UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,064
Published in 7 days
647
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,064 vulnerabilities
  1. Medium 4.3

    CVE-2022-41921 · Discourse

    Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial of service for other users when posting huge amounts of text. Users should upgrade to version 2.9.0.beta13, where a limit has been introduced. No known workarounds are available.

    Published 28 Nov 2022 · Fixed in 2.9.0 · NVD
  2. Medium 4.3

    CVE-2022-41654 · Ghost

    Unauthorized Newsletter Modification

    Published 28 Nov 2022 · Fixed in 4.48.8, 5.22.7 · NVD, Project advisories (GitHub)
  3. Critical 9.1

    CVE-2022-45152 · Moodle

    A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This…

    Published 25 Nov 2022 · Fixed in 3.9.18, 3.11.11, 4.0.5 · NVD
  4. Medium 6.5

    CVE-2022-39346 · Nextcloud

    Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.

    Published 25 Nov 2022 · Fixed in 22.2.10, 23.0.7, 24.0.3 · NVD
  5. Medium 6.5

    CVE-2022-41712 · Frappe Framework

    Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly validate the information injected by the user in the import_file parameter.

    Published 25 Nov 2022 · NVD
  6. Medium

    CVE-2022-0225 · Keycloak

    Stored XSS in groups dropdown

    Published 24 Nov 2022 · Fixed in 20.0.0 · Project advisories (GitHub)
  7. High 7.8

    CVE-2022-40304 · libxml2

    An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

    Published 23 Nov 2022 · Fixed in 2.10.3 · NVD
  8. Medium 5.4

    CVE-2022-45151 · Moodle

    The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

    Published 23 Nov 2022 · Fixed in 3.11.11, 4.0.5 · NVD
  9. Medium 6.1

    CVE-2022-45150 · Moodle

    A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in context of vulnerable website. This vulnerability may allow an attacker to perform cross-site…

    Published 23 Nov 2022 · Fixed in 3.9.18, 3.11.11, 4.0.5 · NVD
  10. Medium 5.4

    CVE-2022-45149 · Moodle

    A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable…

    Published 23 Nov 2022 · Fixed in 3.9.18, 3.11.11, 4.0.5 · NVD
  11. High 7.5

    CVE-2021-46854 · ProFTPD

    mod_radius in ProFTPD before 1.3.7c allows memory disclosure to RADIUS servers because it copies blocks of 16 characters.

    Published 23 Nov 2022 · Fixed in 1.3.7c · NVD
  12. Medium 6.5

    CVE-2022-4044 · Mattermost

    A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages.

    Published 23 Nov 2022 · Fixed in 7.4 · NVD
  13. Medium 5.4

    CVE-2022-38147 · Silverstripe CMS

    Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3).

    Published 23 Nov 2022 · Fixed in 1.11.1 · NVD
  14. Medium 5.4

    CVE-2022-37421 · Silverstripe CMS

    Silverstripe silverstripe/cms through 4.11.0 allows XSS.

    Published 23 Nov 2022 · Fixed in 4.11.3 · NVD
  15. Medium 4.8

    CVE-2022-42095 · Backdrop CMS

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.

    Published 23 Nov 2022 · NVD
  16. Medium 5.4

    CVE-2022-38145 · Silverstripe CMS

    Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the versioned history compare view.

    Published 23 Nov 2022 · Fixed in 1.11.1 · NVD
  17. Medium 5.4

    CVE-2022-37430 · Silverstripe CMS

    Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2).

    Published 23 Nov 2022 · Fixed in 4.11.13 · NVD
  18. Medium 5.4

    CVE-2022-37429 · Silverstripe CMS

    Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters.

    Published 23 Nov 2022 · Fixed in 4.11.13 · NVD
  19. High 7.5

    CVE-2022-40303 · libxml2

    An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

    Published 23 Nov 2022 · Fixed in 2.10.3 · NVD
  20. Medium 5.4

    CVE-2022-38724 · Silverstripe CMS

    Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS.

    Published 23 Nov 2022 · NVD
  21. Medium 4.8

    CVE-2022-42097 · Backdrop CMS

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .

    Published 22 Nov 2022 · NVD
  22. Medium 4.8

    CVE-2022-42094 · Backdrop CMS

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.

    Published 22 Nov 2022 · NVD
  23. Medium 6.1

    CVE-2022-38462 · Silverstripe CMS

    Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or /Security/login request.

    Published 22 Nov 2022 · Fixed in 4.11.13 · NVD
  24. High 7.8

    CVE-2022-41131 · Apache Airflow

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider versions prior to 4.1.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case HIve…

    Published 22 Nov 2022 · Fixed in 2.3.0 · NVD
  25. Medium 5.5

    CVE-2022-40954 · Apache Airflow

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Spark…

    Published 22 Nov 2022 · Fixed in 2.3.0 · NVD
  26. Critical 9.8

    CVE-2022-40189 · Apache Airflow

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Pig…

    Published 22 Nov 2022 · Fixed in 2.3.0 · NVD
  27. Critical 9.8

    CVE-2022-38649 · Apache Airflow

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airflow Pinot Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to…

    Published 22 Nov 2022 · Fixed in 2.3.0 · NVD
  28. Medium 4.8

    CVE-2022-42096 · Backdrop CMS

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.

    Published 21 Nov 2022 · NVD
  29. High 8.8

    CVE-2022-38148 · Silverstripe CMS

    Silverstripe silverstripe/framework through 4.11 allows SQL Injection.

    Published 21 Nov 2022 · NVD
  30. Medium 5.4

    CVE-2022-38146 · Silverstripe CMS

    Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3).

    Published 21 Nov 2022 · NVD
  31. Critical 9.8

    CVE-2022-4093 · Dolibarr ERP CRM

    SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization's systems, leading to a…

    Published 21 Nov 2022 · NVD
  32. Medium 6.1

    CVE-2022-43707 · MyBB

    Visual editor persistent XSS

    Published 19 Nov 2022 · Fixed in 1.8.32 · NVD, Project advisories (GitHub)
  33. Medium 4.9

    CVE-2022-43709 · MyBB

    ACP Users SQL injection

    Published 19 Nov 2022 · Fixed in 1.8.32 · NVD, Project advisories (GitHub)
  34. Medium 6.1

    CVE-2022-43708 · MyBB

    Attachment upload XSS

    Published 19 Nov 2022 · Fixed in 1.8.32 · NVD, Project advisories (GitHub)
  35. Medium 5.4

    CVE-2021-37936 · Kibana

    It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.

    Published 18 Nov 2022 · Fixed in 7.14.1 · NVD
  36. High 8.8

    CVE-2021-33621 · Ruby

    The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

    Published 18 Nov 2022 · Fixed in 2.7.7, 3.0.5, 3.1.3 · NVD
  37. Medium 6.1

    CVE-2021-22141 · Kibana

    An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.

    Published 18 Nov 2022 · Fixed in 6.8.16, 7.13.0 · NVD
  38. Critical 9.8

    CVE-2022-43138 · Dolibarr ERP CRM

    Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.

    Published 17 Nov 2022 · Fixed in 14.0.1 · NVD
  39. Critical 9.8

    CVE-2022-2166 · Mastodon

    Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.

    Published 16 Nov 2022 · NVD
  40. High 7.2

    CVE-2022-43279 · LimeSurvey

    LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php.

    Published 15 Nov 2022 · NVD
  41. High 7.5

    CVE-2022-20947 · Cisco ASA and Firepower Threat Defense

    A vulnerability in dynamic access policies (DAP) functionality of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to improper processing of HostScan data received from the Posture (HostScan)…

    Published 15 Nov 2022 · NVD
  42. Medium 5.8

    CVE-2022-20928 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the authentication and authorization flows for VPN connections in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to establish a connection as a different user. This vulnerability is due to a flaw in the authorization verifications during the VPN authentication flow. An attacker could…

    Published 15 Nov 2022 · NVD
  43. Medium 6.5

    CVE-2022-20927 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management when a device initiates SSL/TLS connections. An attacker could exploit this…

    Published 15 Nov 2022 · NVD
  44. Medium 6.5

    CVE-2022-20924 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by…

    Published 15 Nov 2022 · NVD
  45. Medium 6.8

    CVE-2022-20826 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the secure boot implementation of Cisco Secure Firewalls 3100 Series that are running Cisco Adaptive Security Appliance (ASA) Software or Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated attacker with physical access to the device to bypass the secure boot functionality. This vulnerability is due to a logic error in the boot process. An attacker…

    Published 15 Nov 2022 · NVD
  46. Medium 6.1

    CVE-2022-45402 · Apache Airflow

    In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint.

    Published 15 Nov 2022 · Fixed in 2.4.3 · NVD
  47. Medium 5.9

    CVE-2022-42132 · Liferay Portal / DXP

    The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP…

    Published 15 Nov 2022 · Fixed in 7.4.3.5 · NVD
  48. Medium 4.8

    CVE-2022-42131 · Liferay Portal / DXP

    Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.

    Published 15 Nov 2022 · Fixed in 7.4.3.4 · NVD
  49. Medium 4.3

    CVE-2022-42130 · Liferay Portal / DXP

    The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.

    Published 15 Nov 2022 · Fixed in 7.4.3.5 · NVD
  50. Medium 4.3

    CVE-2022-42129 · Liferay Portal / DXP

    An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.

    Published 15 Nov 2022 · Fixed in 7.4.3.5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.