UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,065
Published in 7 days
648
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,065 vulnerabilities
  1. Medium 5.4

    CVE-2022-38902 · Liferay Portal / DXP

    A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic.

    Published 13 Oct 2022 · NVD
  2. High 7.2

    CVE-2022-35944 · October CMS

    Safe Mode bypass leads to authenticated Remote Code Execution

    Published 13 Oct 2022 · Fixed in 2.2.34, 3.0.66 · NVD, Project advisories (GitHub)
  3. Medium 5.3

    CVE-2022-41316 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.

    Published 12 Oct 2022 · Fixed in 1.9.10, 1.10.7, 1.11.4 · NVD
  4. Medium 6.1

    CVE-2022-41351 · Zimbra Collaboration

    In Zimbra Collaboration Suite (ZCS) 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter and changing the value of the uncheck parameter to a string (instead of default value of 10).

    Published 12 Oct 2022 · NVD
  5. Medium 6.1

    CVE-2022-41350 · Zimbra Collaboration

    In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine.

    Published 12 Oct 2022 · NVD
  6. Medium 6.1

    CVE-2022-41349 · Zimbra Collaboration

    In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/compose accepts an attachUrl parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine.

    Published 12 Oct 2022 · NVD
  7. Medium 6.1

    CVE-2022-41348 · Zimbra Collaboration

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via the onerror attribute of an IMG element, leading to information disclosure.

    Published 12 Oct 2022 · NVD
  8. High 7.8

    CVE-2022-31123 · Grafana

    Plugin signature bypass

    Published 12 Oct 2022 · Fixed in 8.5.14, 9.1.8 · NVD, Project advisories (GitHub)
  9. High 7.5

    CVE-2022-39201 · Grafana

    Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

    Published 12 Oct 2022 · Fixed in 8.5.14, 9.1.8 · NVD, Project advisories (GitHub)
  10. High 7.5

    CVE-2022-31130 · Grafana

    Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

    Published 12 Oct 2022 · Fixed in 8.5.14, 9.1.8 · NVD, Project advisories (GitHub)
  11. Medium 4.3

    CVE-2022-39229 · Grafana

    Using email as a username can block other users from signing in

    Published 12 Oct 2022 · Fixed in 8.5.14, 9.1.8 · NVD, Project advisories (GitHub)
  12. High 8.1

    CVE-2022-0030 · Palo Alto Networks PAN-OS

    An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target firewall or Panorama appliance to impersonate an existing PAN-OS administrator and perform privileged actions.

    Published 12 Oct 2022 · Fixed in 8.1.24 · NVD
  13. Critical 9.8

    CVE-2022-40871 · Dolibarr ERP CRM

    Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.

    Published 12 Oct 2022 · NVD
  14. High 7.8

    CVE-2022-41032 · .NET

    NuGet Client Elevation of Privilege Vulnerability

    Published 11 Oct 2022 · NVD
  15. High 7.5

    CVE-2022-3358 · OpenSSL

    OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5 incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(),…

    Published 11 Oct 2022 · Fixed in 3.0.6 · NVD
  16. Critical 9.0

    CVE-2022-32174 · Gogs

    Stored XSS Assignee

    Published 11 Oct 2022 · Fixed in 0.12.11 · NVD, Project advisories (GitHub)
  17. Medium 5.6

    CVE-2022-33748 · Xen

    lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be acquired nested within one another, but in respectively opposite order. With suitable timing between…

    Published 11 Oct 2022 · NVD
  18. Low 3.8

    CVE-2022-33747 · Xen

    Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. removing pages from a guest's P2M (Physical-to-Machine) mapping. When large pages are in use to map guest pages in the 2nd-stage page tables, such a removal operation may incur a memory allocation (to replace a large mapping with individual smaller ones). These memory allocations are taken from the global…

    Published 11 Oct 2022 · NVD
  19. Medium 6.5

    CVE-2022-33746 · Xen

    P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size. Therefore its freeing may take more time than is reasonable without intermediate preemption checks. Such checking for the need to preempt was so far missing.

    Published 11 Oct 2022 · NVD
  20. High 8.0

    CVE-2021-44171 · Fortinet FortiOS

    A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS version 7.0.0 through 7.0.3 allows attacker to execute privileged commands on a linked FortiSwitch via diagnostic CLI commands.

    Published 10 Oct 2022 · NVD
  21. High 7.5

    CVE-2022-39271 · Traefik

    HTTP/2 connections management could cause a deny of service

    Published 10 Oct 2022 · Fixed in 2.8.8, 2.9.0-rc5 · NVD, Project advisories (GitHub)
  22. Medium 6.5

    CVE-2022-31681 · VMware ESXi

    VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a denial of service condition on the host.

    Published 7 Oct 2022 · Fixed in 7.0 · NVD
  23. Critical 9.1

    CVE-2022-31680 · VMware vCenter Server

    The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server.

    Published 7 Oct 2022 · Fixed in 6.5 · NVD
  24. Medium 6.1

    CVE-2022-37896 · HPE ArubaOS

    A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the affected interface of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below;…

    Published 7 Oct 2022 · Fixed in 10.3.1.1 · NVD
  25. Medium 4.9

    CVE-2022-37895 · HPE ArubaOS

    An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected AP of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and…

    Published 7 Oct 2022 · Fixed in 10.3.1.1 · NVD
  26. Medium 6.5

    CVE-2022-37894 · HPE ArubaOS

    An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected AP of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and…

    Published 7 Oct 2022 · Fixed in 10.3.1.1 · NVD
  27. High 7.8

    CVE-2022-37893 · HPE ArubaOS

    An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x:…

    Published 7 Oct 2022 · Fixed in 10.3.1.1 · NVD
  28. High 7.2

    CVE-2022-42092 · Backdrop CMS

    Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. Note: Third parties dispute this and argue that advanced permissions are required.

    Published 7 Oct 2022 · NVD
  29. Medium 5.3

    CVE-2022-41414 · Liferay Portal / DXP

    An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages.

    Published 7 Oct 2022 · NVD
  30. Medium 5.4

    CVE-2022-37892 · HPE ArubaOS

    A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the affected interface of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20…

    Published 7 Oct 2022 · Fixed in 10.3.1.1 · NVD
  31. Critical 9.8

    CVE-2022-37891 · HPE ArubaOS

    Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in the execution of arbitrary commands on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9…

    Published 7 Oct 2022 · Fixed in 10.3.1.1 · NVD
  32. Critical 9.8

    CVE-2022-37890 · HPE ArubaOS

    Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in the execution of arbitrary commands on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9…

    Published 7 Oct 2022 · Fixed in 10.3.1.1 · NVD
  33. Critical 9.8

    CVE-2022-37889 · HPE ArubaOS

    There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating…

    Published 7 Oct 2022 · Fixed in 10.3.1.1 · NVD
  34. Critical 9.8

    CVE-2022-37887 · HPE ArubaOS

    There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating…

    Published 7 Oct 2022 · Fixed in 10.3.1.1 · NVD
  35. Critical 9.8

    CVE-2022-37886 · HPE ArubaOS

    There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating…

    Published 7 Oct 2022 · Fixed in 10.3.1.1 · NVD
  36. Critical 9.8

    CVE-2022-37885 · HPE ArubaOS

    There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating…

    Published 7 Oct 2022 · Fixed in 10.3.1.1 · NVD
  37. High 8.1

    CVE-2022-41672 · Apache Airflow

    In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

    Published 7 Oct 2022 · NVD
  38. High 7.5

    CVE-2022-41556 · lighttpd

    A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67.

    Published 6 Oct 2022 · Fixed in 1.4.67 · NVD
  39. Critical 9.8

    CVE-2022-37888 · HPE ArubaOS

    There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating…

    Published 6 Oct 2022 · Fixed in 10.3.1.1 · NVD
  40. High 8.8

    CVE-2022-2986 · Moodle

    Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.

    Published 6 Oct 2022 · Fixed in 3.11.9, 4.0.3 · NVD
  41. High 7.5

    CVE-2022-31008 · RabbitMQ

    Predictable credential obfuscation seed value used in Shovel and Federation plugins

    Published 5 Oct 2022 · Fixed in 3.8.32, 3.9.18, 3.10.2 · NVD, Project advisories (GitHub)
  42. High 7.2

    CVE-2022-39265 · MyBB

    Mail settings' command parameter injection

    Published 4 Oct 2022 · Fixed in 1.8.31 · NVD, Project advisories (GitHub)
  43. High 8.0Actively exploited

    CVE-2022-41082 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 3 Oct 2022 · NVD
  44. High 8.8Actively exploited

    CVE-2022-41040 · Microsoft Exchange Server

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Published 3 Oct 2022 · NVD
  45. Unrated

    WPV-bd4a99229dee · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 3 Oct 2022 · Fixed in 1.9 · WPVulnerability
  46. Unrated

    WPV-7527085ff0d4 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 3 Oct 2022 · Fixed in 1.9 · WPVulnerability
  47. Medium 4.3

    CVE-2022-40316 · Moodle

    The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.

    Published 30 Sept 2022 · Fixed in 3.9.17, 3.11.10, 4.0.4 · NVD
  48. Critical 9.8

    CVE-2022-40315 · Moodle

    A limited SQL injection risk was identified in the "browse list of users" site administration page.

    Published 30 Sept 2022 · Fixed in 3.9.17, 3.11.10, 4.0.4 · NVD
  49. Critical 9.8

    CVE-2022-40314 · Moodle

    A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.

    Published 30 Sept 2022 · Fixed in 3.9.17, 3.11.10, 4.0.4 · NVD
  50. High 7.1

    CVE-2022-40313 · Moodle

    Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.

    Published 30 Sept 2022 · Fixed in 3.9.17, 3.11.10, 4.0.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.