UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
650
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. High 7.2

    CVE-2022-35735 · F5 BIG-IP

    In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, an authenticated attacker with Resource Administrator or Manager privileges can create or modify existing monitor objects in the Configuration utility in an undisclosed manner leading to a privilege escalation. Note: Software versions which have reached End of Technical Support…

    Published 4 Aug 2022 · Fixed in 14.1.5.1, 15.1.6.1, 16.1.3.1 · NVD
  2. Critical 9.8

    CVE-2022-35728 · F5 BIG-IP

    In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ version 8.x before 8.2.0 and all versions of 7.x, an authenticated user's iControl REST token may remain valid for a limited time after logging out from the Configuration utility. Note: Software versions which have reached End of Technical…

    Published 4 Aug 2022 · Fixed in 14.1.5.1, 15.1.6.1, 16.1.3.1 · NVD
  3. Medium 5.5

    CVE-2022-35272 · F5 BIG-IP

    In BIG-IP Versions 17.0.x before 17.0.0.1 and 16.1.x before 16.1.3.1, when source-port preserve-strict is configured on an HTTP Message Routing Framework (MRF) virtual server, undisclosed traffic may cause the Traffic Management Microkernel (TMM) to produce a core file and the connection to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 4 Aug 2022 · Fixed in 16.1.3.1 · NVD
  4. High 7.5

    CVE-2022-35245 · F5 BIG-IP

    In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5.1, when a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 4 Aug 2022 · Fixed in 14.1.5.1, 15.1.6.1, 16.1.3.1 · NVD
  5. Critical 9.1

    CVE-2022-35243 · F5 BIG-IP

    In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, using an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions…

    Published 4 Aug 2022 · Fixed in 14.1.5, 15.1.6.1, 16.1.3 · NVD
  6. High 7.5

    CVE-2022-35240 · F5 BIG-IP

    In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when the Message Routing (MR) Message Queuing Telemetry Transport (MQTT) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 4 Aug 2022 · Fixed in 14.1.5, 15.1.6.1, 16.1.2.2 · NVD
  7. High 7.5

    CVE-2022-35236 · F5 BIG-IP

    In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an HTTP2 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 4 Aug 2022 · Fixed in 14.1.5, 15.1.6.1, 16.1.2.2 · NVD
  8. Critical 9.1

    CVE-2022-34865 · F5 BIG-IP

    In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential data poisoning. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 4 Aug 2022 · Fixed in 14.1.5, 15.1.6.1 · NVD
  9. High 7.5

    CVE-2022-34862 · F5 BIG-IP

    In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when an LTM virtual server is configured to perform normalization, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 4 Aug 2022 · Fixed in 14.1.5, 15.1.6.1, 16.1.3.1 · NVD
  10. Medium 6.5

    CVE-2022-34851 · F5 BIG-IP

    In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ Centralized Management all versions of 8.x, an authenticated attacker may cause iControl SOAP to become unavailable through undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 4 Aug 2022 · Fixed in 14.1.5.1, 15.1.6.1, 16.1.3.1 · NVD
  11. High 7.5

    CVE-2022-34844 · F5 BIG-IP

    In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, and all versions of BIG-IQ 8.x, when the Data Plane Development Kit (DPDK)/Elastic Network Adapter (ENA) driver is used with BIG-IP or BIG-IQ on Amazon Web Services (AWS) systems, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Successful exploitation relies on conditions outside of the…

    Published 4 Aug 2022 · Fixed in 15.1.6.1, 16.1.3.1 · NVD
  12. High 7.5

    CVE-2022-34655 · F5 BIG-IP

    In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured on a virtual server, undisclosed traffic can cause Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 4 Aug 2022 · Fixed in 14.1.5, 15.1.6.1, 16.0.1.1 · NVD
  13. High 7.5

    CVE-2022-34651 · F5 BIG-IP

    In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, when an LTM Client or Server SSL profile with TLS 1.3 enabled is configured on a virtual server, along with an iRule that calls HTTP::respond, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 4 Aug 2022 · Fixed in 15.1.6.1, 16.1.3.1 · NVD
  14. Medium 4.9

    CVE-2022-33968 · F5 BIG-IP

    In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, when an LTM monitor or APM SSO is configured on a virtual server, and NTLM challenge-response is in use, undisclosed traffic can cause a buffer over-read. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 4 Aug 2022 · Fixed in 14.1.5.1, 15.1.6.1, 16.1.3.1 · NVD
  15. Medium 6.7

    CVE-2022-33962 · F5 BIG-IP

    In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, certain iRules commands may allow an attacker to bypass the access control restrictions for a self IP address, regardless of the port lockdown settings. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 4 Aug 2022 · Fixed in 14.1.5.1, 15.1.6.1, 16.1.3.1 · NVD
  16. High 7.5

    CVE-2022-33203 · F5 BIG-IP

    In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when a BIG-IP APM access policy with Service Connect agent is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 4 Aug 2022 · Fixed in 14.1.5, 15.1.6.1, 16.1.3 · NVD
  17. High 7.5

    CVE-2022-32455 · F5 BIG-IP

    In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when a BIG-IP LTM Client SSL profile is configured on a virtual server to perform client certificate authentication with session tickets enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of…

    Published 4 Aug 2022 · Fixed in 14.1.5, 15.1.6.1, 16.1.2.2 · NVD
  18. High 7.7

    CVE-2022-31473 · F5 BIG-IP

    In BIG-IP Versions 16.1.x before 16.1.1 and 15.1.x before 15.1.4, when running in Appliance mode, an authenticated attacker may be able to bypass Appliance mode restrictions due to a directory traversal vulnerability in an undisclosed page within iApps. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support…

    Published 4 Aug 2022 · Fixed in 15.1.4 · NVD
  19. Low 2.7

    CVE-2022-31120 · Nextcloud

    Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to…

    Published 4 Aug 2022 · Fixed in 22.2.7, 23.0.4 · NVD
  20. Medium 5.3

    CVE-2022-31118 · Nextcloud

    Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommended that the Nextcloud Server is upgraded to 22.2.9, 23.0.6 or 24.0.2. Users unable to upgrade may disable federated sharing via the Admin…

    Published 4 Aug 2022 · Fixed in 22.2.9, 23.0.6, 24.0.2 · NVD
  21. Medium 4.3

    CVE-2022-23442 · Fortinet FortiOS

    An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may allow an authenticated attacker with a restricted user profile to gather the checksum information about the other VDOMs via CLI commands.

    Published 3 Aug 2022 · NVD
  22. High 7.5

    CVE-2022-35737 · SQLite

    SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

    Published 3 Aug 2022 · Fixed in 3.39.2 · NVD
  23. High 7.4

    CVE-2022-29154 · rsync

    An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync…

    Published 2 Aug 2022 · Fixed in 3.2.5 · NVD
  24. Low 2.7

    CVE-2022-35919 · MinIO

    MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin:ServerUpdate` can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow access to contents at any arbitrary paths that are readable by MinIO process. Users are advised to…

    Published 1 Aug 2022 · Fixed in 2022-07-29t19-40-48z · NVD
  25. Medium 5.3

    CVE-2022-34530 · Backdrop CMS

    An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.

    Published 1 Aug 2022 · NVD
  26. High 7.5

    CVE-2022-31184 · Discourse

    Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been included in the latest stable, beta and tests-passed versions of Discourse which rate limits emails. Users are advised to upgrade. Users unable to upgrade should manually rate limit email.

    Published 1 Aug 2022 · NVD
  27. Medium 5.3

    CVE-2022-31182 · Discourse

    Discourse is the an open source discussion platform. In affected versions a maliciously crafted request for static assets could cause error responses to be cached by Discourse's default NGINX proxy configuration. A corrected NGINX configuration is included in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this…

    Published 1 Aug 2022 · Fixed in 2.8.7 · NVD
  28. Medium 5.4

    CVE-2022-31148 · Shopware

    Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Users are recommend to update to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.

    Published 1 Aug 2022 · Fixed in 5.7.14 · NVD
  29. Medium 6.5

    CVE-2022-30699 · Unbound

    NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a rogue domain name when the cached delegation information is about to expire. The rogue nameserver delays the response so that the cached delegation information is expired. Upon receiving the…

    Published 1 Aug 2022 · Fixed in 1.16.2 · NVD
  30. Medium 6.5

    CVE-2022-30698 · Unbound

    NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a subdomain of a rogue domain name. The rogue nameserver returns delegation information for the subdomain that updates Unbound's delegation cache. This action can be repeated before expiry of the…

    Published 1 Aug 2022 · Fixed in 1.16.2 · NVD
  31. High 7.2

    CVE-2022-36799 · Jira

    This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. In this case the…

    Published 1 Aug 2022 · Fixed in 8.13.19, 8.20.7, 8.22.1 · NVD
  32. High 7.2

    CVE-2022-2593 · Better Search Replace (WordPress plugin)

    Better Search Replace: SQL Injection

    Published 1 Aug 2022 · Fixed in 1.4.1 · WPVulnerability
  33. Medium 6.1

    CVE-2016-3709 · libxml2

    Possible cross-site scripting vulnerability in libxml after commit 960f0e2.

    Published 28 Jul 2022 · Fixed in 2.9.11 · NVD
  34. Medium 5.4

    CVE-2022-1948 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 15.0 before 15.0.1. Missing validation of input used in quick actions allowed an attacker to exploit XSS by injecting HTML in contact details.

    Published 28 Jul 2022 · NVD
  35. Critical 9.8

    CVE-2022-31627 · PHP

    In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.

    Published 28 Jul 2022 · Fixed in 8.1.8 · NVD
  36. High 8.8

    CVE-2022-2550 · Hestia Control Panel

    OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.

    Published 27 Jul 2022 · Fixed in 1.6.5 · NVD
  37. Medium 6.1

    CVE-2022-36880 · Webmin

    The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message.

    Published 27 Jul 2022 · NVD
  38. Critical 9.1

    CVE-2022-36129 · HashiCorp Vault

    HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1.

    Published 26 Jul 2022 · NVD
  39. High 8.8

    CVE-2022-33745 · Xen

    insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. To address XSA-401, code was moved inside a function in Xen. This code movement missed a variable changing meaning / value between old and new code positions. The now wrong use of the variable did lead to a wrong TLB…

    Published 26 Jul 2022 · NVD
  40. Medium 5.4

    CVE-2020-36290 · Confluence

    The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the page excerpt functionality.

    Published 26 Jul 2022 · Fixed in 7.4.5, 7.6.3, 7.7.4 · NVD
  41. Medium 6.1

    CVE-2022-35653 · Moodle

    A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of…

    Published 25 Jul 2022 · Fixed in 3.9.15, 3.11.8 · NVD
  42. Medium 6.1

    CVE-2022-35652 · Moodle

    An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially…

    Published 25 Jul 2022 · Fixed in 3.9.15, 3.11.8, 4.0.2 · NVD
  43. Medium 6.1

    CVE-2022-35651 · Moodle

    A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web…

    Published 25 Jul 2022 · Fixed in 3.9.15, 3.11.8 · NVD
  44. High 7.5

    CVE-2022-35650 · Moodle

    The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers and admins by default.

    Published 25 Jul 2022 · Fixed in 3.9.15, 3.11.8, 4.0.2 · NVD
  45. Critical 9.8

    CVE-2022-35649 · Moodle

    The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

    Published 25 Jul 2022 · Fixed in 3.9.15, 3.11.8, 4.0.2 · NVD
  46. Critical 9.8

    CVE-2022-31181 · PrestaShop

    Chain: SQL Injection (CWE-89) and Eval Injection (CWE-95)

    Published 25 Jul 2022 · Fixed in 1.7.8.7 · NVD, Project advisories (GitHub)
  47. Critical 9.8

    CVE-2022-36446 · Webmin

    software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.

    Published 25 Jul 2022 · Fixed in 1.997 · NVD
  48. High 8.8

    CVE-2022-3141 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: SQL Injection

    Published 23 Jul 2022 · Fixed in 2.3.3 · WPVulnerability
  49. High 7.5

    CVE-2022-34037 · Caddy

    An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an administrator's bad configuration containing a malformed request URI caused the server to return an empty…

    Published 22 Jul 2022 · NVD
  50. High 8.8

    CVE-2022-26137 · Confluence, Jira

    A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the…

    Published 20 Jul 2022 · Fixed in 8.13.22, 8.20.10, 8.22.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.