not deleted when a namespace is deleted, allowing access to internal projects.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  2. Low 3.5

    CVE-2023-3906 · GitLab

    An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  3. Medium 4.3

    CVE-2023-3115 · GitLab

    An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositories.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  4. Medium 4.3

    CVE-2023-2233 · GitLab

    An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4 before 16.4.1. It allows a project reporter to leak the owner's Sentry instance projects.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  5. Medium 5.7

    CVE-2023-0989 · GitLab

    An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to extract non-protected CI/CD variables by tricking a user to visit a fork with a malicious CI/CD configuration.

    Published 29 Sept 2023 · Fixed in 16.2.8, 16.3.5 · NVD
  6. High 7.5

    CVE-2023-5157 · MariaDB

    A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service.

    Published 27 Sept 2023 · Fixed in 10.6.9, 10.7.5, 10.8.4 · NVD
  7. High 7.3

    CVE-2023-3550 · MediaWiki

    Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious link to the instance administrator.

    Published 25 Sept 2023 · NVD
  8. High 8.8Actively exploited

    CVE-2023-41993 · Java

    The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

    Published 21 Sept 2023 · NVD
  9. Critical 9.8

    CVE-2023-5009 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. This was a bypass of [CVE-2023-3932](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3932) showing additional impact.

    Published 19 Sept 2023 · Fixed in 16.2.7, 16.3.4 · NVD
  10. Medium 4.8

    CVE-2023-4862 · Filester (WordPress plugin)

    File Manager Pro – Filester: Cross-site Scripting

    Published 19 Sept 2023 · Fixed in 1.8.1 · WPVulnerability
  11. High 7.2

    CVE-2023-4861 · Filester (WordPress plugin)

    File Manager Pro – Filester: Code Injection

    Published 19 Sept 2023 · Fixed in 1.8.1 · WPVulnerability
  12. Medium 6.5

    CVE-2023-41043 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server processes to be killed and lead to downtime. The issue is patched in version 3.1.1 of the `stable`…

    Published 15 Sept 2023 · Fixed in 3.1.1 · NVD
  13. Medium 6.5

    CVE-2023-41042 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed`…

    Published 15 Sept 2023 · Fixed in 3.1.1 · NVD
  14. Medium 6.5

    CVE-2023-40588 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the…

    Published 15 Sept 2023 · Fixed in 3.1.1 · NVD
  15. Medium 6.5

    CVE-2023-38706 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the…

    Published 15 Sept 2023 · Fixed in 3.1.0 · NVD
  16. High 7.5

    CVE-2023-38039 · curl

    When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

    Published 15 Sept 2023 · Fixed in 8.3.0 · NVD
  17. Medium 6.5

    CVE-2023-36799 · .NET

    .NET Core and Visual Studio Denial of Service Vulnerability

    Published 12 Sept 2023 · NVD
  18. High 7.8

    CVE-2023-36796 · .NET

    Visual Studio Remote Code Execution Vulnerability

    Published 12 Sept 2023 · NVD
  19. High 7.8

    CVE-2023-36794 · .NET

    Visual Studio Remote Code Execution Vulnerability

    Published 12 Sept 2023 · NVD
  20. High 7.8

    CVE-2023-36793 · .NET

    Visual Studio Remote Code Execution Vulnerability

    Published 12 Sept 2023 · NVD
  21. High 7.8

    CVE-2023-36792 · .NET

    Visual Studio Remote Code Execution Vulnerability

    Published 12 Sept 2023 · NVD
  22. High 7.2

    CVE-2022-24093 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.

    Published 12 Sept 2023 · Fixed in 2.3.7, 2.4.3 · NVD
  23. High 7.5

    CVE-2023-32558 · Node.js

    The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

    Published 12 Sept 2023 · Fixed in 20.5.1 · NVD
  24. Medium 5.3

    CVE-2023-32005 · Node.js

    A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file stats through the `fs.statfs` API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.…

    Published 12 Sept 2023 · Fixed in 20.5.1 · NVD
  25. Medium 4.3

    CVE-2023-4630 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project's imports.

    Published 11 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD
  26. Unrated

    WPV-dad0462eb592 · WooCommerce

    Vulnerability in WooCommerce

    Published 11 Sept 2023 · Fixed in 7.0.1 · WPVulnerability
  27. Unrated

    WPV-8b5ff6bece96 · WooCommerce

    Vulnerability in WooCommerce

    Published 11 Sept 2023 · Fixed in 7.9.0 · WPVulnerability
  28. High 8.8

    CVE-2023-4827 · Filester (WordPress plugin)

    File Manager Pro – Filester: Cross-Site Request Forgery (CSRF)

    Published 11 Sept 2023 · Fixed in 1.8 · WPVulnerability
  29. High 7.8

    CVE-2023-4807 · OpenSSL

    Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the…

    Published 8 Sept 2023 · Fixed in 1.1.1w, 3.0.11, 3.1.3 · NVD
  30. Low 3.3

    CVE-2023-41053 · Redis

    Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for…

    Published 6 Sept 2023 · Fixed in 7.0.13 · NVD
  31. High 7.2

    CVE-2021-36036 · Magento / Adobe Commerce

    Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving…

    Published 6 Sept 2023 · Fixed in 2.3.7, 2.4.2 · NVD
  32. High 7.2

    CVE-2021-36023 · Magento / Adobe Commerce

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

    Published 6 Sept 2023 · Fixed in 2.3.7, 2.4.2 · NVD
  33. High 7.2

    CVE-2021-36021 · Magento / Adobe Commerce

    Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.

    Published 6 Sept 2023 · Fixed in 2.3.7, 2.4.2 · NVD
  34. High 7.5

    CVE-2023-4647 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances.

    Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD
  35. Medium 4.3

    CVE-2023-4378 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for…

    Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD
  36. Medium 5.3

    CVE-2023-4018 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to create model experiments in public projects.

    Published 1 Sept 2023 · Fixed in 16.2.5 · NVD
  37. Low 3.8

    CVE-2023-3950 · GitLab

    An information disclosure issue in GitLab EE affecting all versions from 16.2 prior to 16.2.5, and 16.3 prior to 16.3.1 allowed other Group Owners to see the Public Key for a Google Cloud Logging audit event streaming destination, if configured. Owners can now only write the key, not read it.

    Published 1 Sept 2023 · Fixed in 16.2.5 · NVD
  38. High 7.2

    CVE-2023-3915 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. If an external user is given an owner role on any group, that external user may escalate their privileges on the instance by creating a service account in that group. This service account is not classified…

    Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD
  39. Medium 6.5

    CVE-2023-3210 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content.

    Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD
  40. Medium 6.5

    CVE-2023-3205 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content.

    Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD
  41. Medium 4.3

    CVE-2023-1555 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A namespace-level banned user can access the API.

    Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD
  42. Medium 6.1

    CVE-2023-1279 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a different project.

    Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD
  43. Medium 4.3

    CVE-2023-0120 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an unauthorised user.

    Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD
  44. Medium 4.3

    CVE-2022-4343 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which a project member can leak credentials stored in site profile.

    Published 1 Sept 2023 · Fixed in 16.1.5, 16.2.5 · NVD
  45. Unrated

    WPV-2d2a9296eebe · Gtranslate (WordPress plugin)

    Vulnerability in Translate WordPress with GTranslate

    Published 1 Sept 2023 · Fixed in 3.0.4 · WPVulnerability
  46. Medium 5.3

    CVE-2023-4522 · GitLab

    An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 errors when viewing the commit.

    Published 30 Aug 2023 · Fixed in 16.2.0 · NVD
  47. Medium 6.1

    CVE-2023-41080 · Apache Tomcat

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.

    Published 25 Aug 2023 · NVD
  48. Medium 4.8

    CVE-2023-32575 · WooCommerce

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <= 1.3.25 versions.

    Published 25 Aug 2023 · NVD
  49. Medium 5.3

    CVE-2023-40217 · Python

    An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not…

    Published 25 Aug 2023 · Fixed in 3.9.18, 3.10.13, 3.11.5 · NVD
  50. Unrated

    CVE-2025-15695 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Cross-site Scripting

    Published 25 Aug 2023 · Fixed in 3.0.10 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.