UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
250
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Medium 4.8

    CVE-2023-4502 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Cross-site Scripting

    Published 25 Aug 2023 · Fixed in 3.0.4 · WPVulnerability
  2. Medium 6.1

    CVE-2023-40030 · Rust

    Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by `cargo build --timings`. A malicious package included as a dependency may inject nearly arbitrary HTML here, potentially leading to cross-site scripting if the report is subsequently uploaded…

    Published 24 Aug 2023 · Fixed in 1.72.0 · NVD
  3. High 7.5

    CVE-2023-32559 · Node.js

    A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note…

    Published 24 Aug 2023 · NVD
  4. High 7.5

    CVE-2023-1409 · MongoDB

    If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate. This issue affect all…

    Published 23 Aug 2023 · Fixed in 4.4.23, 6.0.7 · NVD
  5. Medium 6.1

    CVE-2023-32300 · Yoast SEO

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.8 versions.

    Published 23 Aug 2023 · NVD
  6. High 7.5

    CVE-2023-41105 · Python

    An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.

    Published 23 Aug 2023 · NVD
  7. Medium 5.9

    CVE-2022-48566 · Python

    An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.

    Published 22 Aug 2023 · Fixed in 3.7.10, 3.8.7, 3.9.1 · NVD
  8. Critical 9.8

    CVE-2022-48565 · Python

    An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.

    Published 22 Aug 2023 · Fixed in 3.7.10, 3.8.7, 3.9.1 · NVD
  9. Medium 6.5

    CVE-2022-48564 · Python

    read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.

    Published 22 Aug 2023 · Fixed in 3.7.10, 3.8.7, 3.9.1 · NVD
  10. High 7.5

    CVE-2022-48560 · Python

    A use-after-free exists in Python through 3.9 via heappushpop in heapq.

    Published 22 Aug 2023 · Fixed in 3.6.11, 3.7.7, 3.8.2 · NVD
  11. Medium 5.9

    CVE-2020-22217 · c-ares

    Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.

    Published 22 Aug 2023 · NVD
  12. Medium 4.4

    CVE-2020-21469 · PostgreSQL

    An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly sending SIGHUP signals. NOTE: this is disputed by the vendor because untrusted users cannot send SIGHUP signals; they can only be sent by a PostgreSQL superuser, a user with pg_reload_conf access, or a user with sufficient privileges at the OS level (the postgres account or the root account).

    Published 22 Aug 2023 · NVD
  13. Low 3.3

    CVE-2020-19909 · curl

    Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via a large value as the retry delay. NOTE: many parties report that this has no direct security impact on the curl user; however, it may (in theory) cause a denial of service to associated systems or networks if, for example, --retry-delay is misinterpreted as a value much smaller than what was intended. This is not especially…

    Published 22 Aug 2023 · NVD
  14. Critical 9.8

    CVE-2023-32002 · Node.js

    The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

    Published 21 Aug 2023 · NVD
  15. Medium 5.3

    CVE-2023-36674 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.

    Published 20 Aug 2023 · Fixed in 1.35.11, 1.38.7, 1.39.4 · NVD
  16. Medium 5.3

    CVE-2023-38898 · Python

    An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1) neither 3.7 nor any other release is affected (it is a bug in some 3.12 pre-releases); (2) there are no common scenarios in which an adversary can call _asyncio._swap_current_task but does not already have the ability…

    Published 15 Aug 2023 · NVD
  17. High 8.8

    CVE-2023-32006 · Node.js

    The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

    Published 15 Aug 2023 · NVD
  18. High 8.8

    CVE-2023-32004 · Node.js

    A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the…

    Published 15 Aug 2023 · NVD
  19. Medium 5.3

    CVE-2023-32003 · Node.js

    `fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the…

    Published 15 Aug 2023 · NVD
  20. High 7.5

    CVE-2023-40518 · OpenLiteSpeed

    LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly validate HTTP request headers.

    Published 14 Aug 2023 · Fixed in 1.7.18 · NVD
  21. Medium 4.9

    CVE-2023-3814 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Incorrect Authorization

    Published 14 Aug 2023 · Fixed in 5.1.1 · WPVulnerability
  22. Medium 4.3

    CVE-2023-39418 · PostgreSQL

    A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

    Published 11 Aug 2023 · Fixed in 15.4 · NVD
  23. High 8.8

    CVE-2023-39417 · PostgreSQL

    IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

    Published 11 Aug 2023 · Fixed in 13.12, 14.9, 15.4 · NVD
  24. Critical 9.8

    CVE-2023-3824 · PHP

    In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.

    Published 11 Aug 2023 · Fixed in 8.0.30, 8.1.22, 8.2.9 · NVD
  25. High 7.5

    CVE-2023-3823 · PHP

    In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick -…

    Published 11 Aug 2023 · Fixed in 8.0.30, 8.1.22, 8.2.9 · NVD
  26. High 7.2

    CVE-2023-40225 · HAProxy

    HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.

    Published 10 Aug 2023 · Fixed in 2.6.15, 2.7.10, 2.8.2 · NVD
  27. High 7.8

    CVE-2023-39963 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a missing password confirmation allowed an attacker, after successfully stealing a session from a logged in user, to create app passwords for the victim. Nextcloud server versions…

    Published 10 Aug 2023 · Fixed in 24.0.12.5, 25.0.9, 26.0.4 · NVD
  28. High 7.7

    CVE-2023-39962 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a malicious user could delete any personal or global external storage, making them inaccessible for everyone else as well. Nextcloud server versions 25.0.9, 26.0.4,…

    Published 10 Aug 2023 · Fixed in 24.0.12.5, 25.0.9, 26.0.4 · NVD
  29. Medium 4.3

    CVE-2023-39961 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an image was shared without download permissions, the user could add the image inline into a text file and download it. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server…

    Published 10 Aug 2023 · Fixed in 25.0.9, 26.0.4 · NVD
  30. Medium 5.3

    CVE-2023-39959 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for the victim. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server…

    Published 10 Aug 2023 · Fixed in 25.0.9, 26.0.4 · NVD
  31. Medium 5.3

    CVE-2023-39958 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, missing protection allows an attacker to brute force the client secrets of configured OAuth2 clients. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions…

    Published 10 Aug 2023 · Fixed in 24.0.12.5, 25.0.9, 26.0.4 · NVD
  32. Medium 6.5

    CVE-2023-39952 · Nextcloud

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1, a user can access files inside a subfolder of a groupfolder accessible to them, even if advanced permissions would block access to the subfolder. Nextcloud Server versions 25.0.8, 26.0.3, and 27.0.1 and…

    Published 10 Aug 2023 · Fixed in 24.0.12.4, 25.0.8, 26.0.3 · NVD
  33. Unrated

    WPV-df8b70a8ee35 · Advanced Custom Fields Pro (WordPress plugin)

    Vulnerability in Advanced Custom Field Pro

    Published 10 Aug 2023 · WPVulnerability
  34. Unrated

    WPV-d1cadcfacbd1 · Advanced Custom Fields Pro (WordPress plugin)

    Vulnerability in Advanced Custom Field Pro

    Published 10 Aug 2023 · Fixed in 6.1.8 · WPVulnerability
  35. Medium 6.5

    CVE-2023-38209 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that could lead to a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.

    Published 9 Aug 2023 · Fixed in 2.4.4 · NVD
  36. High 7.2

    CVE-2023-38208 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

    Published 9 Aug 2023 · Fixed in 2.4.4 · NVD
  37. High 7.5

    CVE-2023-38207 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by a XML Injection (aka Blind XPath Injection) vulnerability that could lead in minor arbitrary file system read. Exploitation of this issue does not require user interaction.

    Published 9 Aug 2023 · Fixed in 2.4.4 · NVD
  38. High 7.5Actively exploited

    CVE-2023-38180 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 8 Aug 2023 · Fixed in 2.1.40, 6.0.21, 7.0.10 · NVD
  39. High 7.5

    CVE-2023-35391 · .NET

    ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

    Published 8 Aug 2023 · Fixed in 2.1.40, 6.0.21, 7.0.10 · NVD
  40. High 7.5

    CVE-2023-38178 · .NET

    .NET Core and Visual Studio Denial of Service Vulnerability

    Published 8 Aug 2023 · NVD
  41. High 7.8

    CVE-2023-35390 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 8 Aug 2023 · Fixed in 6.0.21, 7.0.10 · NVD
  42. Medium 6.5

    CVE-2023-4002 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link any security policy project by its ID to projects or groups the user has access to, potentially revealing the security projects's configured security policies.

    Published 4 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  43. Critical 9.8

    CVE-2023-4008 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random string added was known.

    Published 3 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  44. Medium 6.5

    CVE-2023-3932 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies.

    Published 3 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  45. Unrated

    WPV-644d89382edb · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Published 3 Aug 2023 · Fixed in 6.1.8 · WPVulnerability
  46. Medium 5.4

    CVE-2023-40068 · Advanced Custom Fields

    Advanced Custom Fields (ACF®): Cross-site Scripting

    Published 3 Aug 2023 · NVD, WPVulnerability
  47. Medium 6.5

    CVE-2023-3401 · GitLab

    An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.

    Published 2 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  48. Medium 4.3

    CVE-2023-2022 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have access to merge

    Published 2 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD
  49. High 7.5

    CVE-2023-4011 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS.

    Published 2 Aug 2023 · Fixed in 16.2.2 · NVD
  50. High 7.5

    CVE-2023-3994 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint.

    Published 2 Aug 2023 · Fixed in 16.0.8, 16.1.3, 16.2.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.