UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
249
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. High 7.5

    CVE-2023-22248 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to leak another user's data. Exploitation of this issue does not require user interaction.

    Published 15 Jun 2023 · NVD
  2. High 7.5

    CVE-2023-29331 · .NET

    .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

    Published 14 Jun 2023 · NVD
  3. High 7.5

    CVE-2023-24936 · .NET

    .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

    Published 14 Jun 2023 · NVD
  4. High 7.8

    CVE-2023-24897 · .NET

    .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

    Published 14 Jun 2023 · NVD
  5. High 7.8

    CVE-2023-24895 · .NET

    .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

    Published 14 Jun 2023 · NVD
  6. High 7.3

    CVE-2023-33135 · .NET

    .NET and Visual Studio Elevation of Privilege Vulnerability

    Published 14 Jun 2023 · Fixed in 6.0.18, 7.0.7 · NVD
  7. High 7.3

    CVE-2023-33128 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 14 Jun 2023 · Fixed in 6.0.18, 7.0.7 · NVD
  8. High 7.3

    CVE-2023-33126 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 14 Jun 2023 · Fixed in 6.0.18, 7.0.7 · NVD
  9. Medium 6.5

    CVE-2023-32032 · .NET

    .NET and Visual Studio Elevation of Privilege Vulnerability

    Published 14 Jun 2023 · Fixed in 7.0.7 · NVD
  10. Medium 5.3

    CVE-2023-34250 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, an attacker could use the new topics dismissal endpoint to reveal the number of topics recently created (but not the actual content thereof) in categories they didn't have access to. This issue is patched in version 3.0.4 of the…

    Published 13 Jun 2023 · Fixed in 3.0.4 · NVD
  11. Medium 5.3

    CVE-2023-32301 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, multiple duplicate topics could be created if topic embedding is enabled. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. As a workaround, disable topic…

    Published 13 Jun 2023 · Fixed in 3.0.4 · NVD
  12. Medium 5.3

    CVE-2023-32061 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, the lack of restrictions on the iFrame tag makes it easy for an attacker to exploit the vulnerability and hide subsequent comments from other users. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5…

    Published 13 Jun 2023 · Fixed in 3.0.4 · NVD
  13. Medium 5.3

    CVE-2023-31142 · Discourse

    Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, if a site has modified their general category permissions, they could be set back to the default. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. A…

    Published 13 Jun 2023 · Fixed in 3.0.4 · NVD
  14. Medium 5.4

    CVE-2023-2455 · PostgreSQL

    Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across…

    Published 9 Jun 2023 · Fixed in 13.11, 14.8, 15.3 · NVD
  15. High 7.2

    CVE-2023-2454 · PostgreSQL

    schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.

    Published 9 Jun 2023 · Fixed in 13.11, 14.8, 15.3 · NVD
  16. Medium 5.5

    CVE-2023-33595 · Python

    CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.

    Published 7 Jun 2023 · NVD
  17. Medium 5.3

    CVE-2023-2589 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker can clone a repository from a public project, from a disallowed IP, even after the top-level group has enabled IP restrictions on the group.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  18. Medium 4.9

    CVE-2023-2485 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  19. High 7.5

    CVE-2023-2199 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  20. High 7.5

    CVE-2023-2198 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  21. Medium 6.1

    CVE-2023-2015 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A reflected XSS was possible when creating new abuse reports which allows attackers to perform arbitrary actions on behalf of victims.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  22. Medium 4.3

    CVE-2023-2013 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  23. Medium 4.3

    CVE-2023-2001 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  24. Medium 4.3

    CVE-2023-1825 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. It was possible to disclose issue notes to an unauthorized user at project export.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  25. Medium 4.3

    CVE-2023-0508 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in the NPM package API.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  26. High 7.5

    CVE-2023-0121 · GitLab

    A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.

    Published 7 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  27. Medium 5.4

    CVE-2023-2442 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.

    Published 7 Jun 2023 · Fixed in 15.11.7, 16.0.2 · NVD
  28. Medium 6.5

    CVE-2023-1621 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to commit to projects even from a restricted IP address.

    Published 6 Jun 2023 · Fixed in 15.10.5, 15.11.1 · NVD
  29. High 7.5

    CVE-2023-2132 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A DollarMathPostFilter Regular Expression Denial of Service in was possible by sending crafted payloads to the preview_markdown endpoint.

    Published 6 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  30. Medium 4.3

    CVE-2023-0921 · GitLab

    A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.

    Published 6 Jun 2023 · Fixed in 15.10.8, 15.11.7, 16.0.2 · NVD
  31. High 7.5

    CVE-2023-23755 · Joomla!

    An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods.

    Published 30 May 2023 · Fixed in 4.3.2 · NVD
  32. Medium 6.1

    CVE-2023-23754 · Joomla!

    An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen.

    Published 30 May 2023 · Fixed in 4.3.2 · NVD
  33. Medium 6.5

    CVE-2023-2650 · OpenSSL

    Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An…

    Published 30 May 2023 · Fixed in 1.1.1u, 3.0.9, 3.1.1 · NVD
  34. Unrated

    WPV-158ffac30063 · Jetpack

    Vulnerability in Jetpack – WP Security, Backup, Speed, & Growth

    Published 30 May 2023 · Fixed in 12.1.1 · WPVulnerability
  35. High 8.8

    CVE-2023-2996 · Jetpack

    Jetpack – WP Security, Backup, Speed, & Growth: Improper Input Validation

    Published 30 May 2023 · Fixed in 12.1.1 · NVD, WPVulnerability
  36. Medium 4.3

    CVE-2022-41766 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. Upon an action=rollback operation, the alreadyrolled message can leak a user name (when the user has been revision deleted/suppressed).

    Published 29 May 2023 · Fixed in 1.35.8, 1.37.5, 1.38.3 · NVD
  37. Medium 5.4

    CVE-2023-28785 · Yoast SEO

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.9 versions.

    Published 28 May 2023 · NVD
  38. Medium 6.5

    CVE-2023-32319 · Nextcloud

    Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the provided user name was not an email address. Users from version 24.0.0 onward are affected. This issue has been addressed in releases 24.0.11, 25.0.5 and 26.0.0. Users are advised to upgrade. There are…

    Published 26 May 2023 · Fixed in 24.0.11, 25.0.5 · NVD
  39. High 7.5

    CVE-2023-2825 · GitLab

    An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.

    Published 26 May 2023 · NVD
  40. Low 3.7

    CVE-2023-28322 · curl

    An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to…

    Published 26 May 2023 · Fixed in 8.1.0 · NVD
  41. Medium 5.9

    CVE-2023-28321 · curl

    An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts…

    Published 26 May 2023 · Fixed in 8.1.0 · NVD
  42. Medium 5.9

    CVE-2023-28320 · curl

    A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded…

    Published 26 May 2023 · Fixed in 8.1.0 · NVD
  43. High 7.5

    CVE-2023-28319 · curl

    A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or…

    Published 26 May 2023 · Fixed in 8.1.0 · NVD
  44. Medium 6.7

    CVE-2023-32318 · Nextcloud

    Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account the previous session would be continued and the attacker would be authenticated as the previously logged in user.…

    Published 26 May 2023 · Fixed in 25.0.6 · NVD
  45. High 7.5

    CVE-2023-32067 · c-ares

    c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.

    Published 25 May 2023 · Fixed in 1.19.1 · NVD
  46. Medium 6.5

    CVE-2023-31147 · c-ares

    c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4…

    Published 25 May 2023 · Fixed in 1.19.1 · NVD
  47. Medium 6.4

    CVE-2023-31130 · c-ares

    c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use…

    Published 25 May 2023 · Fixed in 1.19.1 · NVD
  48. Low 3.7

    CVE-2023-31124 · c-ares

    c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.

    Published 25 May 2023 · Fixed in 1.19.1 · NVD
  49. Medium 6.5

    CVE-2023-22504 · Confluence

    Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability in the attachments feature.

    Published 25 May 2023 · Fixed in 7.13.17, 7.19.9, 8.2.2 · NVD
  50. High 7.5

    CVE-2023-28709 · Apache Tomcat

    The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded…

    Published 22 May 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.