Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,062
- Published in 7 days
- 645
- Critical in 30 days
- 382
- Actively exploited
- 421
Latest vulnerabilities
39,062 vulnerabilities- Medium 5.4
CVE-2022-30679 · Adobe Experience Manager
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 19 Dec 2022 · Fixed in 6.5.15.0 · NVD - Medium 6.1
CVE-2022-40743 · Apache Traffic Server
Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This issue affects Apache Traffic Server: 9.0.0 to 9.1.3. Users should upgrade to 9.1.4 or later versions.
Published 19 Dec 2022 · NVD - Medium 5.3
CVE-2022-37392 · Apache Traffic Server
Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Published 19 Dec 2022 · Fixed in 8.1.6, 9.1.4 · NVD - High 7.5
CVE-2022-32749 · Apache Traffic Server
Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under certain conditions. This issue affects Apache Traffic Server: from 8.0.0 through 9.1.3.
Published 19 Dec 2022 · Fixed in 8.1.6, 9.1.4 · NVD - Medium 5.4
CVE-2022-44473 · Adobe Experience Manager
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 16 Dec 2022 · Fixed in 6.5.15.0 · NVD - Medium 5.4
CVE-2022-44469 · Adobe Experience Manager
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 16 Dec 2022 · Fixed in 6.5.15.0 · NVD - Medium 5.4
CVE-2022-44468 · Adobe Experience Manager
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 16 Dec 2022 · Fixed in 6.5.15.0 · NVD - Medium 5.4
CVE-2022-44462 · Adobe Experience Manager
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 16 Dec 2022 · Fixed in 6.5.15.0 · NVD - Medium 5.4
CVE-2022-42367 · Adobe Experience Manager
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 16 Dec 2022 · Fixed in 6.5.15.0 · NVD - Medium 5.4
CVE-2022-42366 · Adobe Experience Manager
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 16 Dec 2022 · Fixed in 6.5.15.0 · NVD - Medium 5.4
CVE-2022-42360 · Adobe Experience Manager
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 16 Dec 2022 · Fixed in 6.5.15.0 · NVD - Medium 4.3
CVE-2022-42351 · Adobe Experience Manager
Adobe Experience Manager version 6.5.14 (and earlier) is affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to disclose low level confidentiality information. Exploitation of this issue does not require user interaction.
Published 16 Dec 2022 · Fixed in 6.5.15.0 · NVD - Medium 5.4
CVE-2022-38106 · SolarWinds Serv-U
This vulnerability happens in the web client versions 15.3.0 to Serv-U 15.3.1. This vulnerability affects the directory creation function.
Published 16 Dec 2022 · NVD - Medium 5.4
CVE-2022-35696 · Adobe Experience Manager
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 16 Dec 2022 · Fixed in 6.5.15.0 · NVD - Medium 5.4
CVE-2022-35694 · Adobe Experience Manager
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Published 16 Dec 2022 · Fixed in 6.5.15.0 · NVD - High 7.5
CVE-2021-35252 · SolarWinds Serv-U
Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker can be simply recovered to plaintext.
Published 16 Dec 2022 · Fixed in 15.3.2 · NVD - High 7.5
CVE-2022-3109 · FFmpeg
An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting availability.
Published 16 Dec 2022 · Fixed in 5.0.3 · NVD - Medium 6.1
CVE-2020-21219 · pfSense
Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to run arbitrary code via the RootFolder field to acme_certificate_edit.php page of the ACME package.
Published 15 Dec 2022 · NVD - High 8.2
CVE-2022-31705 · VMware ESXi
VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this…
Published 14 Dec 2022 · NVD - Critical 9.0
CVE-2022-31358 · Proxmox VE
A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/.
Published 14 Dec 2022 · Fixed in 7.2-3 · NVD - Medium 5.9
CVE-2022-3590 · WordPress
WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
Published 14 Dec 2022 · NVD - High 8.8
CVE-2022-37155 · SPIP
RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.
Published 14 Dec 2022 · NVD - High
CVE-2022-3782 · Keycloak
Path traversal via double URL encoding
Published 13 Dec 2022 · Fixed in 20.0.2 · Project advisories (GitHub) - Medium
CVE-2022-3916 · Keycloak
Session takeover with OIDC offline refreshtokens
Published 13 Dec 2022 · Fixed in 20.0.2 · Project advisories (GitHub) - High 8.8
CVE-2022-4223 · pgAdmin
The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of…
Published 13 Dec 2022 · Fixed in 6.17 · NVD - High 7.5
CVE-2022-3996 · OpenSSL
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by…
Published 13 Dec 2022 · NVD - Low 3.3
CVE-2022-31699 · VMware ESXi
VMware ESXi contains a heap-overflow vulnerability. A malicious local actor with restricted privileges within a sandbox process may exploit this issue to achieve a partial information disclosure.
Published 13 Dec 2022 · NVD - Medium 5.3
CVE-2022-31698 · VMware vCenter Server
The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to trigger a denial-of-service condition by sending a specially crafted header.
Published 13 Dec 2022 · NVD - Medium 5.5
CVE-2022-31697 · VMware vCenter Server
The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with access to a workstation that invoked a vCenter Server Appliance ISO operation (Install/Upgrade/Migrate/Restore) can access plaintext passwords used during that operation.
Published 13 Dec 2022 · NVD - High 8.8
CVE-2022-31696 · VMware ESXi
VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory leading to an escape of the ESXi sandbox.
Published 13 Dec 2022 · NVD - Medium 4.9
CVE-2022-23504 · TYPO3
Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration
Published 13 Dec 2022 · Fixed in 10.4.33, 11.5.20, 12.1.1 · NVD, Project advisories (GitHub) - High 8.8
CVE-2022-23503 · TYPO3
Arbitrary Code Execution via Form Framework
Published 13 Dec 2022 · Fixed in 10.4.33, 11.5.20, 12.1.1 · NVD, Project advisories (GitHub) - Medium 5.4
CVE-2022-23502 · TYPO3
Insufficient Session Expiration after Password Reset
Published 13 Dec 2022 · Fixed in 10.4.33, 11.5.20, 12.1.1 · NVD, Project advisories (GitHub) - Medium 6.5
CVE-2022-23501 · TYPO3
Weak Authentication in Frontend Login
Published 13 Dec 2022 · Fixed in 10.4.33, 11.5.20, 12.1.1 · NVD, Project advisories (GitHub) - High 7.5
CVE-2022-23500 · TYPO3
Denial of Service in Page Error Handling
Published 13 Dec 2022 · Fixed in 9.5.38, 10.4.33, 11.5.20 · NVD, Project advisories (GitHub) - High 8.8
CVE-2022-37912 · HPE ArubaOS
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 12 Dec 2022 · Fixed in 8.6.0.18, 8.7.1.10, 8.10.0.0 · NVD - Medium 5.5
CVE-2022-37911 · HPE ArubaOS
Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the application to consume system resources, resulting in a denial of service condition.
Published 12 Dec 2022 · Fixed in 8.6.0.18, 8.7.1.10, 8.10.0.0 · NVD - Medium 6.5
CVE-2022-37910 · HPE ArubaOS
A buffer overflow vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in a denial of service on the affected system.
Published 12 Dec 2022 · Fixed in 8.6.0.18, 8.7.1.10, 8.10.0.0 · NVD - Medium 5.3
CVE-2022-37909 · HPE ArubaOS
Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs. The scenarios in which disclosure of potentially sensitive information can occur are complex, and depend on factors beyond the control of attackers.
Published 12 Dec 2022 · Fixed in 8.6.0.18, 8.7.1.10, 8.10.0.0 · NVD - Medium 6.5
CVE-2022-37908 · HPE ArubaOS
An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.
Published 12 Dec 2022 · Fixed in 8.6.0.18, 8.7.1.10, 8.10.0.0 · NVD - High 7.5
CVE-2022-37907 · HPE ArubaOS
A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A successful attacker can cause a system hang which can only be resolved via a power cycle of the impacted controller.
Published 12 Dec 2022 · Fixed in 8.6.0.18, 8.7.1.10, 8.10.0.0 · NVD - High 8.1
CVE-2022-37906 · HPE ArubaOS
An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of the vulnerability results in the ability to delete arbitrary files on the underlying operating system.
Published 12 Dec 2022 · Fixed in 8.6.0.18, 8.7.1.10, 8.10.0.0 · NVD - High 8.8
CVE-2022-37905 · HPE ArubaOS
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.
Published 12 Dec 2022 · Fixed in 8.6.0.18, 8.7.1.10, 8.10.0.0 · NVD - High 8.8
CVE-2022-37904 · HPE ArubaOS
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.
Published 12 Dec 2022 · Fixed in 8.6.0.18, 8.7.1.10, 8.10.0.0 · NVD - High 8.8
CVE-2022-37903 · HPE ArubaOS
A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface. Successful exploitation of this vulnerability could lead to full compromise the underlying host operating system.
Published 12 Dec 2022 · Fixed in 8.6.0.18, 8.7.1.10, 8.10.0.0 · NVD - High 7.2
CVE-2022-37902 · HPE ArubaOS
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 12 Dec 2022 · Fixed in 8.6.0.18, 8.7.1.10, 8.10.0.0 · NVD - High 7.2
CVE-2022-37901 · HPE ArubaOS
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 12 Dec 2022 · Fixed in 8.6.0.18, 8.7.1.10, 8.10.0.0 · NVD - High 7.2
CVE-2022-37900 · HPE ArubaOS
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 12 Dec 2022 · Fixed in 8.6.0.18, 8.7.1.10, 8.10.0.0 · NVD - High 7.2
CVE-2022-37899 · HPE ArubaOS
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 12 Dec 2022 · Fixed in 8.6.0.18, 8.7.1.10, 8.10.0.0 · NVD - High 7.2
CVE-2022-37898 · HPE ArubaOS
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Published 12 Dec 2022 · Fixed in 6.5.4.23, 8.6.0.18, 8.7.1.10 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.