UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
235
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Medium 5.3

    CVE-2023-21939 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java…

    Published 18 Apr 2023 · Fixed in 8 · NVD
  2. Low 3.7

    CVE-2023-21938 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to…

    Published 18 Apr 2023 · Fixed in 8 · NVD
  3. Low 3.7

    CVE-2023-21937 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to…

    Published 18 Apr 2023 · Fixed in 8 · NVD
  4. Medium 4.9

    CVE-2023-21935 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Apr 2023 · NVD
  5. Medium 4.9

    CVE-2023-21933 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 18 Apr 2023 · NVD
  6. High 7.4

    CVE-2023-21930 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java…

    Published 18 Apr 2023 · Fixed in 8 · NVD
  7. Medium 5.5

    CVE-2023-21929 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 18 Apr 2023 · NVD
  8. Medium 4.9

    CVE-2023-21920 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Apr 2023 · NVD
  9. Medium 4.9

    CVE-2023-21919 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 18 Apr 2023 · NVD
  10. Medium 4.9

    CVE-2023-21917 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Apr 2023 · NVD
  11. Medium 4.9

    CVE-2023-21913 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Apr 2023 · NVD
  12. High 7.5

    CVE-2023-21912 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.41 and prior and 8.0.30 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 18 Apr 2023 · NVD
  13. Medium 4.9

    CVE-2023-21911 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 18 Apr 2023 · NVD
  14. High 8.8

    CVE-2023-30539 · Nextcloud

    Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are system tag based files access control or files retention rules. It is recommended that the Nextcloud Server is upgraded to 24.0.11 or 25.0.5, the Nextcloud Enterprise Server to 21.0.9.11, 22.2.10.11,…

    Published 17 Apr 2023 · Fixed in 23.0.12.6, 24.0.11, 25.0.5 · NVD
  15. Medium 6.5

    CVE-2019-14944 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command-line flags. This sometimes leads to privilege escalation or remote code execution.

    Published 16 Apr 2023 · Fixed in 11.11.8, 12.0.6, 12.1.6 · NVD
  16. Medium 5.9

    CVE-2019-14942 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages (which have access control) could be sent over cleartext HTTP.

    Published 16 Apr 2023 · Fixed in 11.11.8, 12.0.6, 12.1.6 · NVD
  17. Medium 5.4

    CVE-2018-17537 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. blog-viewer has stored XSS during repository browsing, if package.json exists. .

    Published 16 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  18. Medium 5.4

    CVE-2018-17536 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the merge request page via project import.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  19. High 7.5

    CVE-2018-17455 · GitLab

    An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the "merge request approvals" feature.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  20. Medium 5.4

    CVE-2018-17454 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the issue details screen.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  21. Medium 5.3

    CVE-2018-17453 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers may have been able to obtain sensitive access-token data from Sentry logs via the GRPC::Unknown exception.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  22. Critical 9.8

    CVE-2018-17452 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  23. High 8.8

    CVE-2018-17451 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Cross Site Request Forgery (CSRF) in the Slack integration for issuing slash commands.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  24. Medium 4.3

    CVE-2018-17450 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via the Kubernetes integration, leading (for example) to disclosure of a GCP service token.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  25. High 7.5

    CVE-2018-17449 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Remote attackers could obtain sensitive information about issues, comments, and project titles via events API insecure direct object reference.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  26. High 7.5

    CVE-2018-15472 · GitLab

    An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The diff formatter using rouge can block for a long time in Sidekiq jobs without any timeout.

    Published 15 Apr 2023 · Fixed in 11.1.7, 11.2.4 · NVD
  27. Medium 4.3

    CVE-2021-30153 · MediaWiki

    An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. (It shouldn't because they are hidden.) This is related to ApiVisualEditor.

    Published 15 Apr 2023 · Fixed in 1.31.13, 1.35.2 · NVD
  28. High 7.8

    CVE-2023-28260 · .NET

    .NET DLL Hijacking Remote Code Execution Vulnerability

    Published 11 Apr 2023 · Fixed in 6.0.16, 7.0.5 · NVD
  29. High 7.3

    CVE-2023-25950 · HAProxy

    HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.

    Published 11 Apr 2023 · NVD
  30. Unrated

    WPV-4e7b282ec8a2 · WP Seopress (WordPress plugin)

    Vulnerability in SEOPress – AI SEO Plugin & On-site SEO

    Published 6 Apr 2023 · Fixed in 6.5.0.3 · WPVulnerability
  31. Medium 5.3

    CVE-2023-1787 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A search timeout could be triggered if a specific HTML payload was used in the issue description.

    Published 5 Apr 2023 · Fixed in 15.9.4 · NVD
  32. Medium 5.3

    CVE-2023-1710 · GitLab

    A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 prior to 15.10.1 allows an attacker to view the count of internal notes for a given issue.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  33. Critical 9.8

    CVE-2023-1708 · GitLab

    An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  34. Medium 4.3

    CVE-2023-1417 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group.

    Published 5 Apr 2023 · Fixed in 15.9.4 · NVD
  35. Medium 5.3

    CVE-2023-1167 · GitLab

    Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in MR.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  36. Medium 4.3

    CVE-2023-1071 · GitLab

    An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. Due to improper permissions checks it was possible for an unauthorised user to remove an issue from an epic.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  37. Low 3.8

    CVE-2023-0838 · GitLab

    An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  38. Medium 4.6

    CVE-2023-0450 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1. It was possible to add a branch with an ambiguous name that could be used to social engineer users.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  39. High 7.5

    CVE-2023-1733 · GitLab

    A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.10.1.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  40. Medium 4.9

    CVE-2023-1098 · GitLab

    An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  41. Medium 6.1

    CVE-2023-0523 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. An XSS was possible via a malicious email address for certain instances.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  42. Medium 5.3

    CVE-2023-0319 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1, allowing to read environment names supposed to be restricted to project memebers only.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  43. Medium 6.1

    CVE-2022-3513 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A specially crafted payload could lead to a reflected XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims on self-hosted instances running without strict CSP.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  44. Low 3.7

    CVE-2022-3375 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 11.10 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible to disclose the branch names when attacker has a fork of a project that was switched to private.

    Published 5 Apr 2023 · Fixed in 15.8.5, 15.9.4 · NVD
  45. High 7.2

    CVE-2023-1669 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Deserialization of Untrusted Data

    Published 5 Apr 2023 · Fixed in 6.5.0.3 · WPVulnerability
  46. Medium 6.8

    CVE-2023-28842 · Docker Engine

    Encrypted overlay network with a single endpoint is unauthenticated

    Published 4 Apr 2023 · Fixed in 20.10.24, 23.0.3 · NVD, Project advisories (GitHub)
  47. Medium 6.8

    CVE-2023-28841 · Docker Engine

    Encrypted overlay network traffic may be unencrypted

    Published 4 Apr 2023 · Fixed in 20.10.24, 23.0.3 · NVD, Project advisories (GitHub)
  48. High 8.7

    CVE-2023-28840 · Docker Engine

    Encrypted overlay network may be unauthenticated

    Published 4 Apr 2023 · Fixed in 20.10.24, 23.0.3 · NVD, Project advisories (GitHub)
  49. Unrated

    WPV-1ce4c9d3dd24 · Advanced Custom Fields

    Vulnerability in Advanced Custom Fields (ACF®)

    Published 4 Apr 2023 · Fixed in 5.12.5 · WPVulnerability
  50. Medium 4.3

    CVE-2023-28834 · Nextcloud

    Nextcloud Server is an open source personal cloud server. Nextcloud Server 24.0.0 until 24.0.6 and 25.0.0 until 25.0.4, as well as Nextcloud Enterprise Server 23.0.0 until 23.0.11, 24.0.0 until 24.0.6, and 25.0.0 until 25.0.4, have an information disclosure vulnerability. A user was able to get the full data directory path of the Nextcloud server from an API endpoint. By itself this information…

    Published 3 Apr 2023 · Fixed in 23.0.14, 24.0.10, 25.0.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.