UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
235
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. High 7.5

    CVE-2023-0217 · OpenSSL

    An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not…

    Published 8 Feb 2023 · NVD
  2. High 7.5

    CVE-2023-0216 · OpenSSL

    An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these…

    Published 8 Feb 2023 · NVD
  3. High 7.5

    CVE-2023-0215 · OpenSSL

    The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then…

    Published 8 Feb 2023 · Fixed in 1.0.2zg, 1.1.1t, 3.0.8 · NVD
  4. High 7.5

    CVE-2022-4450 · OpenSSL

    The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file…

    Published 8 Feb 2023 · Fixed in 1.1.1t, 3.0.8 · NVD
  5. Medium 5.9

    CVE-2022-4304 · OpenSSL

    A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For…

    Published 8 Feb 2023 · Fixed in 1.0.2zg, 1.1.1t, 3.0.8 · NVD
  6. Medium 6.1

    CVE-2022-28923 · Caddy

    Open Redirect in Caddy

    Published 7 Feb 2023 · Fixed in 2.5.0-beta.1 · OSV.dev and GitHub
  7. Unrated

    WPV-062373c65986 · WP Optimize (WordPress plugin)

    Vulnerability in WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance

    Published 7 Feb 2023 · Fixed in 3.2.12 · WPVulnerability
  8. Unrated

    WPV-a7e30dbe1f41 · WP Optimize (WordPress plugin)

    Vulnerability in WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance

    Published 6 Feb 2023 · Fixed in 3.2.12 · WPVulnerability
  9. Medium 5.4

    CVE-2022-46798 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-Site Request Forgery (CSRF)

    Published 6 Feb 2023 · Fixed in 2.5.2 · WPVulnerability
  10. Medium 5.3

    CVE-2023-23615 · Discourse

    Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. As a workaround, disable embeddable comments by deleting all embeddable hosts.

    Published 3 Feb 2023 · NVD
  11. Medium 6.5

    CVE-2023-25136 · OpenSSH

    OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

    Published 3 Feb 2023 · NVD
  12. Medium 4.3

    CVE-2023-23751 · Joomla!

    An issue was discovered in Joomla! 4.0.0 through 4.2.4. A missing ACL check allows non super-admin users to access com_actionlogs.

    Published 1 Feb 2023 · NVD
  13. Medium 6.3

    CVE-2023-23750 · Joomla!

    An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.

    Published 1 Feb 2023 · NVD
  14. High 7.6

    CVE-2023-23888 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Path Traversal

    Published 30 Jan 2023 · Fixed in 1.0.119.1 · WPVulnerability
  15. Medium 5.3

    CVE-2023-23624 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches, someone can use the `exclude_tag param` to filter out topics and deduce which ones were using a specific hidden tag. This affects any Discourse site using hidden tags in public categories. This issue is patched in version 3.0.1 on the…

    Published 28 Jan 2023 · Fixed in 3.0.1 · NVD
  16. High 7.5

    CVE-2023-23621 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches, a malicious user can cause a regular expression denial of service using a carefully crafted user agent. This issue is patched in version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branches.…

    Published 28 Jan 2023 · Fixed in 3.0.1 · NVD
  17. Medium 5.3

    CVE-2023-23620 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, the contents of latest/top routes for restricted tags can be accessed by unauthorized users. This issue is patched in version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches. There are no known workarounds.

    Published 28 Jan 2023 · Fixed in 3.0.1 · NVD
  18. Medium 4.3

    CVE-2023-23616 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, when submitting a membership request, there is no character limit for the reason provided with the request. This could potentially allow a user to flood the database with a large amount of data. However it is unlikely this could be used as part…

    Published 28 Jan 2023 · Fixed in 3.0.1 · NVD
  19. Critical 9.8

    CVE-2023-0232 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Deserialization of Untrusted Data

    Published 28 Jan 2023 · Fixed in 2.5.4 · WPVulnerability
  20. Medium 5.4

    CVE-2023-0231 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 28 Jan 2023 · Fixed in 2.5.4 · WPVulnerability
  21. Medium 5.3

    CVE-2022-4255 · GitLab

    An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user email id through webhook payload.

    Published 27 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  22. High 7.5

    CVE-2022-4205 · GitLab

    In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash.

    Published 27 Jan 2023 · Fixed in 12.9.8, 15.5.5 · NVD
  23. Medium 5.3

    CVE-2022-4201 · GitLab

    A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.

    Published 27 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  24. Medium 4.3

    CVE-2022-4335 · GitLab

    A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which allows an attacker to connect to a local host.

    Published 27 Jan 2023 · Fixed in 15.4.6, 15.5.5, 15.6.1 · NVD
  25. Medium 6.5

    CVE-2023-22740 · Discourse

    Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Allocation of Resources Without Limits. Users can create chat drafts of an unlimited length, which can cause a denial of service by generating an excessive load on the server. Additionally, an unlimited number of drafts were loaded when loading the user. This issue…

    Published 27 Jan 2023 · NVD
  26. Medium 6.5

    CVE-2023-22739 · Discourse

    Discourse is an open source platform for community discussion. Versions prior to 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-passed) are subject to Allocation of Resources Without Limits or Throttling. As there is no limit on data contained in a draft, a malicious user can create an arbitrarily large draft, forcing the instance to a crawl. This issue is patched in versions 3.0.1…

    Published 26 Jan 2023 · Fixed in 3.0.1 · NVD
  27. Medium 5.4

    CVE-2023-22468 · Discourse

    Discourse is an open source platform for community discussion. Versions prior to 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests-passed), are vulnerable to cross-site Scripting. A maliciously crafted URL can be included in a post to carry out cross-site scripting attacks on sites with disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this…

    Published 26 Jan 2023 · Fixed in 2.8.13 · NVD
  28. High 8.0

    CVE-2022-4092 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation of user supplied input.

    Published 26 Jan 2023 · NVD
  29. Medium 5.5

    CVE-2022-4054 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an endpoint that allows them to capture request headers.

    Published 26 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  30. Medium 6.4

    CVE-2022-3902 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to unmask webhook secret tokens by reviewing the logs after testing webhooks.

    Published 26 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  31. Medium 6.5

    CVE-2022-3820 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location.

    Published 26 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  32. Medium 4.9

    CVE-2022-3740 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group owner may be able to bypass External Authorization check, if it is enabled, to access git repositories and package registries by using Deploy tokens or Deploy keys .

    Published 26 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  33. Medium 6.1

    CVE-2022-3572 · GitLab

    A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims.

    Published 26 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  34. Medium 5.3

    CVE-2022-3482 · GitLab

    An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only

    Published 26 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  35. Medium 4.3

    CVE-2022-3478 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible to trigger a DoS attack by uploading a malicious nuget package.

    Published 26 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  36. Medium 5.5

    CVE-2023-22458 · Redis

    Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade.…

    Published 20 Jan 2023 · Fixed in 6.2.9, 7.0.8 · NVD
  37. Medium 6.5

    CVE-2022-47015 · MariaDB

    MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.

    Published 20 Jan 2023 · Fixed in 10.9.6, 10.10.4, 10.11.3 · NVD
  38. Medium 5.3

    CVE-2022-39193 · MediaWiki

    An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x. Various components of this extension can expose information on the performer of edits and logged actions. This information should not allow public viewing: it is supposed to be viewable only by users with suppression rights.

    Published 20 Jan 2023 · NVD
  39. Medium 5.5

    CVE-2022-35977 · Redis

    Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no…

    Published 20 Jan 2023 · Fixed in 6.0.17, 6.2.9, 7.0.8 · NVD
  40. Medium 5.3

    CVE-2023-22912 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-CTR encryption with a repeated (aka re-used) nonce, allowing an adversary to decrypt.

    Published 20 Jan 2023 · Fixed in 1.35.9, 1.38.5 · NVD
  41. Medium 5.4

    CVE-2023-22910 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. There is XSS in Wikibase date formatting via wikibase-time-precision-* fields. This allows JavaScript execution by staff/admin users who do not intentionally have the editsitejs capability.

    Published 20 Jan 2023 · Fixed in 1.35.9, 1.38.5 · NVD
  42. Medium 4.9

    CVE-2023-21887 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 18 Jan 2023 · NVD
  43. Medium 4.9

    CVE-2023-21883 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Jan 2023 · NVD
  44. Low 2.7

    CVE-2023-21882 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of…

    Published 18 Jan 2023 · NVD
  45. Medium 4.9

    CVE-2023-21881 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Jan 2023 · NVD
  46. Medium 5.5

    CVE-2023-21880 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 18 Jan 2023 · NVD
  47. Medium 4.9

    CVE-2023-21879 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Jan 2023 · NVD
  48. Medium 4.9

    CVE-2023-21878 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Jan 2023 · NVD
  49. Medium 5.5

    CVE-2023-21877 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 18 Jan 2023 · NVD
  50. Medium 4.9

    CVE-2023-21876 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Jan 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.