UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
249
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Medium 4.3

    CVE-2023-33922 · Elementor

    Elementor Website Builder – more than just a page builder: Missing Authorization

    Published 22 May 2023 · Fixed in 3.13.3 · NVD, WPVulnerability
  2. High 8.8

    CVE-2023-2359 · Slider Revolution

    Slider Revolution: Code Injection

    Published 22 May 2023 · Fixed in 6.6.13 · NVD, WPVulnerability
  3. High 7.5

    CVE-2023-31655 · Redis

    redis v7.0.10 was discovered to contain a segmentation violation. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

    Published 18 May 2023 · NVD
  4. Medium 6.1

    CVE-2023-32960 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Cross-Site Request Forgery (CSRF)

    Published 18 May 2023 · Fixed in 1.23.4 · NVD, WPVulnerability
  5. Medium 5.4

    CVE-2023-2745 · WordPress

    WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

    Published 17 May 2023 · Fixed in 5.9.6, 6.0.4, 6.1.2 · NVD
  6. Medium 6.5

    CVE-2023-2181 · GitLab

    An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A malicious developer could use a git feature called refs/replace to smuggle content into a merge request which would not be visible during review in the UI.

    Published 12 May 2023 · Fixed in 15.9.8, 15.10.7, 15.11.3 · NVD
  7. Unrated

    WPV-cbb5cf9fe805 · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 12 May 2023 · Fixed in 3.13.2 · WPVulnerability
  8. Unrated

    WPV-8a6080fb9ce2 · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 12 May 2023 · Fixed in 3.13.2 · WPVulnerability
  9. Medium 6.5

    CVE-2023-2478 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all versions starting from 15.11 before 15.11.2. Under certain conditions, a malicious unauthorized GitLab user may use a GraphQL endpoint to attach a malicious runner to any project.

    Published 8 May 2023 · Fixed in 15.9.7, 15.10.6, 15.11.2 · NVD
  10. Medium 6.1

    CVE-2023-30777 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Cross-site Scripting

    Published 4 May 2023 · Fixed in 6.1.6 · NVD, WPVulnerability
  11. High 8.8

    CVE-2023-2182 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users thus leading to privilege escalation for those users.

    Published 3 May 2023 · Fixed in 15.10.5 · NVD
  12. Medium 5.7

    CVE-2023-1178 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a release containing a ref to another commit.

    Published 3 May 2023 · Fixed in 15.9.6, 15.10.5, 15.11.1 · NVD
  13. High 8.1

    CVE-2023-0805 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to have access to the public projects of a public group even after being banned from the public group by the owner.

    Published 3 May 2023 · Fixed in 15.9.6, 15.10.5, 15.11.1 · NVD
  14. High 8.0

    CVE-2023-0756 · GitLab

    An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The main branch of a repository with a specially crafted name allows an attacker to create repositories with malicious code, victims who clone or download these repositories will execute arbitrary code on their systems.

    Published 3 May 2023 · Fixed in 15.9.6, 15.10.5, 15.11.1 · NVD
  15. Medium 4.3

    CVE-2022-4376 · GitLab

    An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions, an attacker may be able to map a private email of a GitLab user to their GitLab account on an instance.

    Published 3 May 2023 · Fixed in 15.9.6, 15.10.5, 15.11.1 · NVD
  16. Medium 4.3

    CVE-2023-2069 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with the role of developer could use the import project feature to leak CI/CD variables.

    Published 3 May 2023 · Fixed in 12.9.8, 12.10.7, 13.0.1 · NVD
  17. Medium 6.5

    CVE-2023-1965 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to obtain access tokens granted for 3rd party Group SAML SSO logins. This feature isn't enabled by default.

    Published 3 May 2023 · Fixed in 15.9.6, 15.10.5, 15.11.1 · NVD
  18. Medium 5.4

    CVE-2023-1836 · GitLab

    A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. When viewing an XML file in a repository in "raw" mode, it can be made to render as HTML if viewed under specific circumstances

    Published 3 May 2023 · Fixed in 15.9.6, 15.10.5, 15.11.1 · NVD
  19. Medium 4.5

    CVE-2023-1265 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from all users of a GitLab instance.

    Published 3 May 2023 · Fixed in 15.9.6, 15.10.5, 15.11.1 · NVD
  20. Medium 4.3

    CVE-2023-1204 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A user could use an unverified email as a public email and commit email by sending a specifically crafted request on user update settings.

    Published 3 May 2023 · Fixed in 12.9.8, 12.10.7, 13.0.1 · NVD
  21. Medium 6.5

    CVE-2023-0485 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible that a project member demoted to a user role to read project updates by doing a diff with a pre-existing fork.

    Published 3 May 2023 · Fixed in 15.8.5, 15.9.4, 15.11.1 · NVD
  22. Medium 5.4

    CVE-2023-0155 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was possible due to framing arbitrary content on any page allowing user controlled markdown

    Published 3 May 2023 · Fixed in 15.8.5, 15.9.5, 15.10.1 · NVD
  23. Medium 5.3

    CVE-2023-22503 · Confluence

    Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Rojan Rijal of the Tinder Security Engineering team. The affected versions are before version 7.13.15,…

    Published 1 May 2023 · Fixed in 7.13.15, 7.19.7, 8.2.0 · NVD
  24. High 7.5

    CVE-2023-28847 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior to 25.0.5; as well as Nextcloud Server Enterprise 23.0.0 prior to 23.0.12.6, 24.0.0 prior to 24.0.11, and 25.0.0 prior to 25.0.5; an attacker is not restricted in verifying passwords of share links so they can just start brute forcing the…

    Published 25 Apr 2023 · Fixed in 23.0.12.6, 24.0.11, 25.0.5 · NVD
  25. Unrated

    WPV-224ebf13e69c · Elementor

    Vulnerability in Elementor Website Builder – more than just a page builder

    Published 24 Apr 2023 · Fixed in 3.12.2 · WPVulnerability
  26. High 7.2

    CVE-2023-0329 · Elementor

    Elementor Website Builder – more than just a page builder: SQL Injection

    Published 24 Apr 2023 · Fixed in 3.12.2 · NVD, WPVulnerability
  27. Medium 5.9

    CVE-2023-1255 · OpenSSL

    Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash in rare circumstances. The AES-XTS algorithm is usually used for disk encryption. The AES-XTS cipher decryption implementation for…

    Published 20 Apr 2023 · Fixed in 3.0.9, 3.1.1 · NVD
  28. Medium 5.3

    CVE-2023-27043 · Python

    The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com…

    Published 19 Apr 2023 · Fixed in 3.10.15, 3.11.10, 3.12.6 · NVD
  29. Medium 4.9

    CVE-2023-30606 · Discourse

    Discourse is an open source platform for community discussion. In affected versions a user logged as an administrator can call arbitrary methods on the `SiteSetting` class, notably `#clear_cache!` and `#notify_changed!`, which when done on a multisite instance, can affect the entire cluster resulting in a denial of service. Users not running in multisite environments are not affected. This issue…

    Published 18 Apr 2023 · Fixed in 3.1.0 · NVD
  30. Medium 5.4

    CVE-2023-30538 · Discourse

    Discourse is an open source platform for community discussion. Due to the improper sanitization of SVG files, an attacker can execute arbitrary JavaScript on the users’ browsers by uploading a crafted SVG file. This issue is patched in the latest stable and tests-passed versions of Discourse. Users are advised to upgrade. For users unable to upgrade there are two possible workarounds: enable CDN…

    Published 18 Apr 2023 · Fixed in 3.1.0 · NVD
  31. Medium 6.1

    CVE-2023-29196 · Discourse

    Discourse is an open source platform for community discussion. This vulnerability is not exploitable on the default install of Discourse. A custom feature must be enabled for it to work at all, and the attacker’s payload must pass the CSP to be executed. However, if an attacker succeeds in embedding Javascript that does pass the CSP, it could result in session hijacking for any users that view…

    Published 18 Apr 2023 · Fixed in 3.0.3, 3.1.0 · NVD
  32. Medium 6.5

    CVE-2023-28856 · Redis

    Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.

    Published 18 Apr 2023 · Fixed in 6.0.19, 6.2.12, 7.0.11 · NVD
  33. Low 2.7

    CVE-2023-28440 · Discourse

    Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a long-running request and eventual timeout. This has the greatest potential impact in shared hosting environments where admins are untrusted. This issue has been addressed in versions 3.0.3 and 3.1.0.beta4. Users are advised to upgrade.…

    Published 18 Apr 2023 · Fixed in 3.0.3 · NVD
  34. Medium 4.9

    CVE-2023-21982 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Apr 2023 · NVD
  35. High 7.1

    CVE-2023-21980 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker.…

    Published 18 Apr 2023 · NVD
  36. Medium 4.9

    CVE-2023-21977 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Apr 2023 · NVD
  37. Medium 4.9

    CVE-2023-21976 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Apr 2023 · NVD
  38. Medium 4.9

    CVE-2023-21972 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 18 Apr 2023 · NVD
  39. Low 3.7

    CVE-2023-21968 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to…

    Published 18 Apr 2023 · NVD
  40. Medium 5.9

    CVE-2023-21967 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java…

    Published 18 Apr 2023 · Fixed in 8 · NVD
  41. Medium 4.9

    CVE-2023-21966 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 18 Apr 2023 · NVD
  42. Low 2.7

    CVE-2023-21963 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are 5.7.40 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 18 Apr 2023 · NVD
  43. Medium 4.9

    CVE-2023-21962 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 18 Apr 2023 · NVD
  44. Medium 4.9

    CVE-2023-21955 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Apr 2023 · NVD
  45. Medium 5.9

    CVE-2023-21954 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise…

    Published 18 Apr 2023 · Fixed in 8 · NVD
  46. Medium 4.9

    CVE-2023-21953 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Apr 2023 · NVD
  47. Medium 4.4

    CVE-2023-21947 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 18 Apr 2023 · NVD
  48. Medium 6.5

    CVE-2023-21946 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Apr 2023 · NVD
  49. Medium 4.9

    CVE-2023-21945 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Apr 2023 · NVD
  50. Medium 4.4

    CVE-2023-21940 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 18 Apr 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.