UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,066
Published in 7 days
649
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,066 vulnerabilities
  1. Medium 6.1

    CVE-2022-35278 · Apache ActiveMQ Artemis

    In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.

    Published 23 Aug 2022 · Fixed in 2.24.0 · NVD
  2. Medium 4.8

    CVE-2022-2796 · Pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.

    Published 23 Aug 2022 · Fixed in 10.5.4 · NVD
  3. High 7.4

    CVE-2021-28861 · Python

    Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

    Published 23 Aug 2022 · Fixed in 3.8.14, 3.9.14, 3.10.6 · NVD
  4. High 8.8

    CVE-2022-34652 · AVideo

    A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an attacker to inject SQL by manipulating the description parameter.

    Published 22 Aug 2022 · NVD
  5. High 8.8

    CVE-2022-33149 · AVideo

    A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite plugin, allowing an attacker to inject SQL by manipulating the url parameter.

    Published 22 Aug 2022 · NVD
  6. High 8.8

    CVE-2022-33148 · AVideo

    A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an attacker to inject SQL by manipulating the title parameter.

    Published 22 Aug 2022 · NVD
  7. High 8.8

    CVE-2022-33147 · AVideo

    A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the aVideoEncoder functionality which can be used to add new videos, allowing an attacker to inject SQL by manipulating…

    Published 22 Aug 2022 · NVD
  8. High 7.5

    CVE-2022-32778 · AVideo

    An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, which allows the session cookie to be leaked over non-HTTPS connections. This could allow an attacker to steal the…

    Published 22 Aug 2022 · NVD
  9. High 7.5

    CVE-2022-32777 · AVideo

    An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, which allows the session cookie to be leaked over non-HTTPS connections. This could allow an attacker to steal the…

    Published 22 Aug 2022 · NVD
  10. Medium 6.1

    CVE-2022-32772 · AVideo

    A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "msg" parameter which is inserted into the…

    Published 22 Aug 2022 · NVD
  11. Medium 6.1

    CVE-2022-32771 · AVideo

    A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "success" parameter which is inserted into…

    Published 22 Aug 2022 · NVD
  12. Medium 6.1

    CVE-2022-32770 · AVideo

    A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "toast" parameter which is inserted into the…

    Published 22 Aug 2022 · NVD
  13. Medium 5.0

    CVE-2022-32769 · AVideo

    Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Playlists plugin, allowing an…

    Published 22 Aug 2022 · NVD
  14. Medium 4.2

    CVE-2022-32768 · AVideo

    Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an…

    Published 22 Aug 2022 · NVD
  15. Medium 6.5

    CVE-2022-32761 · AVideo

    An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability.

    Published 22 Aug 2022 · NVD
  16. High 8.8

    CVE-2022-32572 · AVideo

    An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.

    Published 22 Aug 2022 · NVD
  17. High 8.8

    CVE-2022-32282 · AVideo

    An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased privileges.

    Published 22 Aug 2022 · NVD
  18. Medium 6.1

    CVE-2022-30690 · AVideo

    A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.

    Published 22 Aug 2022 · NVD
  19. High 8.8

    CVE-2022-30605 · AVideo

    A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.

    Published 22 Aug 2022 · NVD
  20. Critical 9.9

    CVE-2022-30547 · AVideo

    A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.

    Published 22 Aug 2022 · NVD
  21. High 8.8

    CVE-2022-30534 · AVideo

    An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.

    Published 22 Aug 2022 · NVD
  22. High 8.8

    CVE-2022-29468 · AVideo

    A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.

    Published 22 Aug 2022 · NVD
  23. Critical 9.0

    CVE-2022-28712 · AVideo

    A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.

    Published 22 Aug 2022 · NVD
  24. Medium 6.5

    CVE-2022-28710 · AVideo

    An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability.

    Published 22 Aug 2022 · NVD
  25. Critical 9.6

    CVE-2022-26842 · AVideo

    A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.

    Published 22 Aug 2022 · NVD
  26. Medium 5.3

    CVE-2022-35692 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to leak minor information of another user's account detials. Exploitation of this issue does not require user interaction.

    Published 19 Aug 2022 · Fixed in 2.4.4 · NVD
  27. High 7.1

    CVE-2020-27792 · Ghostscript

    A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000_print_page() function in the gdevlp8k.c file. This flaw allows an attacker to trick a user into opening a crafted PDF file, triggering the heap buffer overflow that could lead to memory corruption or a denial of service.

    Published 19 Aug 2022 · NVD
  28. Medium 6.5

    CVE-2022-36031 · Directus

    Unhandled exception on illegal filename_disk value

    Published 19 Aug 2022 · Fixed in 9.15.0 · NVD, Project advisories (GitHub)
  29. Critical 9.1

    CVE-2022-31247 · Rancher

    Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

    Published 19 Aug 2022 · Fixed in 2.5.16, 2.6.7 · NVD, Project advisories (GitHub)
  30. Critical 9.9

    CVE-2021-36783 · Rancher

    Failure to properly sanitize credentials in cluster template answers

    Published 19 Aug 2022 · Fixed in 2.5.13, 2.6.4 · NVD, Project advisories (GitHub)
  31. High 8.0

    CVE-2022-2625 · PostgreSQL

    A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw…

    Published 18 Aug 2022 · Fixed in 12.12, 13.8, 14.5 · NVD
  32. Medium 6.1

    CVE-2021-30071 · Hestia Control Panel

    A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

    Published 18 Aug 2022 · Fixed in 1.3.5 · NVD
  33. High 7.5

    CVE-2021-30070 · Hestia Control Panel

    An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk [] parameter in the update request being transmitted to the operating system's package manager.

    Published 18 Aug 2022 · Fixed in 1.3.5 · NVD
  34. Medium 5.5

    CVE-2022-37439 · Splunk Enterprise

    In Splunk Enterprise and Universal Forwarder versions in the following table, indexing a specially crafted ZIP file using the file monitoring input can result in a crash of the application. Attempts to restart the application would result in a crash and would require manually removing the malformed file.

    Published 16 Aug 2022 · Fixed in 8.1.11, 8.2.7.1 · NVD
  35. Low 3.5

    CVE-2022-37438 · Splunk Enterprise

    In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information (for example, username, email, and real name) about Splunk users, when visited by another user through the drilldown component. The vulnerability requires user access to create and share dashboards using Splunk Web.

    Published 16 Aug 2022 · Fixed in 8.1.11, 8.2.7.1 · NVD
  36. Critical 9.8

    CVE-2022-37437 · Splunk Enterprise

    When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service (S3) in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Splunk Enterprise and an Ingest Actions Destination through Splunk Web and only applies to environments that have configured TLS certificate…

    Published 16 Aug 2022 · NVD
  37. Medium 5.3

    CVE-2022-34259 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

    Published 16 Aug 2022 · Fixed in 2.3.7, 2.4.3 · NVD
  38. Medium 4.8

    CVE-2022-34258 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 16 Aug 2022 · Fixed in 2.3.7, 2.4.3 · NVD
  39. Medium 6.1

    CVE-2022-34257 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 16 Aug 2022 · Fixed in 2.3.7, 2.4.3 · NVD
  40. Critical 9.8

    CVE-2022-34256 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.

    Published 16 Aug 2022 · Fixed in 2.3.7, 2.4.3 · NVD
  41. High 8.8

    CVE-2022-34255 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in Privilege escalation. An attacker with a low privilege account could leverage this vulnerability to perform an account takeover for a victim. Exploitation of this issue does not require user interaction.

    Published 16 Aug 2022 · Fixed in 2.3.7, 2.4.3 · NVD
  42. High 8.8

    CVE-2022-34254 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could be abused by an attacker to inject malicious scripts into the vulnerable endpoint. A low privileged attacker could leverage this vulnerability to read local files and to perform…

    Published 16 Aug 2022 · Fixed in 2.3.7, 2.4.3 · NVD
  43. High 7.2

    CVE-2022-34253 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction.

    Published 16 Aug 2022 · Fixed in 2.3.7, 2.4.3 · NVD
  44. High 7.2

    CVE-2020-1756 · Moodle

    In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool.

    Published 16 Aug 2022 · Fixed in 3.6.9, 3.7.5, 3.8.2 · NVD
  45. Medium 5.3

    CVE-2020-1755 · Moodle

    In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote address checks.

    Published 16 Aug 2022 · Fixed in 3.6.9, 3.7.5, 3.8.2 · NVD
  46. High 7.5

    CVE-2020-14322 · Moodle

    In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, yui_combo needed to limit the amount of files it can load to help mitigate the risk of denial of service.

    Published 16 Aug 2022 · Fixed in 3.5.13, 3.7.7, 3.8.4 · NVD
  47. High 8.8

    CVE-2020-14321 · Moodle

    In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.

    Published 16 Aug 2022 · Fixed in 3.5.13, 3.7.7, 3.8.4 · NVD
  48. Medium 6.1

    CVE-2020-14320 · Moodle

    In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk.

    Published 16 Aug 2022 · Fixed in 3.7.7, 3.8.4 · NVD
  49. High 7.8

    CVE-2022-37393 · Zimbra Collaboration

    Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.

    Published 16 Aug 2022 · NVD
  50. Medium 6.5

    CVE-2022-38183 · Gitea

    In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.

    Published 12 Aug 2022 · Fixed in 1.16.9 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.