UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,062
Published in 7 days
645
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,062 vulnerabilities
  1. Medium 6.5

    CVE-2022-23548 · Discourse

    Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` branches, parsing posts can be susceptible to regular expression denial of service (ReDoS) attacks. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.

    Published 5 Jan 2023 · Fixed in 2.8.14 · NVD
  2. Medium 5.5

    CVE-2022-23546 · Discourse

    In version 2.9.0.beta14 of Discourse, an open-source discussion platform, maliciously embedded urls can leak an admin's digest of recent topics, possibly exposing private information. A patch is available for version 2.9.0.beta15. There are no known workarounds for this issue.

    Published 5 Jan 2023 · Fixed in 2.9.0 · NVD
  3. Low 3.5

    CVE-2022-46168 · Discourse

    Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta15 on the `beta` and `tests-passed` branches, recipients of a group SMTP email could see the email addresses of all other users inside the group SMTP topic. Most of the time this is not an issue as they are likely already familiar with one another's email addresses. This issue…

    Published 5 Jan 2023 · Fixed in 2.8.14 · NVD
  4. Medium 5.3

    CVE-2023-22622 · WordPress

    WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on…

    Published 5 Jan 2023 · NVD
  5. High 7.5

    CVE-2022-45143 · Apache Tomcat

    The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

    Published 3 Jan 2023 · Fixed in 9.0.69 · NVD
  6. High 7.2

    CVE-2022-45867 · MyBB

    ACP Languages local file inclusion

    Published 3 Jan 2023 · Fixed in 1.8.33 · NVD, Project advisories (GitHub)
  7. Medium 5.4

    CVE-2022-42471 · Fortinet FortiWeb

    An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.4.0 through 6.4.2, FortiWeb version 6.3.6 through 6.3.20 may allow an authenticated and remote attacker to inject arbitrary headers.

    Published 3 Jan 2023 · NVD
  8. Critical 9.8Actively exploited

    CVE-2022-42475 · Fortinet FortiProxy, Fortinet FortiOS

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

    Published 2 Jan 2023 · Fixed in 7.0.9, 7.2.2, 7.2.3 · NVD
  9. Medium 4.3

    CVE-2022-4868 · Froxlor

    Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.

    Published 31 Dec 2022 · NVD
  10. Medium 4.3

    CVE-2022-4867 · Froxlor

    Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.

    Published 31 Dec 2022 · NVD
  11. Medium 5.4

    CVE-2022-4864 · Froxlor

    Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.

    Published 30 Dec 2022 · NVD
  12. Medium 5.3

    CVE-2022-41767 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. When changes made by an IP address are reassigned to a user (using reassignEdits.php), the changes will still be attributed to the IP address on Special:Contributions when doing a range lookup.

    Published 26 Dec 2022 · Fixed in 1.35.8, 1.37.5, 1.38.3 · NVD
  13. Medium 5.3

    CVE-2022-41765 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. HTMLUserTextField exposes the existence of hidden users.

    Published 26 Dec 2022 · Fixed in 1.35.8, 1.37.5, 1.38.3 · NVD
  14. Medium 5.3

    CVE-2021-44856 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by AbuseFilter can be created via Special:ChangeContentModel due to the mishandling of the EditFilterMergedContent hook return value.

    Published 26 Dec 2022 · Fixed in 1.35.5, 1.36.3 · NVD
  15. Critical 9.8

    CVE-2021-45467 · Control Web Panel

    In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi URI. Any number of %00 instances can be used, e.g., .%00%00%00./.%00%00%00./api/account_new_create could also be used for…

    Published 26 Dec 2022 · Fixed in 0.9.8.1107 · NVD
  16. Critical 9.8

    CVE-2021-45466 · Control Web Panel

    In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder.

    Published 26 Dec 2022 · Fixed in 0.9.8.1107 · NVD
  17. Medium 5.4

    CVE-2021-44855 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stored XSS via a URL to the Upload Image feature.

    Published 26 Dec 2022 · Fixed in 1.35.5, 1.36.3 · NVD
  18. Medium 5.3

    CVE-2021-44854 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results from private wikis.

    Published 26 Dec 2022 · Fixed in 1.35.5, 1.36.3 · NVD
  19. High 8.8

    CVE-2022-42898 · Samba

    PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1…

    Published 25 Dec 2022 · Fixed in 4.15.12, 4.16.7, 4.17.3 · NVD
  20. Critical 9.8

    CVE-2022-44640 · Samba

    Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).

    Published 25 Dec 2022 · Fixed in 4.15.3, 4.16.8, 4.17.4 · NVD
  21. Medium 5.3

    CVE-2022-44381 · Snipe-IT

    Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.

    Published 25 Dec 2022 · NVD
  22. Medium 5.4

    CVE-2022-44380 · Snipe-IT

    Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.

    Published 25 Dec 2022 · Fixed in 6.0.14 · NVD
  23. Critical 9.8

    CVE-2022-44567 · Rocket.Chat

    A command injection vulnerability exists in Rocket.Chat-Desktop <3.8.14 that could allow an attacker to pass a malicious url of openInternalVideoChatWindow to shell.openExternal(), which may lead to remote code execution (internalVideoChatWindow.ts#L17). To exploit the vulnerability, the internal video chat window must be disabled or a Mac App Store build must be used…

    Published 23 Dec 2022 · Fixed in 3.8.14 · NVD
  24. High 7.5

    CVE-2022-43551 · curl

    A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII…

    Published 23 Dec 2022 · Fixed in 7.87.0 · NVD
  25. High 8.8

    CVE-2022-23555 · authentik

    Token reuse in invitation URLs leads to access control bypass via the use of a different enrollment flow

    Published 23 Dec 2022 · Fixed in 2022.10.4, 2022.11.3, 2022.11.4 · NVD, Project advisories (GitHub)
  26. Medium 6.4

    CVE-2022-46172 · authentik

    Existing Authenticated Users can Create Arbitrary Accounts

    Published 23 Dec 2022 · Fixed in 2022.10.4, 2022.11.3, 2022.11.4 · NVD, Project advisories (GitHub)
  27. Medium 5.4

    CVE-2022-44510 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 22 Dec 2022 · Fixed in 6.5.15.0 · NVD
  28. Medium 5.3

    CVE-2022-41697 · Ghost

    A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability.

    Published 22 Dec 2022 · NVD
  29. Medium 5.4

    CVE-2022-44488 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  30. Medium 5.4

    CVE-2022-44474 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  31. Medium 5.4

    CVE-2022-44471 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  32. Medium 5.4

    CVE-2022-44470 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  33. Medium 5.4

    CVE-2022-44467 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  34. Medium 5.4

    CVE-2022-44466 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  35. Medium 5.4

    CVE-2022-44465 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  36. Medium 5.4

    CVE-2022-44463 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  37. Medium 5.4

    CVE-2022-42365 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  38. Medium 5.4

    CVE-2022-42364 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  39. Medium 5.4

    CVE-2022-42362 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  40. Medium 5.4

    CVE-2022-42357 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  41. Medium 5.4

    CVE-2022-42356 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  42. Medium 5.4

    CVE-2022-42354 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  43. Medium 5.4

    CVE-2022-42352 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  44. Medium 5.4

    CVE-2022-42350 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  45. Medium 5.4

    CVE-2022-42349 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  46. Medium 5.4

    CVE-2022-42348 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  47. Medium 5.4

    CVE-2022-42346 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  48. Medium 5.4

    CVE-2022-42345 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  49. Medium 5.4

    CVE-2022-35695 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD
  50. Medium 5.4

    CVE-2022-35693 · Adobe Experience Manager

    Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.