UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,065
Published in 7 days
648
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,065 vulnerabilities
  1. Medium 5.4

    CVE-2022-3483 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 15.3.5, all versions starting from 15.4 before 15.4.4, all versions starting from 15.5 before 15.5.2. A malicious maintainer could exfiltrate a Datadog integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server.

    Published 9 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  2. High 7.5

    CVE-2022-3285 · GitLab

    Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an unauthorized attacker to prevent access to GitLab

    Published 9 Nov 2022 · Fixed in 15.2.5, 15.3.4 · NVD
  3. Medium 6.1

    CVE-2022-3280 · GitLab

    An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick users into visiting a trustworthy URL and being redirected to arbitrary content.

    Published 9 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  4. Medium 5.4

    CVE-2022-3265 · GitLab

    A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.

    Published 9 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  5. Medium 5.3

    CVE-2022-2761 · GitLab

    An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to use GitLab Flavored Markdown (GFM) references in a Jira issue to disclose the names of resources they don't have access to.

    Published 9 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  6. High 7.8

    CVE-2022-41123 · Microsoft Exchange Server

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Published 9 Nov 2022 · NVD
  7. High 8.8Actively exploited

    CVE-2022-41080 · Microsoft Exchange Server

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Published 9 Nov 2022 · NVD
  8. High 8.0

    CVE-2022-41079 · Microsoft Exchange Server

    Microsoft Exchange Server Spoofing Vulnerability

    Published 9 Nov 2022 · NVD
  9. High 8.0

    CVE-2022-41078 · Microsoft Exchange Server

    Microsoft Exchange Server Spoofing Vulnerability

    Published 9 Nov 2022 · NVD
  10. High 8.1

    CVE-2022-38023 · Samba

    Netlogon RPC Elevation of Privilege Vulnerability

    Published 9 Nov 2022 · Fixed in 4.15.13, 4.16.8, 4.17.4 · NVD
  11. High 7.2

    CVE-2022-37967 · Samba

    Windows Kerberos Elevation of Privilege Vulnerability

    Published 9 Nov 2022 · Fixed in 4.15.13, 4.16.8, 4.17.4 · NVD
  12. High 8.1

    CVE-2022-37966 · Samba

    Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability

    Published 9 Nov 2022 · Fixed in 4.15.13, 4.16.8, 4.17.4 · NVD
  13. High 7.5

    CVE-2022-45061 · Python

    An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they…

    Published 9 Nov 2022 · NVD
  14. High 7.5

    CVE-2022-45060 · Varnish Cache

    An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a…

    Published 9 Nov 2022 · Fixed in 6.0.11, 7.1.2 · NVD
  15. High 7.5

    CVE-2022-45059 · Varnish Cache

    An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.

    Published 9 Nov 2022 · Fixed in 7.1.2 · NVD
  16. Medium 6.1

    CVE-2022-27914 · Joomla!

    An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com_media.

    Published 8 Nov 2022 · Fixed in 4.2.5 · NVD
  17. High 8.1

    CVE-2022-39328 · Grafana

    Race condition allowing privilege escalation

    Published 8 Nov 2022 · Fixed in 9.2.4 · NVD, Project advisories (GitHub)
  18. Medium 5.3

    CVE-2022-39307 · Grafana

    User enumeration via forget password

    Published 8 Nov 2022 · Fixed in 8.x, 8.5.15, 9.2.4 · NVD, Project advisories (GitHub)
  19. High 8.1

    CVE-2022-39306 · Grafana

    Email addresses and usernames can not be trusted

    Published 8 Nov 2022 · Fixed in 8.x, 8.5.15, 9.2.4 · NVD, Project advisories (GitHub)
  20. High 7.8

    CVE-2022-42919 · Python

    Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine. Pickles can…

    Published 7 Nov 2022 · Fixed in 3.9.16, 3.10.9 · NVD
  21. Medium 6.1

    CVE-2022-3869 · Froxlor

    Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.

    Published 5 Nov 2022 · Fixed in 0.10.38.2 · NVD
  22. Medium 6.5

    CVE-2022-43572 · Splunk Enterprise

    In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk (S2S) or HTTP Event Collector (HEC) protocols to an indexer results in a blockage or denial-of-service preventing further indexing.

    Published 4 Nov 2022 · Fixed in 8.1.12, 8.2.9, 9.0.2 · NVD
  23. Medium 6.5

    CVE-2022-43570 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injection via a custom View. The XXE injection causes Splunk Web to embed incorrect documents into an error.

    Published 4 Nov 2022 · Fixed in 8.1.12, 8.2.9, 9.0.2 · NVD
  24. Medium 5.4

    CVE-2022-43569 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can inject and store arbitrary scripts that can lead to persistent cross-site scripting (XSS) in the object name of a Data Model.

    Published 4 Nov 2022 · Fixed in 8.1.12, 8.2.9, 9.0.2 · NVD
  25. Medium 6.1

    CVE-2022-43568 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a View allows for a Reflected Cross Site Scripting via JavaScript Object Notation (JSON) in a query parameter when output_mode=radio.

    Published 4 Nov 2022 · Fixed in 8.1.12, 8.2.9, 9.0.2 · NVD
  26. High 8.8

    CVE-2022-43567 · Splunk Enterprise

    In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system commands remotely through the use of specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app.

    Published 4 Nov 2022 · Fixed in 8.1.12, 8.2.9, 9.0.2 · NVD
  27. High 8.0

    CVE-2022-43566 · Splunk Enterprise

    In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more privileged user’s permissions to bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards  in the Analytics Workspace. The vulnerability requires the attacker to phish the victim by tricking them into initiating a…

    Published 4 Nov 2022 · Fixed in 8.1.12, 8.2.9, 9.0.2 · NVD
  28. High 8.8

    CVE-2022-43565 · Splunk Enterprise

    In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the ‘tstats command handles Javascript Object Notation (JSON) lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser.

    Published 4 Nov 2022 · Fixed in 8.1.12, 8.2.9 · NVD
  29. Medium 6.5

    CVE-2022-43564 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user who can create search macros and schedule search reports can cause a denial of service through the use of specially crafted search macros.

    Published 4 Nov 2022 · Fixed in 8.1.12, 8.2.9 · NVD
  30. High 8.8

    CVE-2022-43563 · Splunk Enterprise

    In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the rex search command handles field names lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot…

    Published 4 Nov 2022 · Fixed in 8.1.12, 8.2.9 · NVD
  31. Medium 5.4

    CVE-2022-43562 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote authenticated user conduct various attacks against the system, including cross-site scripting and cache poisoning.

    Published 4 Nov 2022 · Fixed in 8.1.12, 8.2.9, 9.0.2 · NVD
  32. Medium 4.6

    CVE-2022-3721 · Froxlor

    Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39.

    Published 4 Nov 2022 · Fixed in 0.10.39 · NVD
  33. High 8.8

    CVE-2022-43571 · Splunk Enterprise

    In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.

    Published 3 Nov 2022 · Fixed in 8.1.12, 8.2.9, 9.0.2 · NVD
  34. Medium 4.8

    CVE-2022-43561 · Splunk Enterprise

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts that can lead to persistent cross-site scripting (XSS). The vulnerability affects instances with Splunk Web enabled.

    Published 3 Nov 2022 · Fixed in 8.1.12, 8.2.9, 9.0.2 · NVD
  35. Medium 5.9

    CVE-2022-38712 · IBM WebSphere Application Server

    "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762."

    Published 3 Nov 2022 · Fixed in 8.0.0.15, 8.5.5.23, 9.0.5.14 · NVD
  36. Medium 4.9

    CVE-2021-37823 · OpenCart

    OpenCart 3.0.3.7 allows users to obtain database information or read server files through SQL injection in the background.

    Published 3 Nov 2022 · NVD
  37. Medium 6.5

    CVE-2022-39376 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to inject custom fields values in `mailto` links. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds.

    Published 3 Nov 2022 · Fixed in 10.0.4 · NVD
  38. Medium 5.4

    CVE-2022-39375 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to create a public RSS feed to inject malicious code in dashboards of other users. This issue has been patched, please upgrade to version 10.0.4. There are currently no known…

    Published 3 Nov 2022 · Fixed in 10.0.4 · NVD
  39. Medium 4.8

    CVE-2022-39373 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Administrator may store malicious code in entity name. This issue has been patched, please upgrade to version 10.0.4.

    Published 3 Nov 2022 · Fixed in 10.0.4 · NVD
  40. Medium 5.4

    CVE-2022-39372 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Authenticated users may store malicious code in their account information. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds.

    Published 3 Nov 2022 · Fixed in 10.0.4 · NVD
  41. Medium 5.4

    CVE-2022-39371 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Script related HTML tags in assets inventory information are not properly neutralized. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds.

    Published 3 Nov 2022 · Fixed in 10.0.4 · NVD
  42. Medium 4.3

    CVE-2022-39370 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Connected users may gain access to debug panel through the GLPI update script. This issue has been patched, please upgrade to 10.0.4. As a workaround, delete the `install/update.php` script.

    Published 3 Nov 2022 · Fixed in 10.0.4 · NVD
  43. Medium 4.8

    CVE-2022-39277 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting (XSS) attack. This issue has been patched, please upgrade to GLPI 10.0.4. There are currently no known…

    Published 3 Nov 2022 · Fixed in 10.0.4 · NVD
  44. Critical 9.8

    CVE-2022-39323 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Time based attack using a SQL injection in api REST user_token. This issue has been patched, please upgrade to version 10.0.4. As a workaround, disable login with user_token on API Rest.

    Published 3 Nov 2022 · Fixed in 10.0.4 · NVD
  45. Medium 5.3

    CVE-2022-44646 · TeamCity

    In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings

    Published 3 Nov 2022 · Fixed in 2022.10 · NVD
  46. High 7.5

    CVE-2022-44624 · TeamCity

    In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters

    Published 3 Nov 2022 · Fixed in 2022.10 · NVD
  47. High 7.5

    CVE-2022-44623 · TeamCity

    In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings

    Published 3 Nov 2022 · Fixed in 2022.10 · NVD
  48. Medium 5.3

    CVE-2022-44622 · TeamCity

    In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive

    Published 3 Nov 2022 · Fixed in 2022.10 · NVD
  49. Medium 5.3

    CVE-2022-39276 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or an external calendar in planning is subject to SSRF exploit. In case a remote script returns a redirect response, the redirect target URL is not checked against the URL allow list…

    Published 3 Nov 2022 · Fixed in 10.0.4 · NVD
  50. Medium 4.8

    CVE-2022-39262 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be used to steal credentials. This issue has been patched, please upgrade to version 10.0.4.

    Published 3 Nov 2022 · Fixed in 10.0.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.