UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,065
Published in 7 days
648
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,065 vulnerabilities
  1. High 7.5

    CVE-2022-29055 · Fortinet FortiProxy, Fortinet FortiOS

    A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x, FortiProxy version 7.0.0 through 7.0.4, 2.0.0 through 2.0.9, 1.2.x allows a remote unauthenticated or authenticated attacker to crash the sslvpn daemon via an HTTP GET request.

    Published 18 Oct 2022 · Fixed in 6.2.11, 6.4.10, 7.0.7 · NVD
  2. Critical 9.8Actively exploited

    CVE-2022-40684 · Fortinet FortiProxy, Fortinet FortiOS

    An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

    Published 18 Oct 2022 · Fixed in 7.0.7, 7.2.2 · NVD
  3. Medium 5.3

    CVE-2022-39315 · Kirby

    User enumeration in the brute force protection

    Published 18 Oct 2022 · Fixed in 3.5.8.2, 3.6.6.2, 3.7.5.1 · NVD, Project advisories (GitHub)
  4. Low 3.7

    CVE-2022-39314 · Kirby

    User enumeration in the code-based login and password reset forms

    Published 18 Oct 2022 · Fixed in 3.5.8.2, 3.6.6.2, 3.7.5.1 · NVD, Project advisories (GitHub)
  5. High 7.5

    CVE-2022-40696 · Advanced Custom Fields

    Advanced Custom Fields (ACF®): Exposure of Sensitive Information to an Unauthorized Actor

    Published 18 Oct 2022 · NVD, WPVulnerability
  6. High 7.8

    CVE-2022-3569 · Zimbra Collaboration

    Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior, where the 'zimbra' user can effectively coerce postfix into running arbitrary commands as 'root'.

    Published 17 Oct 2022 · NVD
  7. High 7.5

    CVE-2022-3559 · Exim

    A vulnerability was found in Exim and classified as problematic. This issue affects some unknown processing of the component Regex Handler. The manipulation leads to use after free. The name of the patch is 4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2. It is recommended to apply a patch to fix this issue. The identifier VDB-211073 was assigned to this vulnerability.

    Published 17 Oct 2022 · Fixed in 4.97 · NVD
  8. Medium 4.3

    CVE-2022-3351 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. A user's primary email may be disclosed to an attacker through group member events webhooks.

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  9. Medium 4.3

    CVE-2022-3331 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab's Zentao integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Zentao project issues.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  10. Medium 4.3

    CVE-2022-3330 · GitLab

    It was possible for a guest user to read a todo targeting an inaccessible note in Gitlab CE/EE affecting all versions from 15.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1.

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  11. Medium 4.3

    CVE-2022-3325 · GitLab

    Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. Allowed for editing the approval rules via the API by an unauthorised user.

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  12. Medium 4.3

    CVE-2022-3293 · GitLab

    Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  13. Medium 6.5

    CVE-2022-3291 · GitLab

    Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 can leak sensitive information via cache

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  14. Medium 4.3

    CVE-2022-3288 · GitLab

    A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the content of the default branch would be expected.

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  15. Medium 5.3

    CVE-2022-3286 · GitLab

    Lack of IP address checking in GitLab EE affecting all versions from 14.2 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows a group member to bypass IP restrictions when using a deploy token

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  16. High 7.5

    CVE-2022-3283 · GitLab

    A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning an issue with special crafted content added to the description could have been used to trigger high CPU usage.

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  17. Medium 6.5

    CVE-2022-3279 · GitLab

    An unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to prevent access to job logs

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  18. Medium 6.5

    CVE-2022-3067 · GitLab

    An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. It was possible for an authenticated user to read arbitrary projects' content given the project's ID.

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  19. Medium 5.4

    CVE-2022-3066 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.0 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. It was possible for an unauthorised user to create issues in a project.

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  20. High 7.3

    CVE-2022-3060 · GitLab

    Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests

    Published 17 Oct 2022 · NVD
  21. High 7.5

    CVE-2022-3031 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It may be possible for an attacker to guess a user's password by brute force by sending crafted requests to a specific endpoint, even if the victim user has 2FA enabled on their account.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  22. Medium 4.3

    CVE-2022-3030 · GitLab

    An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosure of pipeline status to unauthorized users.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  23. Critical 9.9

    CVE-2022-2992 · GitLab

    A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  24. High 7.5

    CVE-2022-2931 · GitLab

    A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Malformed content added to the issue description could have been used to trigger high CPU usage.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  25. Medium 4.3

    CVE-2022-2908 · GitLab

    A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allowed an attacker to trigger high CPU usage via a special crafted input added in the Commit message field.

    Published 17 Oct 2022 · Fixed in 15.1.5, 15.2.3, 15.3.1 · NVD
  26. Critical 9.9

    CVE-2022-2884 · GitLab

    A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint

    Published 17 Oct 2022 · Fixed in 15.1.5, 15.2.3, 15.3.1 · NVD
  27. Medium 4.8

    CVE-2022-2865 · GitLab

    A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 and 15.3 prior to 15.3.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  28. Medium 4.3

    CVE-2022-2630 · GitLab

    An improper access control issue in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosure of confidential information via the Incident timeline events.

    Published 17 Oct 2022 · Fixed in 15.2.4, 15.3.2 · NVD
  29. Medium 6.5

    CVE-2022-2592 · GitLab

    A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prior to 15.3.2 allows an authenticated attacker to create a maliciously large Snippet which when requested with or without authentication places excessive load on the server, potential leading to Denial of Service.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  30. High 7.4

    CVE-2022-2533 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it…

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  31. High 8.0

    CVE-2022-2527 · GitLab

    An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2.which allowed an authenticated attacker to inject arbitrary content. A victim interacting with this content could lead to arbitrary requests.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  32. Medium 6.5

    CVE-2022-2455 · GitLab

    A business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2 allowed an authenticated and authorized user to exhaust server resources by importing a malicious project.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  33. High 7.3

    CVE-2022-2428 · GitLab

    A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  34. Critical 9.8

    CVE-2022-42968 · Gitea

    Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.

    Published 16 Oct 2022 · Fixed in 1.17.3 · NVD
  35. Critical 9.8

    CVE-2017-20149 · MikroTik RouterOS

    The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated user can trigger the vulnerability by sending a crafted HTTP request. An attacker can use this vulnerability to execute arbitrary code on the affected system, as exploited in the wild in mid-2017 and later.

    Published 15 Oct 2022 · Fixed in 6.37.5, 6.38.5 · NVD
  36. High 7.5

    CVE-2022-42341 · Adobe ColdFusion

    Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.

    Published 14 Oct 2022 · NVD
  37. High 7.5

    CVE-2022-42340 · Adobe ColdFusion

    Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.

    Published 14 Oct 2022 · NVD
  38. High 7.2

    CVE-2022-38424 · Adobe ColdFusion

    Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. Exploitation of this issue does not require user interaction, but does require administrator privileges.

    Published 14 Oct 2022 · NVD
  39. Medium 4.9

    CVE-2022-38423 · Adobe ColdFusion

    Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in information disclosure. Exploitation of this issue does not require user interaction, but does require administrator privileges.

    Published 14 Oct 2022 · NVD
  40. High 7.5

    CVE-2022-38422 · Adobe ColdFusion

    Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in information disclosure. Exploitation of this issue does not require user interaction.

    Published 14 Oct 2022 · NVD
  41. High 7.2

    CVE-2022-38421 · Adobe ColdFusion

    Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but does require administrator privileges.

    Published 14 Oct 2022 · NVD
  42. High 7.5

    CVE-2022-38420 · Adobe ColdFusion

    Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Use of Hard-coded Credentials vulnerability that could result in application denial-of-service by gaining access to start/stop arbitrary services. Exploitation of this issue does not require user interaction.

    Published 14 Oct 2022 · NVD
  43. High 7.5

    CVE-2022-38419 · Adobe ColdFusion

    Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.

    Published 14 Oct 2022 · NVD
  44. Critical 9.8

    CVE-2022-38418 · Adobe ColdFusion

    Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

    Published 14 Oct 2022 · NVD
  45. Critical 9.8

    CVE-2022-35712 · Adobe ColdFusion

    Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.

    Published 14 Oct 2022 · NVD
  46. Critical 9.8

    CVE-2022-35711 · Adobe ColdFusion

    Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.

    Published 14 Oct 2022 · NVD
  47. Critical 9.8

    CVE-2022-35710 · Adobe ColdFusion

    Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.

    Published 14 Oct 2022 · NVD
  48. Medium 5.4

    CVE-2022-35698 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.

    Published 14 Oct 2022 · Fixed in 2.4.4 · NVD
  49. Critical 9.8

    CVE-2022-35690 · Adobe ColdFusion

    Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.

    Published 14 Oct 2022 · NVD
  50. Medium 5.3

    CVE-2022-35689 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

    Published 14 Oct 2022 · Fixed in 2.4.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.