Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,065
- Published in 7 days
- 648
- Critical in 30 days
- 382
- Actively exploited
- 421
Latest vulnerabilities
39,065 vulnerabilities- Medium 5.4
CVE-2022-28851 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.
Published 30 Sept 2022 · Fixed in 6.5.14.0 · NVD - Medium 5.4
CVE-2022-21826 · Ivanti Connect Secure
Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a…
Published 30 Sept 2022 · NVD - Medium 4.9
CVE-2022-2922 · DNN Platform
Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0.
Published 30 Sept 2022 · Fixed in 9.11.0 · NVD - Medium 4.3
CVE-2022-39232 · Discourse
Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete quotes won't break the app. As a workaround, the quote can be fixed via the rails console.
Published 29 Sept 2022 · NVD - Medium 4.3
CVE-2022-39226 · Discourse
Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a malicious actor can add large payloads of text into the Location and Website fields of a user profile, which causes issues for other users when loading that profile. A fix to limit the length of user input for these fields is…
Published 29 Sept 2022 · Fixed in 2.8.9 · NVD - Medium 4.3
CVE-2022-36068 · Discourse
Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed`…
Published 29 Sept 2022 · Fixed in 2.8.9 · NVD - High 7.2
CVE-2022-36066 · Discourse
Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on…
Published 29 Sept 2022 · Fixed in 2.8.9 · NVD - Medium 6.5
CVE-2021-42049 · MediaWiki
An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages where they suppressed information (such as PII). This allows oversighters to whitewash revisions.
Published 29 Sept 2022 · NVD - Medium 4.8
CVE-2021-42048 · MediaWiki
An issue was discovered in the Growth extension in MediaWiki through 1.36.2. Any admin can add arbitrary JavaScript code to the Newcomer home page footer, which can be executed by viewers with zero edits.
Published 29 Sept 2022 · NVD - Medium 5.4
CVE-2021-42047 · MediaWiki
An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard feature enabled, users can login with a mentor account and trigger an XSS payload (such as alert) via Growthexperiments-mentor-dashboard-mentee-overview-no-js-fallback.
Published 29 Sept 2022 · NVD - Medium 6.1
CVE-2021-42046 · MediaWiki
An issue was discovered in the GlobalWatchlist extension in MediaWiki through 1.36.2. The rev-deleted-user and ntimes messages were not properly escaped and allowed for users to inject HTML and JavaScript.
Published 29 Sept 2022 · NVD - Medium 5.4
CVE-2021-42045 · MediaWiki
An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote.
Published 29 Sept 2022 · NVD - Medium 4.3
CVE-2021-40695 · Moodle
It was possible for a student to view their quiz grade before it had been released, using a quiz web service.
Published 29 Sept 2022 · Fixed in 3.9.10, 3.10.7, 3.11.3 · NVD - Medium 4.9
CVE-2021-40694 · Moodle
Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.
Published 29 Sept 2022 · Fixed in 3.9.10, 3.10.7, 3.11.3 · NVD - Medium 6.5
CVE-2021-40693 · Moodle
An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.
Published 29 Sept 2022 · Fixed in 3.9.10, 3.10.7, 3.11.3 · NVD - Medium 4.3
CVE-2021-40692 · Moodle
Insufficient capability checks made it possible for teachers to download users outside of their courses.
Published 29 Sept 2022 · Fixed in 3.9.10, 3.10.7, 3.11.3 · NVD - Medium 4.3
CVE-2021-40691 · Moodle
A session hijack risk was identified in the Shibboleth authentication plugin.
Published 29 Sept 2022 · Fixed in 3.9.10, 3.10.7, 3.11.3 · NVD - Critical 9.8
CVE-2016-2338 · Ruby
An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.
Published 29 Sept 2022 · NVD - Medium 6.5
CVE-2022-31629 · PHP
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
Published 28 Sept 2022 · Fixed in 7.4.31, 8.0.24, 8.1.11 · NVD - Medium 5.5
CVE-2022-31628 · PHP
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.
Published 28 Sept 2022 · Fixed in 7.4.31, 8.0.24, 8.1.11 · NVD - Medium 6.5
CVE-2022-35282 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability to obtain sensitive data.
Published 28 Sept 2022 · Fixed in 8.0.0.15, 8.5.5.22, 9.0.5.13 · NVD - High 7.5
CVE-2022-39261 · Drupal
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a…
Published 28 Sept 2022 · Fixed in 9.3.22, 9.4.7 · NVD - Low 3.7
CVE-2021-43980 · Apache Tomcat
The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or…
Published 28 Sept 2022 · NVD - High 8.8
CVE-2022-31367 · Strapi
Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.
Published 27 Sept 2022 · Fixed in 3.6.10, 4.1.10 · NVD - High 7.5
CVE-2022-3204 · Unbound
A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a…
Published 26 Sept 2022 · NVD - Critical 9.8Actively exploited
CVE-2022-41352 · Zimbra Collaboration
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red…
Published 26 Sept 2022 · NVD - High 7.8
CVE-2022-41347 · Zimbra Collaboration
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). The Sudo configuration permits the zimbra user to execute the NGINX binary as root with arbitrary parameters. As part of its intended functionality, NGINX can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.
Published 26 Sept 2022 · NVD - Medium 5.4
CVE-2022-38439 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.
Published 23 Sept 2022 · Fixed in 6.5.14.0 · NVD - Medium 5.4
CVE-2022-38438 · Adobe Experience Manager
Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.
Published 23 Sept 2022 · Fixed in 6.5.14.0 · NVD - Medium 5.4
CVE-2022-35251 · Rocket.Chat
A cross-site scripting vulnerability exists in Rocket.chat <v5 due to style injection in the complete chat window, an adversary is able to manipulate not only the style of it, but will also be able to block functionality as well as hijacking the content of targeted users. Hence the payloads are stored in messages, it is a persistent attack vector, which will trigger as soon as the message gets…
Published 23 Sept 2022 · Fixed in 5.0 · NVD - Medium 4.3
CVE-2022-35250 · Rocket.Chat
A privilege escalation vulnerability exists in Rocket.chat <v5 which made it possible to elevate privileges for any authenticated user to view Direct messages without appropriate permissions.
Published 23 Sept 2022 · Fixed in 5.0 · NVD - Medium 4.3
CVE-2022-35249 · Rocket.Chat
A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.
Published 23 Sept 2022 · Fixed in 5.0 · NVD - High 8.8
CVE-2022-35248 · Rocket.Chat
A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentication can be bypassed when telling the server to use CAS during login.
Published 23 Sept 2022 · Fixed in 4.7.5, 4.8.2 · NVD - Medium 4.3
CVE-2022-35247 · Rocket.Chat
A information disclosure vulnerability exists in Rocket.chat <v5, <v4.8.2 and <v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients.
Published 23 Sept 2022 · Fixed in 4.7.5, 4.8.2 · NVD - Medium 4.3
CVE-2022-35246 · Rocket.Chat
A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl Meteor server method that can disclose arbitrary file upload URLs to users that should not be able to access.
Published 23 Sept 2022 · Fixed in 4.7.5, 4.8.2 · NVD - Medium 4.3
CVE-2022-32229 · Rocket.Chat
A information disclosure vulnerability exists in Rockert.Chat <v5 due to /api/v1/chat.getThreadsList lack of sanitization of user inputs and can therefore leak private thread messages to unauthorized users via Mongo DB injection.
Published 23 Sept 2022 · Fixed in 5.0 · NVD - Medium 4.3
CVE-2022-32228 · Rocket.Chat
An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 since the getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs.
Published 23 Sept 2022 · Fixed in 4.7.5, 4.8.2 · NVD - Medium 6.5
CVE-2022-32227 · Rocket.Chat
A cleartext transmission of sensitive information exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product.
Published 23 Sept 2022 · Fixed in 4.7.5, 4.8.2 · NVD - Medium 4.3
CVE-2022-32226 · Rocket.Chat
An improper access control vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to input data in the getUsersOfRoom Meteor server method is not type validated, so that MongoDB query operator objects are accepted by the server, so that instead of a matching rid String a$regex query can be executed, bypassing the room access permission check for every but the first matching room.
Published 23 Sept 2022 · Fixed in 4.7.5, 4.8.2 · NVD - Medium 6.5
CVE-2022-32220 · Rocket.Chat
An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.
Published 23 Sept 2022 · Fixed in 5.0 · NVD - Medium 4.3
CVE-2022-32219 · Rocket.Chat
An information disclosure vulnerability exists in Rocket.Chat <v4.7.5 which allowed the "users.list" REST endpoint gets a query parameter from JSON and runs Users.find(queryFromClientSide). This means virtually any authenticated user can access any data (except password hashes) of any user authenticated.
Published 23 Sept 2022 · Fixed in 4.7.5 · NVD - Medium 4.3
CVE-2022-32218 · Rocket.Chat
An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to the actionLinkHandler method was found to allow Message ID Enumeration with Regex MongoDB queries.
Published 23 Sept 2022 · Fixed in 4.7.5, 4.8.2 · NVD - Medium 5.3
CVE-2022-32217 · Rocket.Chat
A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs.
Published 23 Sept 2022 · Fixed in 4.6.4 · NVD - High 8.8
CVE-2022-32211 · Rocket.Chat
A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v4.4.4 and <v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret.
Published 23 Sept 2022 · Fixed in 3.18.6, 4.4.4, 4.7.3 · NVD - Medium 6.8
CVE-2022-30124 · Rocket.Chat
An improper authentication vulnerability exists in Rocket.Chat Mobile App <4.14.1.22788 that allowed an attacker with physical access to a mobile device to bypass local authentication (PIN code).
Published 23 Sept 2022 · Fixed in 4.14.1.22788 · NVD - Medium 6.5
CVE-2022-3257 · Mattermost
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.
Published 23 Sept 2022 · Fixed in 7.2.0 · NVD - Low 3.7
CVE-2022-35252 · curl
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.
Published 23 Sept 2022 · Fixed in 7.85.0 · NVD - High 7.8
CVE-2022-2566 · FFmpeg
A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points()` goes through all entries in the loop and adds `sc->ctts_data[i].count` to `sc->sample_offsets_count`. This can lead to an integer overflow resulting in a small allocation with `av_calloc()`. An attacker can cause remote code execution via a malicious mp4 file. We recommend…
Published 23 Sept 2022 · NVD - Medium 5.3
CVE-2022-40979 · TeamCity
In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Perforce executable
Published 23 Sept 2022 · Fixed in 2022.04.4 · NVD - Low 3.7
CVE-2022-39231 · Parse Server
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or from 5.0.0 to 5.2.6, validation of the authentication adapter app ID for _Facebook_ and _Spotify_ may be circumvented. Configurations which allow users to authenticate using the Parse Server authentication adapter where `appIds` is set as a string instead of an…
Published 23 Sept 2022 · Fixed in 4.10.16, 5.2.7 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.