UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,065
Published in 7 days
648
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,065 vulnerabilities
  1. High 8.8

    CVE-2022-39234 · GLPI

    GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Deleted/deactivated user could continue to use their account as long as its cookie is valid. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds.

    Published 3 Nov 2022 · Fixed in 10.0.4 · NVD
  2. Medium 6.1

    CVE-2022-3844 · Webmin

    A vulnerability, which was classified as problematic, was found in Webmin 2.001. Affected is an unknown function of the file xterm/index.cgi. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.003 is able to address this issue. The patch is identified as d3d33af3c0c3fd3a889c84e287a038b7a457d811. It is recommended to upgrade…

    Published 2 Nov 2022 · NVD
  3. Medium 5.4

    CVE-2022-2904 · GitLab

    A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 It was possible to exploit a vulnerability in the external status checks feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of…

    Published 2 Nov 2022 · Fixed in 15.2.5, 15.3.4 · NVD
  4. Medium 5.3

    CVE-2022-39378 · Discourse

    Discourse is a platform for community discussion. Under certain conditions, a user badge may have been awarded based on a user's activity in a topic with restricted access. Before this vulnerability was disclosed, the topic title of the topic associated with the user badge may be viewed by any user. If there are sensitive information in the topic title, it will therefore have been exposed. This…

    Published 2 Nov 2022 · Fixed in 2.8.9 · NVD
  5. High 8.8

    CVE-2022-39356 · Discourse

    Discourse is a platform for community discussion. Users who receive an invitation link that is not scoped to a single email address can enter any non-admin user's email and gain access to their account when accepting the invitation. All users should upgrade to the latest version. A workaround is temporarily disabling invitations with `SiteSetting.max_invites_per_day = 0` or scope them to…

    Published 2 Nov 2022 · Fixed in 2.8.10 · NVD
  6. Medium 4.9

    CVE-2022-39241 · Discourse

    Discourse is a platform for community discussion. A malicious admin could use this vulnerability to perform port enumeration on the local host or other hosts on the internal network, as well as against hosts on the Internet. Latest `stable`, `beta`, and `test-passed` versions are now patched. As a workaround, self-hosters can use `DISCOURSE_BLOCKED_IP_BLOCKS` env var (which overrides…

    Published 2 Nov 2022 · Fixed in 2.8.10 · NVD
  7. High 7.1

    CVE-2022-43995 · sudo

    Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture.

    Published 2 Nov 2022 · Fixed in 1.9.12 · NVD
  8. Medium 6.1

    CVE-2022-43985 · Apache Airflow

    In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint.

    Published 2 Nov 2022 · Fixed in 2.4.2 · NVD
  9. Medium 6.1

    CVE-2022-43982 · Apache Airflow

    In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument.

    Published 2 Nov 2022 · Fixed in 2.4.2 · NVD
  10. Medium 4.3

    CVE-2022-38380 · Fortinet FortiOS

    An improper access control [CWE-284] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user to modify the interface settings via the API.

    Published 2 Nov 2022 · NVD
  11. High 7.5

    CVE-2022-35842 · Fortinet FortiOS

    An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and versions 6.4.0 through 6.4.9 may allow a remote unauthenticated attacker to gain information about LDAP and SAML settings configured in FortiOS.

    Published 2 Nov 2022 · NVD
  12. High 8.1

    CVE-2022-30307 · Fortinet FortiOS

    A key management error vulnerability [CWE-320] affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthenticated attacker to perform a man in the middle attack.

    Published 2 Nov 2022 · Fixed in 6.4.10, 7.0.8, 7.2.2 · NVD
  13. High 8.6

    CVE-2022-26122 · Fortinet FortiOS

    An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker to bypass the AV engine via manipulating MIME attachment with junk and pad characters in base64.

    Published 2 Nov 2022 · NVD
  14. High 7.5

    CVE-2022-3786 · Node.js, OpenSSL

    A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious…

    Published 1 Nov 2022 · Fixed in 3.0.7, 18.11.0 · NVD
  15. High 7.5

    CVE-2022-3602 · Node.js, OpenSSL

    A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious…

    Published 1 Nov 2022 · Fixed in 3.0.7, 18.11.0 · NVD
  16. High 7.1

    CVE-2022-42327 · Xen

    x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a guest can read and write the global shared xAPIC page by moving the local APIC out of xAPIC mode. Access to this shared page bypasses the expected isolation that should exist between two guests.

    Published 1 Nov 2022 · NVD
  17. Medium 5.5

    CVE-2022-42326 · Xen

    Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In case a node has been created in a transaction and it is later deleted in the same transaction, the transaction will be terminated with an error. As this error is encountered only when handling…

    Published 1 Nov 2022 · NVD
  18. Medium 5.5

    CVE-2022-42325 · Xen

    Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In case a node has been created in a transaction and it is later deleted in the same transaction, the transaction will be terminated with an error. As this error is encountered only when handling…

    Published 1 Nov 2022 · NVD
  19. Medium 5.5

    CVE-2022-42324 · Xen

    Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder. This in turn can feed a…

    Published 1 Nov 2022 · NVD
  20. Medium 6.5

    CVE-2022-42319 · Xen

    Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest, xenstored might need to allocate quite large amounts of memory temporarily. This memory is freed only after the request has been finished completely. A request is regarded to be finished only after the guest has read the response message of the request from the ring page. Thus a guest not…

    Published 1 Nov 2022 · NVD
  21. Medium 5.5

    CVE-2022-42310 · Xen

    Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base.

    Published 1 Nov 2022 · Fixed in 4.13.0 · NVD
  22. High 7.5

    CVE-2022-42252 · Apache Tomcat

    If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to…

    Published 1 Nov 2022 · Fixed in 9.0.68, 10.0.27, 10.1.1 · NVD
  23. High 8.1

    CVE-2022-42915 · curl

    curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and…

    Published 29 Oct 2022 · Fixed in 7.86.0 · NVD
  24. High 7.5

    CVE-2022-42916 · curl

    In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN…

    Published 29 Oct 2022 · Fixed in 7.86.0 · NVD
  25. Critical 9.8

    CVE-2022-2826 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. TODO

    Published 28 Oct 2022 · Fixed in 12.9.8, 12.10.7 · NVD
  26. Medium 4.9

    CVE-2022-3018 · GitLab

    An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 9.3 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 allows a project maintainer to access the DataDog integration API key from webhook logs.

    Published 28 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  27. Medium 4.3

    CVE-2022-2882 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. A malicious maintainer could exfiltrate a GitHub integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server.

    Published 28 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  28. High 8.8

    CVE-2022-0074 · OpenLiteSpeed

    Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. This affects versions from 1.6.15 before 1.7.16.1.

    Published 27 Oct 2022 · Fixed in 1.7.16.1 · NVD
  29. High 8.8

    CVE-2022-0073 · OpenLiteSpeed

    Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. This affects 1.7.0 versions before 1.7.16.1.

    Published 27 Oct 2022 · NVD
  30. Medium 5.8

    CVE-2022-0072 · OpenLiteSpeed

    Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1

    Published 27 Oct 2022 · Fixed in 1.7.16.1 · NVD
  31. Medium 6.5

    CVE-2022-39364 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to versions 22.2.10.5, 23.0.9, and 24.0.5 an attacker reading `nextcloud.log` may gain knowledge of credentials to connect to a SharePoint service. Nextcloud Server versions 23.0.9 and 24.0.5 and Nextcloud…

    Published 27 Oct 2022 · Fixed in 23.0.9, 24.0.5 · NVD
  32. Medium 4.3

    CVE-2022-39330 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versions 22.2.10, 23.0.10, and 24.0.6 are vulnerable to a logged-in attacker slowing down the system by generating a lot of database/cpu load. Nextcloud Server versions 23.0.10 and 24.0.6 and Nextcloud…

    Published 27 Oct 2022 · Fixed in 23.0.10, 24.0.6 · NVD
  33. Medium 5.3

    CVE-2022-39329 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable to exposure of information that cannot be controlled by administrators without direct database access. Versions 23.0.9 and 24.0.5 contains patches for this issue. No known workarounds are available.

    Published 27 Oct 2022 · Fixed in 23.0.9, 24.0.5 · NVD
  34. Critical 9.8

    CVE-2022-39365 · Pimcore

    RCE vulnerability in Pimcore/Mail & Dynamic Text Layout

    Published 27 Oct 2022 · Fixed in 10.5.9 · NVD, Project advisories (GitHub)
  35. High 8.8

    CVE-2022-39362 · Metabase

    Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-executed, which could pose a possible attack vector. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer automatically executes ad-hoc native queries. Now the native editor…

    Published 26 Oct 2022 · Fixed in 1.42.6, 1.43.7, 1.44.5 · NVD
  36. High 8.8

    CVE-2022-39361 · Metabase

    Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow Remote Code Execution (RCE), which can be abused by users able to write SQL queries on H2 databases. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer allows DDL…

    Published 26 Oct 2022 · Fixed in 1.42.6, 1.43.7, 1.44.5 · NVD
  37. Medium 6.5

    CVE-2022-39360 · Metabase

    Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase now blocks password…

    Published 26 Oct 2022 · Fixed in 1.42.6, 1.43.7, 1.44.5 · NVD
  38. Medium 6.5

    CVE-2022-39359 · Metabase

    Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer follow…

    Published 26 Oct 2022 · Fixed in 1.42.6, 1.43.7, 1.44.5 · NVD
  39. Medium 6.5

    CVE-2022-39358 · Metabase

    Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6.

    Published 26 Oct 2022 · Fixed in 1.42.6, 1.43.7, 1.44.5 · NVD
  40. Medium 6.5

    CVE-2022-43776 · Metabase

    The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects.

    Published 26 Oct 2022 · Fixed in 0.44.5 · NVD
  41. Medium 6.1

    CVE-2022-27913 · Joomla!

    An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components.

    Published 25 Oct 2022 · NVD
  42. Medium 5.3

    CVE-2022-27912 · Joomla!

    An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests.

    Published 25 Oct 2022 · NVD
  43. High 7.5

    CVE-2022-43680 · Expat

    In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

    Published 24 Oct 2022 · NVD
  44. High 7.5

    CVE-2022-39313 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a Denial of Service. This issue has been patched in versions 4.10.17, and 5.2.8. There are no known workarounds.

    Published 24 Oct 2022 · Fixed in 4.10.17, 5.2.8 · NVD
  45. Low 3.3

    CVE-2022-3647 · Redis

    ** DISPUTED ** A vulnerability, which was classified as problematic, was found in Redis up to 6.2.7/7.0.5. Affected is the function sigsegvHandler of the file debug.c of the component Crash Report. The manipulation leads to denial of service. The complexity of an attack is rather high. The exploitability is told to be difficult. The real existence of this vulnerability is still doubted at the…

    Published 21 Oct 2022 · Fixed in 6.2.8, 7.0.6 · NVD
  46. High 7.5

    CVE-2022-3639 · GitLab

    A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Improper data handling on branch creation could have been used to trigger high CPU usage.

    Published 21 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  47. Critical 9.8

    CVE-2022-37454 · PHP, Python

    The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

    Published 21 Oct 2022 · Fixed in 7.4.33, 8.0.25, 8.1.12 · NVD
  48. Critical 9.8

    CVE-2022-3620 · Exim

    A vulnerability was found in Exim and classified as problematic. This issue affects the function dmarc_dns_lookup of the file dmarc.c of the component DMARC Handler. The manipulation leads to use after free. The attack may be initiated remotely. The name of the patch is 12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445. It is recommended to apply a patch to fix this issue. The associated identifier of…

    Published 20 Oct 2022 · Fixed in 4.97 · NVD
  49. High 8.8

    CVE-2022-42344 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation.

    Published 20 Oct 2022 · Fixed in 2.3.7, 2.4.3 · NVD
  50. Low 3.7

    CVE-2022-41983 · F5 BIG-IP

    On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use, undisclosed conditions can cause BIG-IP to send data unencrypted even with an SSL Profile applied.

    Published 19 Oct 2022 · Fixed in 14.1.5.1, 15.1.7, 16.1.3.1 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.