UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
249
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Medium 6.1

    CVE-2023-36473 · Discourse

    Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass CSP. The vulnerability is patched in the latest tests-passed, beta and stable branches.

    Published 13 Jul 2023 · Fixed in 3.0.5 · NVD
  2. High 8.8

    CVE-2022-24834 · Redis

    Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in…

    Published 13 Jul 2023 · Fixed in 6.0.20, 6.2.13, 7.0.12 · NVD
  3. Medium 6.5

    CVE-2023-3444 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to merge arbitrary code into protected branches.

    Published 13 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  4. High 7.5

    CVE-2023-3424 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.

    Published 13 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  5. Low 3.8

    CVE-2023-3363 · GitLab

    An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1, resulted in the Sidekiq log including webhook tokens when the log format was set to `default`.

    Published 13 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  6. Medium 5.3

    CVE-2023-3362 · GitLab

    An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access the import error information if a project was imported from GitHub.

    Published 13 Jul 2023 · Fixed in 16.0.6 · NVD
  7. Low 3.8

    CVE-2023-2620 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1. A maintainer could modify a webhook URL to leak masked webhook secrets by manipulating other masked portions. This addresses an incomplete fix for CVE-2023-0838.

    Published 13 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  8. Medium 4.3

    CVE-2023-2576 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. This allowed a developer to remove the CODEOWNERS rules and merge to a protected branch.

    Published 13 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  9. Medium 5.4

    CVE-2023-2200 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field.

    Published 13 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  10. Medium 6.5

    CVE-2023-2190 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.10 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1. It may be possible for users to view new commits to private projects in a fork created while the project was public.

    Published 13 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  11. High 8.1

    CVE-2023-33170 · .NET

    ASP.NET and Visual Studio Security Feature Bypass Vulnerability

    Published 11 Jul 2023 · Fixed in 6.0.20, 7.0.9 · NVD
  12. High 8.1

    CVE-2023-33127 · .NET

    .NET and Visual Studio Elevation of Privilege Vulnerability

    Published 11 Jul 2023 · Fixed in 6.0.20, 7.0.9 · NVD
  13. High 8.8

    CVE-2023-36824 · Redis

    Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to authenticated users executing a specially crafted `COMMAND GETKEYS` or…

    Published 11 Jul 2023 · Fixed in 7.0.12 · NVD
  14. Medium 4.3

    CVE-2023-1936 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to leak the email address of a user who created a service desk issue.

    Published 11 Jul 2023 · Fixed in 15.11.10, 16.0.6, 16.1.1 · NVD
  15. Medium 4.3

    CVE-2022-47172 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-Site Request Forgery (CSRF)

    Published 5 Jul 2023 · Fixed in 2.6.3 · WPVulnerability
  16. Medium 6.1

    CVE-2023-1119 · WP Optimize (WordPress plugin)

    WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance: Cross-site Scripting

    Published 4 Jul 2023 · Fixed in 3.2.13 · WPVulnerability
  17. High 7.5

    CVE-2023-30589 · Node.js

    The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16,…

    Published 1 Jul 2023 · Fixed in 16.20.1, 18.16.1, 20.3.1 · NVD
  18. High 7.5

    CVE-2023-30586 · Node.js

    A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for…

    Published 1 Jul 2023 · Fixed in 20.3.1 · NVD
  19. Medium 5.3

    CVE-2023-37305 · MediaWiki

    An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/Page/PageContentHandler.php and includes/Page/PageDisplayHandler.php, hidden users can be exposed via public interfaces.

    Published 30 Jun 2023 · NVD
  20. Medium 5.4

    CVE-2023-37304 · MediaWiki

    An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3. includes/DoubleWiki.php allows XSS via the column alignment feature.

    Published 30 Jun 2023 · NVD
  21. Critical 9.8

    CVE-2023-37303 · MediaWiki

    An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails after a temporary browser hang and a DBQueryDisconnectedError error message.

    Published 30 Jun 2023 · NVD
  22. Medium 6.1

    CVE-2023-37302 · MediaWiki

    An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).

    Published 30 Jun 2023 · NVD
  23. Medium 5.3

    CVE-2023-37301 · MediaWiki

    An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur.

    Published 30 Jun 2023 · NVD
  24. Medium 5.3

    CVE-2023-37300 · MediaWiki

    An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.

    Published 30 Jun 2023 · NVD
  25. Medium 6.1

    CVE-2023-37256 · MediaWiki

    An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. It allows one to store javascript: URLs in URL fields, and automatically links these URLs.

    Published 29 Jun 2023 · NVD
  26. Medium 6.1

    CVE-2023-37255 · MediaWiki

    An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the "get edits" type is vulnerable to HTML injection through the User-Agent HTTP request header.

    Published 29 Jun 2023 · NVD
  27. Medium 6.1

    CVE-2023-37254 · MediaWiki

    An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. XSS can occur in Special:CargoQuery via a crafted page item when using the default format.

    Published 29 Jun 2023 · NVD
  28. Medium 6.1

    CVE-2023-37251 · MediaWiki

    An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3. The googleanalyticstrackurl parser function does not properly escape JavaScript in the onclick handler and does not prevent use of javascript: URLs.

    Published 29 Jun 2023 · NVD
  29. Medium 6.5

    CVE-2023-2232 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.10 before 16.1, leading to a ReDoS vulnerability in the Jira prefix

    Published 28 Jun 2023 · Fixed in 16.1 · NVD
  30. Medium 5.3

    CVE-2022-4143 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.7 before 15.8.5, from 15.9 before 15.9.4, and from 15.10 before 15.10.1 that allows for crafted, unapproved MRs to be introduced and merged without authorization

    Published 28 Jun 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  31. Medium 6.1

    CVE-2023-36675 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.

    Published 26 Jun 2023 · Fixed in 1.35.11, 1.38.7, 1.39.4 · NVD
  32. High 7.5

    CVE-2023-36632 · Python

    The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API…

    Published 25 Jun 2023 · NVD
  33. High 8.8

    CVE-2023-35928 · Nextcloud

    Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until…

    Published 23 Jun 2023 · Fixed in 24.0.12.2, 25.0.7, 26.0.2 · NVD
  34. High 8.1

    CVE-2023-35927 · Nextcloud

    NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, when two server are…

    Published 23 Jun 2023 · Fixed in 24.0.12.2, 25.0.7, 26.0.2 · NVD
  35. Critical 9.1

    CVE-2023-35172 · Nextcloud

    NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, an attacker can…

    Published 23 Jun 2023 · Fixed in 24.0.12.2, 25.0.7, 26.0.2 · NVD
  36. Medium 6.1

    CVE-2023-35171 · Nextcloud

    NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker's site. Nextcloud Server and Nextcloud Enterprise Server 26.0.2 contain a patch for this issue. No known…

    Published 23 Jun 2023 · Fixed in 26.0.2 · NVD
  37. High 7.5

    CVE-2023-32320 · Nextcloud

    Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were executed even if the amount of faulty requests succeeded the limit by the time the response was sent to the client. This allowed someone to send as many requests the server could handle in parallel to bruteforce protected details instead of…

    Published 22 Jun 2023 · Fixed in 24.0.12.2, 25.0.7, 26.0.2 · NVD
  38. High 7.5

    CVE-2023-34981 · Apache Tomcat

    A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

    Published 21 Jun 2023 · NVD
  39. Medium 6.1

    CVE-2023-30500 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 20 Jun 2023 · Fixed in 1.8.1.3 · NVD, WPVulnerability
  40. High 7.2

    CVE-2023-29297 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  41. Medium 4.3

    CVE-2023-29296 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to modify a minor functionality of another user's data. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  42. Medium 4.3

    CVE-2023-29295 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  43. Medium 4.3

    CVE-2023-29294 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  44. Low 2.7

    CVE-2023-29293 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An admin privileged attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  45. Medium 4.9

    CVE-2023-29292 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  46. Medium 4.9

    CVE-2023-29291 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  47. Medium 5.3

    CVE-2023-29290 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  48. Medium 6.5

    CVE-2023-29289 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an XML Injection vulnerability. An attacker with low privileges can trigger a specially crafted script to a security feature bypass. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  49. Medium 4.3

    CVE-2023-29288 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A privileged attacker could leverage this vulnerability to modify a minor functionality of another user's data. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  50. Medium 5.3

    CVE-2023-29287 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Information Exposure vulnerability that could lead to a security feature bypass. An attacker could leverage this vulnerability to leak minor user data. Exploitation of this issue does not require user interaction..

    Published 15 Jun 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.