UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
235
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. High 8.8

    CVE-2023-1196 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Deserialization of Untrusted Data

    Published 3 Apr 2023 · Fixed in 5.12.5, 6.1.0 · NVD, WPVulnerability
  2. Medium 6.5

    CVE-2023-28844 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an older version and use that for uncontrolled distribution. This issue has been addressed in versions 24.0.10 and 25.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published 31 Mar 2023 · Fixed in 24.0.10, 25.0.4 · NVD
  3. Critical 9.8

    CVE-2023-29141 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.

    Published 31 Mar 2023 · Fixed in 1.35.10, 1.38.6, 1.39.3 · NVD
  4. Medium 5.3

    CVE-2023-29140 · MediaWiki

    An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. Attackers might be able to see edits for which the username has been hidden, because there is no check for rev_deleted.

    Published 31 Mar 2023 · NVD
  5. Medium 6.5

    CVE-2023-29139 · MediaWiki

    An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. When a user with checkuserlog permissions makes many CheckUserLog API requests in some configurations, denial of service can occur (RequestTimeoutException or upstream request timeout).

    Published 31 Mar 2023 · NVD
  6. Medium 4.3

    CVE-2023-29137 · MediaWiki

    An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. The UserImpactHandler for GrowthExperiments inadvertently returns the timezone preference for arbitrary users, which can be used to de-anonymize users.

    Published 31 Mar 2023 · NVD
  7. Medium 5.3

    CVE-2023-28756 · Ruby

    A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.

    Published 31 Mar 2023 · NVD
  8. Medium 5.5

    CVE-2023-27538 · curl

    An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the…

    Published 30 Mar 2023 · Fixed in 8.0.0 · NVD
  9. Medium 5.9

    CVE-2023-27537 · curl

    A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

    Published 30 Mar 2023 · NVD
  10. Medium 5.9

    CVE-2023-27536 · curl

    An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive…

    Published 30 Mar 2023 · NVD
  11. Medium 5.9

    CVE-2023-27535 · curl

    An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and…

    Published 30 Mar 2023 · NVD
  12. High 8.8

    CVE-2023-27534 · curl

    A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo…

    Published 30 Mar 2023 · NVD
  13. High 8.8

    CVE-2023-27533 · curl

    A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an…

    Published 30 Mar 2023 · NVD
  14. High 7.5

    CVE-2023-28835 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share was using a weak complexity random number generator, so when the sharer did not change it the password could be guessable to an attacker willing to brute force it. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. This issue only…

    Published 30 Mar 2023 · Fixed in 23.0.14, 24.0.10, 25.0.4 · NVD
  15. High 8.8

    CVE-2023-28833 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a file name which was not restricted and could overwrite files in the appdata directory. Administrators may have access to overwrite these files by other means but this method could be exploited by tricking an admin into uploading a…

    Published 30 Mar 2023 · Fixed in 23.0.14, 24.0.10, 25.0.4 · NVD
  16. High 7.5

    CVE-2023-28644 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denial of service. This issue has been addressed and it is recommended that the Nextcloud Server is upgraded to 25.0.3. There are no known workarounds for this vulnerability.

    Published 30 Mar 2023 · Fixed in 25.0.3 · NVD
  17. High 8.8

    CVE-2023-28643 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will replace the first one instead of being renamed to `{name} (2)`. It is recommended that the Nextcloud Server is upgraded to 25.0.3 or 24.0.9. Users unable to upgrade should avoid sharing 2 folders with…

    Published 30 Mar 2023 · Fixed in 24.0.9, 25.0.3 · NVD
  18. High 8.8

    CVE-2023-26482 · Nextcloud

    Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defined scripts, in order to generate PDFs, invoking webhooks or running scripts on the server. Due to this combination depending on the…

    Published 30 Mar 2023 · Fixed in 23.0.12.5, 24.0.10, 25.0.4 · NVD
  19. High 7.5

    CVE-2023-0836 · HAProxy

    An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.

    Published 29 Mar 2023 · Fixed in 2.2.27 · NVD
  20. Medium 5.3

    CVE-2023-0466 · OpenSSL

    The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was…

    Published 28 Mar 2023 · Fixed in 1.1.1u, 3.0.9, 3.1.1 · NVD
  21. Medium 5.3

    CVE-2023-0465 · OpenSSL

    Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to…

    Published 28 Mar 2023 · Fixed in 1.1.1u, 3.0.9, 3.1.1 · NVD
  22. High 8.1

    CVE-2023-25817 · Nextcloud

    Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This issue has been addressed andit is recommended that the Nextcloud Server is upgraded to 24.0.9. There are no known workarounds for this vulnerability.

    Published 27 Mar 2023 · Fixed in 24.0.9 · NVD
  23. Medium 4.3

    CVE-2023-22251 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Incorrect Authorization vulnerability. A low-privileged authenticated attacker could leverage this vulnerability to achieve minor information disclosure.

    Published 27 Mar 2023 · Fixed in 2.4.4 · NVD
  24. Medium 5.3

    CVE-2023-22250 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

    Published 27 Mar 2023 · Fixed in 2.4.4 · NVD
  25. Medium 4.8

    CVE-2023-22249 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 27 Mar 2023 · Fixed in 2.4.4 · NVD
  26. High 7.5

    CVE-2023-22247 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

    Published 27 Mar 2023 · Fixed in 2.4.4 · NVD
  27. High 7.1

    CVE-2023-25818 · Nextcloud

    Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and then brute force the 62^21 combinations for the password reset token. As of commit `704eb3aa` password reset attempts are now throttled. Note that 62^21 combinations would significant compute resources to brute force. None the less it is…

    Published 27 Mar 2023 · Fixed in 23.0.12.5, 24.0.10, 25.0.4 · NVD
  28. High 7.8

    CVE-2023-25820 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud Server versions 25.0.x prior to 25.0.5 and versions 24.0.x prior to 24.0.10 as well as Nextcloud Enterprise Server versions 25.0.x prior to 25.0.4, 24.0.x prior to 24.0.10, 23.0.x prior to 23.0.12.5,…

    Published 22 Mar 2023 · Fixed in 23.0.12.5, 24.0.10, 25.0.4 · NVD
  29. High 7.5

    CVE-2023-0464 · OpenSSL

    A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy…

    Published 22 Mar 2023 · Fixed in 1.1.1u, 3.0.9, 3.1.1 · NVD
  30. Medium 4.3

    CVE-2023-28708 · Apache Tomcat

    When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.…

    Published 22 Mar 2023 · Fixed in 8.5.86, 9.0.72, 10.1.6 · NVD
  31. High 8.8

    CVE-2022-46800 · LiteSpeed Cache

    LiteSpeed Cache: Cross-Site Request Forgery (CSRF)

    Published 22 Mar 2023 · Fixed in 5.3.1 · NVD, WPVulnerability
  32. Medium 5.5

    CVE-2023-28425 · Redis

    Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.

    Published 20 Mar 2023 · Fixed in 7.0.10 · NVD
  33. High 8.1

    CVE-2023-28112 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, some user provided URLs were being passed to FastImage without SSRF protection. Insufficient protections could enable attackers to trigger outbound network connections from the Discourse server to private IP addresses. This affects any site running the `tests-passed` or `beta`…

    Published 17 Mar 2023 · Fixed in 3.1.0 · NVD
  34. High 7.5

    CVE-2023-28111 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, attackers are able to bypass Discourse's server-side request forgery (SSRF) protection for private IPv4 addresses by using a IPv4-mapped IPv6 address. The issue is patched in the latest beta and tests-passed version of Discourse. version 3.1.0.beta3 of the `beta` and…

    Published 17 Mar 2023 · Fixed in 3.1.0 · NVD
  35. Medium 4.9

    CVE-2023-28107 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.0.2 of the `stable` branch and version 3.1.0.beta3 of the `beta` and `tests-passed` branches, a user logged as an administrator can request backups multiple times, which will eat up all the connections to the DB. If this is done on a site using multisite, then it can affect the whole cluster. The vulnerability is patched in…

    Published 17 Mar 2023 · Fixed in 3.1.0 · NVD
  36. Medium 5.4

    CVE-2023-25172 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this…

    Published 17 Mar 2023 · Fixed in 3.0.1, 3.1.0 · NVD
  37. Medium 6.1

    CVE-2023-26040 · Discourse

    Discourse is an open-source discussion platform. Between versions 3.1.0.beta2 and 3.1.0.beta3 of the `tests-passed` branch, editing or responding to a chat message containing malicious content could lead to a cross-site scripting attack. This issue is patched in version 3.1.0.beta3 of the `tests-passed` branch. There are no known workarounds.

    Published 17 Mar 2023 · NVD
  38. Medium 4.3

    CVE-2023-23622 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branches, the count of topics displayed for a tag is a count of all regular topics regardless of whether the topic is in a read restricted category or not. As a result, any users can technically poll a sensitive tag to determine if a new topic is…

    Published 17 Mar 2023 · Fixed in 3.0.0 · NVD
  39. Critical 9.8

    CVE-2023-28531 · OpenSSH

    ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

    Published 17 Mar 2023 · Fixed in 9.3 · NVD
  40. Medium 4.3

    CVE-2023-23935 · Discourse

    Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the `stable` branch and versions 3.1.0.beta2 and prior on the `beta` and `tests-passed` branches, the count of personal messages displayed for a tag is a count of all personal messages regardless of whether the personal message is visible to a given user. As a result, any users can technically poll a sensitive tag to…

    Published 16 Mar 2023 · Fixed in 3.0.1 · NVD
  41. Unrated

    WPV-e92602f78438 · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 16 Mar 2023 · WPVulnerability
  42. Unrated

    WPV-8057ee50410d · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 16 Mar 2023 · WPVulnerability
  43. Unrated

    WPV-555fd61b91e3 · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 16 Mar 2023 · WPVulnerability
  44. Medium 5.4

    CVE-2022-3758 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Due to improper permissions checks an unauthorised user was able to read, add or edit a users private snippet.

    Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD
  45. Medium 5.3

    CVE-2023-1072 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible to trigger a resource depletion attack due to improper filtering for number of requests to read commits details.

    Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD
  46. Medium 5.4

    CVE-2023-0050 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.

    Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD
  47. High 7.3

    CVE-2022-4331 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. If a group with SAML SSO enabled is transferred to a new namespace as a child group, it's possible previously removed malicious maintainer or owner of the child group can still gain access to the group via…

    Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD
  48. Medium 5.3

    CVE-2023-0223 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Non-project members could retrieve release descriptions via the API, even if the release visibility is restricted to project members only in the project settings.

    Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD
  49. Medium 4.3

    CVE-2022-4289 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users.

    Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD
  50. Medium 6.1

    CVE-2022-3381 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.0 to 15.7.8, 15.8 prior to 15.8.4 and 15.9 prior to 15.9.2. A crafted URL could be used to redirect users to arbitrary sites

    Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.