UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,065
Published in 7 days
648
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,065 vulnerabilities
  1. Low 3.1

    CVE-2022-39225 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.15, or 5.0.0 and above prior to 5.2.6, a user can write to the session object of another user if the session object ID is known. For example, an attacker can assign the session object to their own user by writing to the `user` field and then read any custom fields of…

    Published 23 Sept 2022 · Fixed in 4.10.15, 5.2.6 · NVD
  2. High 8.6

    CVE-2022-41318 · Squid

    SQUID-2022:2 Buffer Over Read in SSPI and SMB Authentication

    Published 23 Sept 2022 · Fixed in 5.7 · NVD, Project advisories (GitHub)
  3. Medium 6.5

    CVE-2022-41317 · Squid

    SQUID-2022:1 Exposure of Sensitive Information in Cache Manager

    Published 23 Sept 2022 · Fixed in 5.7 · NVD, Project advisories (GitHub)
  4. Low

    CVE-2022-2668 · Keycloak

    SAML javascript protocol mapper: Uploading of scripts through admin console

    Published 22 Sept 2022 · Fixed in 19.0.2 · Project advisories (GitHub)
  5. Medium

    CVE-2022-2256 · Keycloak

    Stored XSS when loading default roles

    Published 22 Sept 2022 · Fixed in 19.0.2 · Project advisories (GitHub)
  6. Critical 9.8

    CVE-2022-35951 · Redis

    Heap overflow in Redis 7.0 XAUTOCLAIM command's COUNT argument.

    Published 22 Sept 2022 · Fixed in 7.0.5 · NVD, Project advisories (GitHub)
  7. Critical 9.1

    CVE-2022-40186 · HashiCorp Vault

    An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checking the proper alias assigned to an entity. This may allow for unintended access to key/value paths…

    Published 22 Sept 2022 · Fixed in 1.9.9, 1.10.6, 1.11.3 · NVD
  8. Medium 6.5

    CVE-2022-38512 · Liferay Portal / DXP

    The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.

    Published 22 Sept 2022 · NVD
  9. High 7.5

    CVE-2022-28981 · Liferay Portal / DXP

    Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.

    Published 22 Sept 2022 · NVD
  10. Medium 6.1

    CVE-2022-28980 · Liferay Portal / DXP

    Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.

    Published 22 Sept 2022 · Fixed in 7.4.3.5 · NVD
  11. Medium 6.1

    CVE-2022-28977 · Liferay Portal / DXP

    HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3)…

    Published 22 Sept 2022 · Fixed in 7.4.3.4 · NVD
  12. Medium 4.3

    CVE-2022-39975 · Liferay Portal / DXP

    The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.

    Published 22 Sept 2022 · Fixed in 7.4.3.35 · NVD
  13. Medium 6.1

    CVE-2022-28982 · Liferay Portal / DXP

    A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.

    Published 22 Sept 2022 · Fixed in 7.4.3.4 · NVD
  14. Medium 6.1

    CVE-2022-28979 · Liferay Portal / DXP

    Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text…

    Published 22 Sept 2022 · Fixed in 7.4.3.4 · NVD
  15. Medium 5.4

    CVE-2022-28978 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.

    Published 22 Sept 2022 · Fixed in 7.4.2 · NVD
  16. Medium 5.4

    CVE-2022-41224 · Jenkins

    Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.

    Published 21 Sept 2022 · Fixed in 2.370 · NVD
  17. Medium 5.4

    CVE-2022-37246 · Craft CMS

    Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label.

    Published 21 Sept 2022 · NVD
  18. Critical 9.8

    CVE-2022-37026 · Erlang/OTP

    In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.

    Published 21 Sept 2022 · Fixed in 23.3.4.15, 24.3.4.2, 25.0.2 · NVD
  19. Medium 4.8

    CVE-2022-3255 · Pimcore

    If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users,…

    Published 21 Sept 2022 · Fixed in 10.5.7 · NVD
  20. High 7.5

    CVE-2022-3080 · BIND 9

    By sending specific queries to the resolver, an attacker can cause named to crash.

    Published 21 Sept 2022 · Fixed in 9.16.33, 9.18.7, 9.19.5 · NVD
  21. High 7.5

    CVE-2022-38178 · BIND 9

    By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

    Published 21 Sept 2022 · NVD
  22. High 7.5

    CVE-2022-38177 · BIND 9

    By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.

    Published 21 Sept 2022 · NVD
  23. High 7.5

    CVE-2022-2906 · BIND 9

    An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.

    Published 21 Sept 2022 · Fixed in 9.18.7, 9.19.5 · NVD
  24. High 8.2

    CVE-2022-2881 · BIND 9

    The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process.

    Published 21 Sept 2022 · Fixed in 9.18.7, 9.19.5 · NVD
  25. Medium 5.3

    CVE-2022-2795 · BIND 9

    By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.

    Published 21 Sept 2022 · Fixed in 9.16.33, 9.18.7, 9.19.5 · NVD
  26. Medium 6.1

    CVE-2022-40754 · Apache Airflow

    In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint.

    Published 21 Sept 2022 · NVD
  27. High 7.5

    CVE-2022-40604 · Apache Airflow

    In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.

    Published 21 Sept 2022 · NVD
  28. Medium 6.6

    CVE-2022-35957 · Grafana

    Escalation from admin to server admin when auth proxy is used

    Published 20 Sept 2022 · Fixed in 8.5.13, 9.0.9, 9.1.6 · NVD, Project advisories (GitHub)
  29. Low 3.8

    CVE-2022-36062 · Grafana

    Grafana folders admin only permission privilege escalation

    Published 20 Sept 2022 · Fixed in 8.5.13, 9.0.9, 9.1.6 · NVD, Project advisories (GitHub)
  30. High 7.5

    CVE-2022-34917 · Apache Kafka

    A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network…

    Published 20 Sept 2022 · Fixed in 3.0.2, 3.1.2, 3.2.3 · NVD
  31. High 7.5

    CVE-2022-28204 · MediaWiki

    A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere&target=Property%3AP31&namespace=1&invert=1 can take more than thirty seconds. There is a DDoS risk.

    Published 19 Sept 2022 · Fixed in 1.37.2 · NVD
  32. High 7.5

    CVE-2022-28203 · MediaWiki

    A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.

    Published 19 Sept 2022 · Fixed in 1.35.6, 1.36.4, 1.37.2 · NVD
  33. Medium 4.4

    CVE-2022-28201 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinite recursion, because a bare local interwiki is mishandled for the mainpage message.

    Published 19 Sept 2022 · Fixed in 1.35.6, 1.36.4, 1.37.2 · NVD
  34. Medium 5.5

    CVE-2022-3213 · ImageMagick

    A heap buffer overflow issue was found in ImageMagick. When an application processes a malformed TIFF file, it could lead to undefined behavior or a crash causing a denial of service.

    Published 19 Sept 2022 · Fixed in 6.9.12-62, 7.1.0-47 · NVD
  35. Critical 9.8Actively exploited

    CVE-2022-35914 · GLPI

    /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

    Published 19 Sept 2022 · NVD
  36. Unrated

    WPV-89669cfe12e4 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 19 Sept 2022 · Fixed in 1.7.5.5 · WPVulnerability
  37. Unrated

    WPV-2c98b88dfcab · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 19 Sept 2022 · Fixed in 1.7.5.5 · WPVulnerability
  38. Medium 4.3

    CVE-2022-3173 · Snipe-IT

    Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.

    Published 17 Sept 2022 · Fixed in 6.0.10 · NVD
  39. Medium 5.3

    CVE-2022-39211 · Nextcloud

    Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue.

    Published 16 Sept 2022 · Fixed in 23.0.8, 24.0.4 · NVD
  40. Medium 5.4

    CVE-2022-37251 · Craft CMS

    Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.

    Published 16 Sept 2022 · NVD
  41. Medium 5.4

    CVE-2022-37247 · Craft CMS

    Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.

    Published 16 Sept 2022 · NVD
  42. Medium 5.4

    CVE-2022-35664 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.

    Published 16 Sept 2022 · NVD
  43. Medium 5.4

    CVE-2022-34218 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.

    Published 16 Sept 2022 · NVD
  44. Medium 5.4

    CVE-2022-30686 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.

    Published 16 Sept 2022 · NVD
  45. Medium 5.4

    CVE-2022-30685 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.

    Published 16 Sept 2022 · NVD
  46. Medium 5.4

    CVE-2022-30684 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.

    Published 16 Sept 2022 · NVD
  47. Medium 5.3

    CVE-2022-30683 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a Violation of Secure Design Principles vulnerability that could lead to bypass the security feature of the encryption mechanism in the backend . An attacker could leverage this vulnerability to decrypt secrets, however, this is a high-complexity attack as the threat actor needs to already possess those secrets. Exploitation…

    Published 16 Sept 2022 · NVD
  48. Medium 5.4

    CVE-2022-30682 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.

    Published 16 Sept 2022 · NVD
  49. Medium 5.4

    CVE-2022-30681 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.

    Published 16 Sept 2022 · NVD
  50. Medium 5.4

    CVE-2022-30680 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.

    Published 16 Sept 2022 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.