UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
235
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Low 2.7

    CVE-2023-1084 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A malicious project Maintainer may create a Project Access Token with Owner level privileges using a crafted request.

    Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD
  2. Low 3.8

    CVE-2023-0483 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible for a project maintainer to extract a Datadog integration API key by modifying the site.

    Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD
  3. Medium 4.3

    CVE-2022-4462 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. This vulnerability could allow a user to unmask the Discord Webhook URL through viewing the raw API response.

    Published 9 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD
  4. Unrated

    WPV-f024881a8f30 · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 9 Mar 2023 · Fixed in 1.23.1 · WPVulnerability
  5. Unrated

    WPV-2924c420eb27 · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 9 Mar 2023 · Fixed in 1.23.1 · WPVulnerability
  6. Medium 6.1

    CVE-2022-4007 · GitLab

    A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 prior to 15.9.2 A cross-site scripting vulnerability was found in the title field of work items that allowed attackers to perform arbitrary actions on behalf of victims at client side.

    Published 8 Mar 2023 · Fixed in 15.7.8, 15.8.4, 15.9.2 · NVD
  7. Unrated

    WPV-b12b946beb1d · UpdraftPlus

    Vulnerability in UpdraftPlus: WP Backup & Migration Plugin

    Published 8 Mar 2023 · Fixed in 1.23.1 · WPVulnerability
  8. High 7.5

    CVE-2023-27522 · Apache HTTP Server

    HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.

    Published 7 Mar 2023 · Fixed in 2.4.56 · NVD
  9. Critical 9.8

    CVE-2023-25690 · Apache HTTP Server

    Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using…

    Published 7 Mar 2023 · NVD
  10. High 8.6

    CVE-2022-4904 · c-ares

    A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

    Published 6 Mar 2023 · Fixed in 1.19.0 · NVD
  11. Medium 5.4

    CVE-2023-0823 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 6 Mar 2023 · Fixed in 2.4.7 · WPVulnerability
  12. Medium 5.3

    CVE-2023-25819 · Discourse

    Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the `tests-passed` or `beta` branches >= 3.1.0.beta2. The issue is patched in the latest `beta` and `tests-passed` version of Discourse.

    Published 4 Mar 2023 · Fixed in 3.1.0 · NVD
  13. Low 3.7

    CVE-2022-41862 · PostgreSQL

    In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.

    Published 3 Mar 2023 · Fixed in 13.10, 14.7, 15.2 · NVD
  14. Unrated

    WPV-3b3b87c1baae · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 3 Mar 2023 · Fixed in 20.2.1 · WPVulnerability
  15. Medium 6.5

    CVE-2023-25155 · Redis

    Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9.

    Published 2 Mar 2023 · Fixed in 6.0.18, 6.2.11, 7.0.9 · NVD
  16. Unrated

    WPV-ce051045a72f · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 2 Mar 2023 · Fixed in 20.2.1 · WPVulnerability
  17. Medium 6.5

    CVE-2023-24400 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 2 Mar 2023 · Fixed in 2.4.7 · WPVulnerability
  18. Medium 5.5

    CVE-2022-36021 · Redis

    Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.

    Published 1 Mar 2023 · Fixed in 6.0.18, 6.2.11, 7.0.9 · NVD
  19. Medium 6.2

    CVE-2023-0567 · PHP

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

    Published 1 Mar 2023 · Fixed in 8.0.28, 8.1.16, 8.2.3 · NVD
  20. High 7.5

    CVE-2023-25821 · Nextcloud

    Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access Control. Secure view for internal shares can be circumvented if reshare permissions are also given. This issue is patched in versions 24.0.7 and 25.0.1. No workaround is available.

    Published 25 Feb 2023 · Fixed in 24.0.7 · NVD
  21. Medium 6.5

    CVE-2023-25816 · Nextcloud

    Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consumption. A user can configure a very long password, consuming more resources on password validation than desired. This issue is patched in 25.0.3 No workaround is available.

    Published 25 Feb 2023 · Fixed in 25.0.3 · NVD
  22. Medium 4.9

    CVE-2022-4203 · OpenSSL

    A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. The read buffer overrun might…

    Published 24 Feb 2023 · Fixed in 3.0.8 · NVD
  23. Medium 5.4

    CVE-2023-0586 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting

    Published 24 Feb 2023 · Fixed in 4.3.0 · WPVulnerability
  24. Medium 4.8

    CVE-2023-0585 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-site Scripting

    Published 24 Feb 2023 · Fixed in 4.3.0 · WPVulnerability
  25. Medium 4.2

    CVE-2023-23920 · Node.js

    An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.

    Published 23 Feb 2023 · Fixed in 16.19.1, 18.14.1, 19.6.1 · NVD
  26. High 7.5

    CVE-2023-23919 · Node.js

    A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

    Published 23 Feb 2023 · Fixed in 16.19.1, 18.14.1, 19.2.0 · NVD
  27. High 7.5

    CVE-2023-23918 · Node.js

    A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.

    Published 23 Feb 2023 · Fixed in 16.19.1, 18.14.1, 19.6.1 · NVD
  28. Medium 6.5

    CVE-2023-23916 · curl

    An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a…

    Published 23 Feb 2023 · Fixed in 7.88.0 · NVD
  29. Medium 6.5

    CVE-2023-23915 · curl

    A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when…

    Published 23 Feb 2023 · Fixed in 7.88.0 · NVD
  30. Critical 9.1

    CVE-2023-23914 · curl

    A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent…

    Published 23 Feb 2023 · Fixed in 7.88.0 · NVD
  31. High 7.5

    CVE-2023-25579 · Nextcloud

    Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing the string in the wrong order. The function is used in the `newFile()` and `newFolder()` items, which may allow to creation of paths outside of ones own space and overwriting data from other users with crafted paths. This issue has been…

    Published 22 Feb 2023 · Fixed in 23.0.12, 24.0.8, 25.0.2 · NVD
  32. High 7.5

    CVE-2023-24329 · Python

    An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

    Published 17 Feb 2023 · Fixed in 3.9.17, 3.10.12, 3.11.4 · NVD
  33. Medium 5.4

    CVE-2023-23936 · Node.js

    Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.

    Published 16 Feb 2023 · Fixed in 16.19.1, 18.14.1, 19.6.1 · NVD
  34. Medium 5.3Actively exploited

    CVE-2023-23752 · Joomla!

    An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

    Published 16 Feb 2023 · Fixed in 4.2.8 · NVD
  35. High 7.5

    CVE-2023-0662 · PHP

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space.

    Published 16 Feb 2023 · Fixed in 8.0.28, 8.1.16, 8.2.3 · NVD
  36. High 8.1

    CVE-2023-0568 · PHP

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.

    Published 16 Feb 2023 · Fixed in 8.0.28, 8.1.16, 8.2.3 · NVD
  37. High 7.8

    CVE-2023-21808 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 14 Feb 2023 · NVD
  38. Critical 9.1

    CVE-2023-25725 · HAProxy

    HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3,…

    Published 14 Feb 2023 · Fixed in 2.5.12, 2.6.9, 2.7.3 · NVD
  39. Medium 5.4

    CVE-2022-46805 · Conditional Payments For Woocommerce (WordPress plugin)

    Conditional Payments for WooCommerce: Cross-Site Request Forgery (CSRF)

    Published 14 Feb 2023 · Fixed in 2.3.2 · WPVulnerability
  40. High 7.5

    CVE-2023-0518 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. It was possible to trigger a DoS attack by uploading a malicious Helm chart.

    Published 13 Feb 2023 · Fixed in 15.6.7, 15.7.6, 15.8.1 · NVD
  41. High 8.1

    CVE-2022-4138 · GitLab

    A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a malicious project.

    Published 13 Feb 2023 · Fixed in 15.6.7, 15.7.6, 15.8.1 · NVD
  42. High 7.5

    CVE-2022-3759 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child pipelines and make a sidekiq job allocate a lot of memory. In GitLab instances where Sidekiq is…

    Published 13 Feb 2023 · Fixed in 15.6.7, 15.7.6, 15.8.1 · NVD
  43. Medium 6.5

    CVE-2022-3411 · GitLab

    A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.

    Published 13 Feb 2023 · Fixed in 15.6.7, 15.7.6, 15.8.1 · NVD
  44. Medium 5.3

    CVE-2023-25162 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.0.12 are vulnerable to server-side request forgery (SSRF). Attackers can leverage enclosed alphanumeric payloads to bypass IP filters and gain SSRF, which would allow an attacker to read crucial…

    Published 13 Feb 2023 · Fixed in 23.0.12, 24.0.8 · NVD
  45. Medium 5.3

    CVE-2023-25161 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage overflow, or cost impact when using external email services. Users should upgrade to Nextcloud Server…

    Published 13 Feb 2023 · Fixed in 23.0.12, 24.0.8 · NVD
  46. Medium 5.3

    CVE-2023-25159 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the same platform. Nextcloud Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, Nextcloud Enterprise Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, and Nextcloud Office (Richdocuments) App 6.x prior to 6.3.1 and 7.x prior to…

    Published 13 Feb 2023 · NVD
  47. Medium 5.9

    CVE-2022-43552 · curl

    A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.

    Published 9 Feb 2023 · Fixed in 7.87.0 · NVD
  48. Medium 5.7

    CVE-2023-25167 · Discourse

    Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service using a carefully crafted git URL. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this issue.

    Published 8 Feb 2023 · Fixed in 3.0.1 · NVD
  49. High 7.5

    CVE-2023-0401 · OpenSSL

    A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to…

    Published 8 Feb 2023 · NVD
  50. High 7.4

    CVE-2023-0286 · OpenSSL

    There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.…

    Published 8 Feb 2023 · Fixed in 1.0.2zg, 1.1.1t, 3.0.8 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.