UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,066
Published in 7 days
649
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,066 vulnerabilities
  1. Medium 4.8

    CVE-2022-3144 · Wordfence Security

    Wordfence Security – Firewall, Malware Scan, and Login Security: Cross-site Scripting

    Published 6 Sept 2022 · Fixed in 7.6.1 · NVD, WPVulnerability
  2. Medium 5.4

    CVE-2022-38093 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-Site Request Forgery (CSRF)

    Published 5 Sept 2022 · Fixed in 4.2.4 · WPVulnerability
  3. High 7.2

    CVE-2022-37458 · Discourse

    Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate.

    Published 2 Sept 2022 · NVD
  4. Medium 4.7

    CVE-2022-38170 · Apache Airflow

    In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.

    Published 2 Sept 2022 · Fixed in 2.3.4 · NVD
  5. Critical 9.8

    CVE-2022-38054 · Apache Airflow

    In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.

    Published 2 Sept 2022 · NVD
  6. High 7.5

    CVE-2022-29158 · Apache OFBiz

    Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599

    Published 2 Sept 2022 · Fixed in 18.12.06 · NVD
  7. Critical 9.8

    CVE-2022-29063 · Apache OFBiz

    The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099. In version 18.12.05 and earlier, by hosting a malicious RMI server on localhost, an attacker may exploit this behavior, at server start-up or on a server restart, in order to run arbitrary code. Upgrade to at least 18.12.06 or apply patches at…

    Published 2 Sept 2022 · Fixed in 18.12.06 · NVD
  8. High 7.5

    CVE-2022-25813 · Apache OFBiz

    In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SSTI. A RCE is then possible.

    Published 2 Sept 2022 · Fixed in 18.12.06 · NVD
  9. Critical 9.8

    CVE-2022-25371 · Apache OFBiz

    Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. By leveraging a bug in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142) it is possible to perform a remote code execution (RCE) attack in Apache OFBiz, release 18.12.05 and earlier.

    Published 2 Sept 2022 · Fixed in 18.12.06 · NVD
  10. Medium 5.4

    CVE-2022-25370 · Apache OFBiz

    Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using…

    Published 2 Sept 2022 · Fixed in 18.12.06 · NVD
  11. Medium 4.9

    CVE-2022-39194 · MediaWiki

    An issue was discovered in the MediaWiki through 1.38.2. The community configuration pages for the GrowthExperiments extension could cause a site to become unavailable due to insufficient validation when certain actions (including page moves) were performed.

    Published 2 Sept 2022 · NVD
  12. High 7.5

    CVE-2022-32743 · Samba

    Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it.

    Published 1 Sept 2022 · Fixed in 4.17.0 · NVD
  13. Medium 5.3

    CVE-2022-2739 · Podman

    The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-14370, which was previously fixed via RHSA-2020:5056. This issue could possibly allow an attacker to gain access to sensitive information stored in environment variables.

    Published 1 Sept 2022 · NVD
  14. High 7.5

    CVE-2022-2738 · Podman

    The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-8945, which was previously fixed via RHSA-2020:2117. This issue could possibly be used to crash or cause potential code execution in Go applications that use the Go GPGME wrapper library, under certain conditions, during GPG…

    Published 1 Sept 2022 · NVD
  15. Medium 5.5

    CVE-2022-1615 · Samba

    In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.

    Published 1 Sept 2022 · Fixed in 4.17.0 · NVD
  16. Critical 9.8

    CVE-2020-35527 · SQLite

    In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.

    Published 1 Sept 2022 · NVD
  17. High 7.5

    CVE-2020-35525 · SQLite

    In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing.

    Published 1 Sept 2022 · NVD
  18. High 8.8

    CVE-2022-1552 · PostgreSQL

    A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary…

    Published 31 Aug 2022 · Fixed in 12.11, 13.7, 14.3 · NVD
  19. Medium 5.3

    CVE-2022-27911 · Joomla!

    An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing '_JEXEC or die check' caused by the PSR12 changes.

    Published 31 Aug 2022 · NVD
  20. Medium 5.3

    CVE-2022-39046 · GNU C Library

    An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap.

    Published 31 Aug 2022 · NVD
  21. Medium 4.8

    CVE-2022-3035 · Snipe-IT

    Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11.

    Published 29 Aug 2022 · Fixed in 6.0.11 · NVD
  22. Medium 5.5

    CVE-2022-1115 · ImageMagick

    A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulnerability is triggered when an attacker passes a specially crafted TIFF image file to ImageMagick for conversion, potentially leading to a denial of service.

    Published 29 Aug 2022 · Fixed in 6.9.12-44, 7.1.0-29 · NVD
  23. High 8.8

    CVE-2022-0336 · Samba

    The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as one added when a computer is joined to a domain. An attacker who has the ability to write to an…

    Published 29 Aug 2022 · Fixed in 4.13.17, 4.14.12, 4.15.4 · NVD
  24. High 7.1

    CVE-2022-0284 · ImageMagick

    A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of service and information disclosure.

    Published 29 Aug 2022 · Fixed in 7.1.0-20 · NVD
  25. Medium 6.5

    CVE-2022-3017 · Froxlor

    Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38.

    Published 28 Aug 2022 · Fixed in 0.10.38 · NVD
  26. Medium 5.5

    CVE-2022-38791 · MariaDB

    In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock.

    Published 27 Aug 2022 · Fixed in 10.6.9, 10.7.5, 10.8.4 · NVD
  27. Medium 6.5

    CVE-2022-36522 · MikroTik RouterOS

    Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.

    Published 26 Aug 2022 · NVD
  28. Low 3.3

    CVE-2021-3574 · ImageMagick

    A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks.

    Published 26 Aug 2022 · NVD
  29. High 8.0

    CVE-2022-2997 · Snipe-IT

    Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.

    Published 25 Aug 2022 · Fixed in 6.0.10 · NVD
  30. Medium 5.5

    CVE-2021-20224 · ImageMagick

    An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls to GetPixelIndex() could result in values outside the range of representable for the 'unsigned char'. When ImageMagick processes a crafted pdf file, this could lead to an undefined behaviour or a crash.

    Published 25 Aug 2022 · Fixed in 6.9.11-57, 7.0.10-57 · NVD
  31. Medium 5.4

    CVE-2022-32746 · Samba

    A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl.

    Published 25 Aug 2022 · Fixed in 4.14.14, 4.15.9, 4.16.4 · NVD
  32. High 8.1

    CVE-2022-32745 · Samba

    A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segmentation fault.

    Published 25 Aug 2022 · Fixed in 4.14.14, 4.15.9, 4.16.4 · NVD
  33. High 8.8

    CVE-2022-32744 · Samba

    A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling full domain takeover.

    Published 25 Aug 2022 · Fixed in 4.14.14, 4.15.9, 4.16.4 · NVD
  34. Medium 4.3

    CVE-2022-32742 · Samba

    A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer).

    Published 25 Aug 2022 · Fixed in 4.14.14, 4.15.9, 4.16.4 · NVD
  35. High 8.8

    CVE-2022-2031 · Samba

    A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services.

    Published 25 Aug 2022 · Fixed in 4.14.14, 4.15.9, 4.16.4 · NVD
  36. Medium 5.9

    CVE-2021-43767 · PostgreSQL

    Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's first few queries. Despite the use of SSL certificate verification and encryption, Odyssey will pass…

    Published 25 Aug 2022 · Fixed in 11.14, 12.9, 13.5 · NVD
  37. High 8.8

    CVE-2022-36051 · ZITADEL

    Broken Authorization in ZITADEL Actions

    Published 25 Aug 2022 · Fixed in 1.87.1, 2.2.0 · NVD, Project advisories (GitHub)
  38. Critical 9.8

    CVE-2022-34960 · MikroTik RouterOS

    The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the host device. This allows the attacker to mount any arbitrary file to any location on the host.

    Published 25 Aug 2022 · NVD
  39. Medium 5.4

    CVE-2018-14520 · Kirby

    An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages.

    Published 24 Aug 2022 · NVD
  40. Medium 4.3

    CVE-2018-14519 · Kirby

    An issue was discovered in Kirby 2.5.12. The delete page functionality suffers from a CSRF flaw. A remote attacker can craft a malicious CSRF page and force the user to delete a page.

    Published 24 Aug 2022 · NVD
  41. Medium

    CVE-2022-36046 · Next.js

    Unexpected server crash in Next.js version 12.2.3

    Published 24 Aug 2022 · Project advisories (GitHub)
  42. Medium 5.3

    CVE-2021-4189 · Python

    A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning…

    Published 24 Aug 2022 · Fixed in 3.7.11, 3.8.9, 3.9.3 · NVD
  43. Medium 5.3

    CVE-2021-4040 · Apache ActiveMQ Artemis

    A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest threat from this vulnerability is system availability.

    Published 24 Aug 2022 · Fixed in 2.19.1 · NVD
  44. High 7.8

    CVE-2021-3999 · GNU C Library

    A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

    Published 24 Aug 2022 · Fixed in 2.31 · NVD
  45. High 7.5

    CVE-2021-3998 · GNU C Library

    A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.

    Published 24 Aug 2022 · Fixed in 2.35 · NVD
  46. Critical 9.8

    CVE-2022-38078 · Movable Type

    Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and versions are as follows: Movable Type 7 r.5202 and earlier, Movable Type Advanced 7 r.5202 and earlier,…

    Published 24 Aug 2022 · Fixed in 1.53, 6.8.7, 7.9.5 · NVD
  47. Medium 5.4

    CVE-2022-36037 · Kirby

    Cross-site scripting (XSS) from dynamic options in the multiselect field

    Published 24 Aug 2022 · Fixed in 3.5.8.1 · NVD, Project advisories (GitHub)
  48. High 7.1

    CVE-2022-35174 · Kirby

    Cross-site scripting (XSS) from content entered in the tags and multiselect fields

    Published 24 Aug 2022 · Fixed in 3.7.4 · Project advisories (GitHub)
  49. Medium 6.5

    CVE-2021-3670 · Samba

    MaxQueryDuration not honoured in Samba AD DC LDAP

    Published 23 Aug 2022 · Fixed in 4.16.0 · NVD
  50. Medium 6.8

    CVE-2021-20316 · Samba

    A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.

    Published 23 Aug 2022 · Fixed in 4.15.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.