UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,062
Published in 7 days
645
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,062 vulnerabilities
  1. Critical 9.8

    CVE-2022-37897 · HPE ArubaOS

    There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

    Published 12 Dec 2022 · Fixed in 8.6.0.18, 8.7.1.10, 8.10.0.0 · NVD
  2. Medium 4.3

    CVE-2022-46685 · Gitea

    In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log.

    Published 12 Dec 2022 · Fixed in 1.4.5 · NVD
  3. High 7.3

    CVE-2022-46908 · SQLite

    SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

    Published 12 Dec 2022 · Fixed in 3.40.1 · NVD
  4. Medium 6.1

    CVE-2022-44637 · Redmine

    Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user.

    Published 12 Dec 2022 · Fixed in 4.2.9, 5.0.4 · NVD
  5. Medium 6.1

    CVE-2022-44031 · Redmine

    Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-formatted fields.

    Published 12 Dec 2022 · Fixed in 4.2.9, 5.0.4 · NVD
  6. Low 3.7

    CVE-2022-23485 · Sentry

    Invite code reuse via cookie manipulation

    Published 10 Dec 2022 · Fixed in 22.11.0 · NVD, Project advisories (GitHub)
  7. Medium 4.9

    CVE-2022-46831 · TeamCity

    In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources normally limited to TeamCity system administrators.

    Published 8 Dec 2022 · NVD
  8. Medium 5.3

    CVE-2022-46830 · TeamCity

    In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning.

    Published 8 Dec 2022 · NVD
  9. Low 3.3

    CVE-2022-4123 · Podman

    A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.

    Published 8 Dec 2022 · NVD
  10. Medium 5.3

    CVE-2022-4122 · Podman

    A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure.

    Published 8 Dec 2022 · NVD
  11. Medium 4.3

    CVE-2022-46158 · PrestaShop

    Potential Information exposure in the upload directory

    Published 8 Dec 2022 · Fixed in 1.7.8.8 · NVD, Project advisories (GitHub)
  12. Medium 6.5

    CVE-2022-23469 · Traefik

    Authorization header displayed in the debug logs

    Published 8 Dec 2022 · Fixed in 2.9.6 · NVD, Project advisories (GitHub)
  13. Medium 6.5

    CVE-2022-46153 · Traefik

    Routes exposed with an empty TLSOption

    Published 8 Dec 2022 · Fixed in 2.9.6 · NVD, Project advisories (GitHub)
  14. Medium 6.5

    CVE-2022-23471 · containerd

    containerd CRI stream server: Host memory exhaustion through Terminal resize goroutine leak

    Published 7 Dec 2022 · Fixed in 1.5.16, 1.6.12 · NVD, Project advisories (GitHub)
  15. Medium 6.1

    CVE-2022-45122 · Movable Type

    Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type 6.8.7 and earlier (Movable Type 6 Series), Movable Type Advanced 6.8.7 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and…

    Published 7 Dec 2022 · Fixed in 6.8.7, 7.9.6 · NVD
  16. Medium 6.5

    CVE-2022-45113 · Movable Type

    Improper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to access a specially crafted URL may allow a remote unauthenticated attacker to set a specially crafted URL to the Reset Password page and conduct a phishing attack. Affected products/versions are as follows: Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type…

    Published 7 Dec 2022 · Fixed in 6.8.7, 7.9.6 · NVD
  17. High 7.2

    CVE-2022-43660 · Movable Type

    Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage of Content Types' may execute an arbitrary Perl script and/or an arbitrary OS command. Affected products/versions are as follows: Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier…

    Published 7 Dec 2022 · Fixed in 7.9.6 · NVD
  18. High 8.7

    CVE-2022-41800 · F5 BIG-IP

    In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 7 Dec 2022 · NVD
  19. High 8.8

    CVE-2022-41622 · F5 BIG-IP

    In all versions,  BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 7 Dec 2022 · NVD
  20. High 7.5

    CVE-2022-44030 · Redmine

    Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configuration, this may require login as a registered user.

    Published 6 Dec 2022 · NVD
  21. Medium 5.4

    CVE-2022-40680 · Fortinet FortiOS

    A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages.

    Published 6 Dec 2022 · NVD
  22. Critical 9.8

    CVE-2022-35843 · Fortinet FortiProxy, Fortinet FortiOS

    An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9, 6.2 all versions, 6.0 all versions and FortiProxy SSH login component 7.0.0 through 7.0.5, 2.0.0 through 2.0.10, 1.2.0 all versions may allow a remote and unauthenticated attacker to login into the device via sending specially crafted…

    Published 6 Dec 2022 · NVD
  23. High 7.5

    CVE-2022-30305 · Fortinet FortiSandbox

    An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4.1.0 through 4.1.1, 4.0.0 through 4.0.2, 3.3.0 through 3.3.3, 3.2.0 through 3.2.2,3.1.0 through 3.1.1 and 3.0.0 through 3.0.2 may allow a remote attacker to repeatedly enter incorrect credentials without causing a log entry, and with no…

    Published 6 Dec 2022 · NVD
  24. High 7.2

    CVE-2022-45912 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUploader by an authenticated admin user. An authenticated admin user can upload files through the ClientUploader utility, and traverse to any other directory for remote code execution.

    Published 5 Dec 2022 · NVD
  25. Medium 6.1

    CVE-2022-43556 · Concrete CMS

    Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output is not sanitized. The Concrete CMS security team has ranked this 4.2 with CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Thanks @_akbar_jafarli_ for reporting. Remediate by updating to Concrete CMS 8.5.10 and Concrete CMS 9.1.3.

    Published 5 Dec 2022 · Fixed in 8.5.10 · NVD
  26. High 8.1

    CVE-2022-43548 · Node.js

    A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was…

    Published 5 Dec 2022 · Fixed in 14.21.1, 16.18.1 · NVD
  27. Medium 6.5

    CVE-2022-35260 · curl

    curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user…

    Published 5 Dec 2022 · Fixed in 7.86.0 · NVD
  28. High 7.5

    CVE-2022-35258 · Ivanti Connect Secure

    An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1.

    Published 5 Dec 2022 · Fixed in 9.1 · NVD
  29. Medium 6.5

    CVE-2022-35256 · Node.js

    The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

    Published 5 Dec 2022 · Fixed in 14.20.1, 16.17.1, 18.9.1 · NVD
  30. Critical 9.1

    CVE-2022-35255 · Node.js

    A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be…

    Published 5 Dec 2022 · Fixed in 16.17.1, 18.9.1 · NVD
  31. High 7.5

    CVE-2022-35254 · Ivanti Connect Secure

    An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1.

    Published 5 Dec 2022 · Fixed in 9.1 · NVD
  32. Critical 9.8

    CVE-2022-32221 · curl

    When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free…

    Published 5 Dec 2022 · Fixed in 7.86.0 · NVD
  33. High 7.5

    CVE-2022-37783 · Craft CMS

    All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to avoid Cross Site Request Forgery attacks. The CRAFT_CSRF_TOKEN cookie discloses the password hash in without encoding it whereas the…

    Published 5 Dec 2022 · NVD
  34. Critical 9.8

    CVE-2022-43516 · Zabbix

    A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)

    Published 5 Dec 2022 · Fixed in 6.0.12, 6.2.6 · NVD
  35. Critical 9.8

    CVE-2022-45315 · MikroTik RouterOS

    Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process. This vulnerability allows authenticated attackers to execute arbitrary code via a crafted packet.

    Published 5 Dec 2022 · Fixed in 7.6 · NVD
  36. High 8.8

    CVE-2022-45313 · MikroTik RouterOS

    Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arbitrary code via a crafted nova message.

    Published 5 Dec 2022 · Fixed in 7.5 · NVD
  37. Medium 5.3

    CVE-2022-43504 · WordPress

    Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7.

    Published 5 Dec 2022 · Fixed in 5.8.6, 5.9.5, 6.0.3 · NVD
  38. Medium 6.1

    CVE-2022-43500 · WordPress

    Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.

    Published 5 Dec 2022 · Fixed in 5.8.6, 5.9.5, 6.0.3 · NVD
  39. Medium 6.1

    CVE-2022-43497 · WordPress

    Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.

    Published 5 Dec 2022 · Fixed in 5.8.6, 5.9.5, 6.0.3 · NVD
  40. High 7.5

    CVE-2022-46405 · Mastodon

    Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated messages.

    Published 4 Dec 2022 · NVD
  41. Medium 4.3

    CVE-2022-46159 · Discourse

    Discourse is an open-source discussion platform. In version 2.8.13 and prior on the `stable` branch and version 2.9.0.beta14 and prior on the `beta` and `tests-passed` branches, any authenticated user can create an unlisted topic. These topics, which are not readily available to other users, can take up unnecessary site resources. A patch for this issue is available in the `main` branch of…

    Published 2 Dec 2022 · NVD
  42. Critical 9.8

    CVE-2022-46145 · authentik

    Unauthorized user creation and potential account takeover

    Published 2 Dec 2022 · Fixed in 2022.10.2, 2022.11.2 · NVD, Project advisories (GitHub)
  43. Medium 5.3

    CVE-2022-41970 · Nextcloud

    Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and previews of documents (first page) can be downloaded without being watermarked. Versions 24.0.7 and 25.0.1 contain a fix for this issue. No known workarounds are available.

    Published 1 Dec 2022 · Fixed in 24.0.7 · NVD
  44. Low 2.7

    CVE-2022-41969 · Nextcloud

    Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Versions 23.0.11, 24.0.7, and 25.0.0 contain a fix for the issue. As a workaround, don't create user accounts with long passwords.

    Published 1 Dec 2022 · Fixed in 23.0.11, 24.0.7 · NVD
  45. Medium 5.3

    CVE-2022-41968 · Nextcloud

    Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can send unnecessary amounts of data against the database. Version 23.0.10 and 24.0.5 contain patches for the issue. No known workarounds are available.

    Published 1 Dec 2022 · Fixed in 23.0.10, 24.0.5 · NVD
  46. Medium 4.3

    CVE-2022-46150 · Discourse

    Discourse is an open-source discussion platform. Prior to version 2.8.13 of the `stable` branch and version 2.9.0.beta14 of the `beta` and `tests-passed` branches, unauthorized users may learn of the existence of hidden tags and that they have been applied to topics that they have access to. This issue is patched in version 2.8.13 of the `stable` branch and version 2.9.0.beta14 of the `beta` and…

    Published 29 Nov 2022 · Fixed in 2.8.13 · NVD
  47. Medium 5.4

    CVE-2022-46148 · Discourse

    Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the `stable` branch and versions 2.9.0.beta11 and prior on the `beta` and `tests-passed` branches, users composing malicious messages and navigating to drafts page could self-XSS. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. This issue…

    Published 29 Nov 2022 · NVD
  48. Medium 4.3

    CVE-2022-41944 · Discourse

    Discourse is an open-source discussion platform. In stable versions prior to 2.8.12 and beta or tests-passed versions prior to 2.9.0.beta.13, under certain conditions, a user can see notifications for topics they no longer have access to. If there is sensitive information in the topic title, it will therefore have been exposed. This issue is patched in stable version 2.8.12, beta version…

    Published 28 Nov 2022 · NVD
  49. Medium 4.3

    CVE-2022-41921 · Discourse

    Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial of service for other users when posting huge amounts of text. Users should upgrade to version 2.9.0.beta13, where a limit has been introduced. No known workarounds are available.

    Published 28 Nov 2022 · Fixed in 2.9.0 · NVD
  50. Medium 4.3

    CVE-2022-41654 · Ghost

    Unauthorized Newsletter Modification

    Published 28 Nov 2022 · Fixed in 4.48.8, 5.22.7 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.