UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,054
Published in 7 days
637
Critical in 30 days
381
Actively exploited
421

Latest vulnerabilities

39,054 vulnerabilities
  1. High 7.5

    CVE-2022-2712 · Eclipse GlassFish

    In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code. This is fixed in GlassFish 7.0.0.

    Published 27 Jan 2023 · NVD
  2. Medium 6.5

    CVE-2023-22740 · Discourse

    Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Allocation of Resources Without Limits. Users can create chat drafts of an unlimited length, which can cause a denial of service by generating an excessive load on the server. Additionally, an unlimited number of drafts were loaded when loading the user. This issue…

    Published 27 Jan 2023 · NVD
  3. Medium 6.5

    CVE-2023-23610 · GLPI

    GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access (including assets, tickets, users, ...). This issue is patched in 10.0.6.

    Published 26 Jan 2023 · Fixed in 9.5.12, 10.0.6 · NVD
  4. Medium 6.5

    CVE-2023-22739 · Discourse

    Discourse is an open source platform for community discussion. Versions prior to 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-passed) are subject to Allocation of Resources Without Limits or Throttling. As there is no limit on data contained in a draft, a malicious user can create an arbitrarily large draft, forcing the instance to a crawl. This issue is patched in versions 3.0.1…

    Published 26 Jan 2023 · Fixed in 3.0.1 · NVD
  5. High 8.5

    CVE-2023-22736 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and version 2.6.0-rc4, are vulnerable to an authorization bypass bug which allows a malicious Argo CD user to deploy Applications outside the configured allowed namespaces. Reconciled Application namespaces are specified as a comma-delimited list of glob patterns.…

    Published 26 Jan 2023 · Fixed in 2.5.8 · NVD
  6. Medium 4.8

    CVE-2023-22725 · GLPI

    GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6.

    Published 26 Jan 2023 · Fixed in 9.5.12, 10.0.6 · NVD
  7. Medium 4.8

    CVE-2023-22724 · GLPI

    GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting (XSS) payloads inside RSS links. Victims who wish to visit an RSS content and click on the link will execute the Javascript. This issue is patched in 10.0.6.

    Published 26 Jan 2023 · Fixed in 10.0.6 · NVD
  8. Medium 6.1

    CVE-2023-22722 · GLPI

    GLPI is a Free Asset and IT Management Software package. Versions 9.4.0 and above, prior to 10.0.6 are subject to Cross-site Scripting. An attacker can persuade a victim into opening a URL containing a payload exploiting this vulnerability. After exploited, the attacker can make actions as the victim or exfiltrate session cookies. This issue is patched in version 10.0.6.

    Published 26 Jan 2023 · Fixed in 9.5.12, 10.0.6 · NVD
  9. High 7.5

    CVE-2023-22500 · GLPI

    GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerability allow unauthorized access to inventory files. Thus, if anonymous access to FAQ is allowed, inventory files are accessbile by unauthenticated users. This issue is patched in version 10.0.6. As a workaround, disable native inventory and…

    Published 26 Jan 2023 · Fixed in 10.0.6 · NVD
  10. High 8.8

    CVE-2023-22482 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6.0-rc-3 are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens. OIDC providers include an `aud` (audience) claim in signed tokens. The value of that claim specifies the intended audience(s) of the…

    Published 26 Jan 2023 · Fixed in 2.3.14, 2.4.20, 2.5.8 · NVD
  11. Medium 5.4

    CVE-2023-22468 · Discourse

    Discourse is an open source platform for community discussion. Versions prior to 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests-passed), are vulnerable to cross-site Scripting. A maliciously crafted URL can be included in a post to carry out cross-site scripting attacks on sites with disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this…

    Published 26 Jan 2023 · Fixed in 2.8.13 · NVD
  12. High 8.0

    CVE-2022-4092 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation of user supplied input.

    Published 26 Jan 2023 · NVD
  13. Medium 5.5

    CVE-2022-4054 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an endpoint that allows them to capture request headers.

    Published 26 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  14. High 7.5

    CVE-2022-43917 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Application Server traditional. IBM X-Force ID: 241045.

    Published 26 Jan 2023 · NVD
  15. High 7.5

    CVE-2022-42330 · Xen

    Guests can cause Xenstore crash via soft reset When a guest issues a "Soft Reset" (e.g. for performing a kexec) the libxl based Xen toolstack will normally perform a XS_RELEASE Xenstore operation. Due to a bug in xenstored this can result in a crash of xenstored. Any other use of XS_RELEASE will have the same impact.

    Published 26 Jan 2023 · NVD
  16. Medium 4.8

    CVE-2022-41941 · GLPI

    GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6.

    Published 26 Jan 2023 · Fixed in 9.5.12, 10.0.6 · NVD
  17. High 7.5

    CVE-2022-3924 · BIND 9

    This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting…

    Published 26 Jan 2023 · Fixed in 9.16.37, 9.18.11, 9.19.9 · NVD
  18. Medium 6.4

    CVE-2022-3902 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to unmask webhook secret tokens by reviewing the logs after testing webhooks.

    Published 26 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  19. Medium 6.5

    CVE-2022-3820 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location.

    Published 26 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  20. Medium 4.9

    CVE-2022-3740 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group owner may be able to bypass External Authorization check, if it is enabled, to access git repositories and package registries by using Deploy tokens or Deploy keys .

    Published 26 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  21. High 7.5

    CVE-2022-3736 · BIND 9

    BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.

    Published 26 Jan 2023 · Fixed in 9.16.37, 9.18.11, 9.19.9 · NVD
  22. Medium 6.1

    CVE-2022-3572 · GitLab

    A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims.

    Published 26 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  23. High 7.5

    CVE-2022-3488 · BIND 9

    Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND to exit with an assertion failure. 'Broken' in this context is anything that would cause the resolver to reject the query response, such as a mismatch between query and answer name. This issue affects BIND 9 versions 9.11.4-S1 through…

    Published 26 Jan 2023 · NVD
  24. Medium 5.3

    CVE-2022-3482 · GitLab

    An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only

    Published 26 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  25. Medium 4.3

    CVE-2022-3478 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible to trigger a DoS attack by uploading a malicious nuget package.

    Published 26 Jan 2023 · Fixed in 15.4.6, 15.5.5 · NVD
  26. High 7.5

    CVE-2022-3094 · BIND 9

    Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access permissions (ACLs) and is retained during the processing of a dynamic update from a client whose access credentials are…

    Published 26 Jan 2023 · Fixed in 9.16.37, 9.18.11, 9.19.9 · NVD
  27. Critical 9.8

    CVE-2020-22452 · phpMyAdmin

    SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.

    Published 26 Jan 2023 · Fixed in 5.2.0 · NVD
  28. Low 3.5

    CVE-2022-39324 · Grafana

    Spoofing originalUrl of snapshots

    Published 26 Jan 2023 · Fixed in 8.x, 8.5.16, 9.2.8 · NVD, Project advisories (GitHub)
  29. High 8.8

    CVE-2022-21953 · Rancher

    Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster

    Published 25 Jan 2023 · Fixed in 2.5.17, 2.6.10, 2.7.1 · NVD, Project advisories (GitHub)
  30. Critical 9.8

    CVE-2022-43755 · Rancher

    Rancher cattle-token is predictable

    Published 25 Jan 2023 · Fixed in 2.6.10, 2.7.1 · NVD, Project advisories (GitHub)
  31. High 8.8

    CVE-2022-43757 · Rancher

    Plaintext storage of sensitive data in Rancher API and cluster.management.cattle.io objects

    Published 25 Jan 2023 · Fixed in 2.5.17, 2.6.10, 2.7.1 · NVD, Project advisories (GitHub)
  32. Medium 6.8

    CVE-2022-43758 · Rancher

    Command injection in Rancher Git package

    Published 25 Jan 2023 · Fixed in 2.5.17, 2.6.10, 2.7.1 · NVD, Project advisories (GitHub)
  33. High 8.8

    CVE-2022-43759 · Rancher

    Privilege escalation in project role template binding (PRTB) and -promoted roles

    Published 25 Jan 2023 · Fixed in 2.5.17, 2.6.10 · NVD, Project advisories (GitHub)
  34. High 8.8

    GHSA-c45c-39f6-6gw9 · Rancher

    Rancher generated tokens not revoked after modifications made to authentication provider

    Published 25 Jan 2023 · Fixed in 2.5.17, 2.6.10, 2.7.1 · Project advisories (GitHub)
  35. Unrated

    WPV-6d57087e848c · Intuitive Custom Post Order (WordPress plugin)

    Vulnerability in Intuitive Custom Post Order

    Published 25 Jan 2023 · Fixed in 3.1.4 · WPVulnerability
  36. High 7.2

    CVE-2023-1016 · Intuitive Custom Post Order (WordPress plugin)

    Intuitive Custom Post Order: SQL Injection

    Published 25 Jan 2023 · Fixed in 3.1.5 · WPVulnerability
  37. Medium 4.3

    CVE-2022-4386 · Intuitive Custom Post Order (WordPress plugin)

    Intuitive Custom Post Order: Cross-Site Request Forgery (CSRF)

    Published 24 Jan 2023 · Fixed in 3.1.4 · WPVulnerability
  38. Medium 4.3

    CVE-2022-4385 · Intuitive Custom Post Order (WordPress plugin)

    Intuitive Custom Post Order: Missing Authorization

    Published 24 Jan 2023 · Fixed in 3.1.4 · WPVulnerability
  39. Critical 9.8

    CVE-2023-22884 · Apache Airflow

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.

    Published 21 Jan 2023 · Fixed in 2.5.1 · NVD
  40. High 7.5

    CVE-2023-24021 · ModSecurity

    Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.

    Published 20 Jan 2023 · Fixed in 2.9.7 · NVD
  41. Medium 5.5

    CVE-2023-22458 · Redis

    Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade.…

    Published 20 Jan 2023 · Fixed in 6.2.9, 7.0.8 · NVD
  42. High 7.5

    CVE-2022-48279 · ModSecurity

    In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity (C language) codebase.

    Published 20 Jan 2023 · Fixed in 2.9.6, 3.0.8 · NVD
  43. Medium 6.5

    CVE-2022-47015 · MariaDB

    MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.

    Published 20 Jan 2023 · Fixed in 10.9.6, 10.10.4, 10.11.3 · NVD
  44. Medium 5.3

    CVE-2022-39193 · MediaWiki

    An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x. Various components of this extension can expose information on the performer of edits and logged actions. This information should not allow public viewing: it is supposed to be viewable only by users with suppression rights.

    Published 20 Jan 2023 · NVD
  45. Medium 5.5

    CVE-2022-35977 · Redis

    Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no…

    Published 20 Jan 2023 · Fixed in 6.0.17, 6.2.9, 7.0.8 · NVD
  46. Medium 5.3

    CVE-2023-22912 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-CTR encryption with a repeated (aka re-used) nonce, allowing an adversary to decrypt.

    Published 20 Jan 2023 · Fixed in 1.35.9, 1.38.5 · NVD
  47. Medium 5.4

    CVE-2023-22910 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. There is XSS in Wikibase date formatting via wikibase-time-precision-* fields. This allows JavaScript execution by staff/admin users who do not intentionally have the editsitejs capability.

    Published 20 Jan 2023 · Fixed in 1.35.9, 1.38.5 · NVD
  48. Medium 4.3

    CVE-2023-22700 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Cross-Site Request Forgery (CSRF)

    Published 20 Jan 2023 · Fixed in 9.3.1 · WPVulnerability
  49. Medium 5.4

    CVE-2022-47197 · Ghost

    An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator…

    Published 19 Jan 2023 · NVD
  50. Medium 5.4

    CVE-2022-47196 · Ghost

    An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator…

    Published 19 Jan 2023 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.