UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
650
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. Medium 6.5

    CVE-2022-32213 · Node.js

    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

    Published 14 Jul 2022 · Fixed in 14.20.1, 16.17.1, 18.9.1 · NVD
  2. High 8.1

    CVE-2022-32212 · Node.js

    A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

    Published 14 Jul 2022 · Fixed in 14.20.1, 16.17.1, 18.5.0 · NVD
  3. High 8.8

    CVE-2022-2594 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Unrestricted Upload of File with Dangerous Type

    Published 14 Jul 2022 · Fixed in 5.12.3 · NVD, WPVulnerability
  4. High 8.8

    CVE-2022-32114 · Strapi

    An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create (upload)" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the…

    Published 13 Jul 2022 · NVD
  5. Medium 4.8

    CVE-2020-21967 · PrestaShop

    File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file page.

    Published 13 Jul 2022 · NVD
  6. High 7.5

    CVE-2022-22982 · VMware vCenter Server

    The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.

    Published 13 Jul 2022 · NVD
  7. Critical 9.6

    CVE-2022-31105 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious (or otherwise untrustworthy) OpenID Connect (OIDC) provider. A patch for this vulnerability has been released in Argo CD versions 2.4.5, 2.3.6, and…

    Published 12 Jul 2022 · Fixed in 2.2.11, 2.3.6, 2.4.5 · NVD
  8. Medium 6.1

    CVE-2022-31102 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with 2.3.0 and prior to 2.3.6 and 2.4.5 is vulnerable to a cross-site scripting (XSS) bug which could allow an attacker to inject arbitrary JavaScript in the `/auth/callback` page in a victim's browser. This vulnerability only affects Argo CD instances which have single sign on (SSO) enabled. The exploit…

    Published 12 Jul 2022 · Fixed in 2.3.6, 2.4.5 · NVD
  9. High 8.8

    CVE-2022-1025 · Argo CD

    All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.

    Published 12 Jul 2022 · NVD
  10. Medium 6.5

    CVE-2022-29901 · VMware ESXi

    Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.

    Published 12 Jul 2022 · NVD
  11. Medium 5.3

    CVE-2022-2366 · Mattermost

    Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers.

    Published 12 Jul 2022 · Fixed in 6.3.9, 6.5.2, 6.6.2 · NVD
  12. High 8.1

    CVE-2022-24800 · October CMS

    RCE via race condition in upload process

    Published 12 Jul 2022 · Fixed in 1.0.476, 1.1.12, 2.2.15 · NVD, Project advisories (GitHub)
  13. Critical 9.8

    CVE-2022-32294 · Zimbra Collaboration

    Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartext on port UDP 514 (aka the syslog port). NOTE: a third party reports that this cannot be reproduced.

    Published 11 Jul 2022 · NVD
  14. High 8.8

    CVE-2022-22476 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specially crafted request. IBM X-Force ID: 225604.

    Published 8 Jul 2022 · Fixed in 22.0.0.8 · NVD
  15. Medium 4.8

    CVE-2022-32061 · Snipe-IT

    An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.

    Published 7 Jul 2022 · NVD
  16. Medium 4.8

    CVE-2022-32060 · Snipe-IT

    An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.

    Published 7 Jul 2022 · NVD
  17. High 7.5

    CVE-2022-2191 · Eclipse Jetty

    In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.

    Published 7 Jul 2022 · NVD
  18. High 7.5

    CVE-2022-2048 · Eclipse Jetty, Jenkins

    In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.

    Published 7 Jul 2022 · Fixed in 9.4.47, 10.0.9, 11.0.9 · NVD
  19. Low 2.7

    CVE-2022-2047 · Eclipse Jetty

    In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.

    Published 7 Jul 2022 · Fixed in 9.4.46, 10.0.9 · NVD
  20. Medium 5.9

    CVE-2022-32208 · curl

    When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

    Published 7 Jul 2022 · Fixed in 7.84.0 · NVD
  21. Critical 9.8

    CVE-2022-32207 · curl

    When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.

    Published 7 Jul 2022 · Fixed in 7.84.0 · NVD
  22. Medium 6.5

    CVE-2022-32206 · curl

    curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc…

    Published 7 Jul 2022 · Fixed in 7.84.0 · NVD
  23. Medium 4.3

    CVE-2022-32205 · curl

    A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576…

    Published 7 Jul 2022 · Fixed in 7.84.0 · NVD
  24. High 8.8

    CVE-2022-25048 · Control Web Panel

    Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.

    Published 7 Jul 2022 · NVD
  25. Medium 5.9

    CVE-2022-25047 · Control Web Panel

    The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.

    Published 7 Jul 2022 · NVD
  26. Critical 9.8

    CVE-2022-25046 · Control Web Panel

    A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.

    Published 7 Jul 2022 · NVD
  27. Medium 6.1

    CVE-2022-23713 · Kibana

    A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser.

    Published 6 Jul 2022 · Fixed in 7.17.5 · NVD
  28. Medium 4.3

    CVE-2021-37839 · Apache Superset

    Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.

    Published 6 Jul 2022 · NVD
  29. Medium 5.4

    CVE-2022-35230 · Zabbix

    An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.

    Published 6 Jul 2022 · Fixed in 5.0.25 · NVD
  30. Medium 5.4

    CVE-2022-35229 · Zabbix

    An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.

    Published 6 Jul 2022 · Fixed in 4.0.0, 5.0.25 · NVD
  31. Medium 4.9

    CVE-2021-46687 · JFrog Artifactory

    JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x.

    Published 6 Jul 2022 · Fixed in 6.23.38, 7.31.10 · NVD
  32. Medium 6.1

    CVE-2021-45721 · JFrog Artifactory

    JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.36.1 versions prior to 7.29.8; JFrog Artifactory versions before 6.23.41 versions prior to 6.23.38.

    Published 6 Jul 2022 · Fixed in 6.23.38, 7.29.8 · NVD
  33. High 8.8

    CVE-2021-23163 · JFrog Artifactory

    JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.33.6 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x.

    Published 6 Jul 2022 · Fixed in 6.23.38, 7.33.6 · NVD
  34. Low 3.5

    CVE-2022-31014 · Nextcloud

    Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an already-authenticated SMTP session and run arbitrary SMTP commands as the email user, such as sending emails to…

    Published 5 Jul 2022 · Fixed in 21.0.9.5, 22.2.8, 23.0.5 · NVD
  35. Medium 5.3

    CVE-2022-2097 · OpenSSL

    AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher…

    Published 5 Jul 2022 · Fixed in 1.1.1q, 3.0.5 · NVD
  36. Medium 6.1

    CVE-2022-34912 · MediaWiki

    An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped.

    Published 2 Jul 2022 · Fixed in 1.37.3 · NVD
  37. Medium 6.1

    CVE-2022-34911 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is not escaped: SpecialCreateAccount::successfulAction() calls ::showSuccessPage() with a message as…

    Published 2 Jul 2022 · Fixed in 1.35.7, 1.37.3 · NVD
  38. High 7.5

    CVE-2022-32091 · MariaDB

    MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc.

    Published 1 Jul 2022 · Fixed in 10.7.5, 10.8.4, 10.9.2 · NVD
  39. High 7.5

    CVE-2022-32089 · MariaDB

    MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.

    Published 1 Jul 2022 · Fixed in 10.7.5, 10.8.4, 10.9.2 · NVD
  40. High 7.5

    CVE-2022-32088 · MariaDB

    MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort.

    Published 1 Jul 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  41. High 7.5

    CVE-2022-32087 · MariaDB

    MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args.

    Published 1 Jul 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  42. High 7.5

    CVE-2022-32086 · MariaDB

    MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field.

    Published 1 Jul 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  43. High 7.5

    CVE-2022-32085 · MariaDB

    MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor.

    Published 1 Jul 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  44. High 7.5

    CVE-2022-32084 · MariaDB

    MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.

    Published 1 Jul 2022 · Fixed in 10.7.5, 10.8.4, 10.9.2 · NVD
  45. High 7.5

    CVE-2022-32083 · MariaDB

    MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker.

    Published 1 Jul 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  46. High 7.5

    CVE-2022-32082 · MariaDB

    MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.

    Published 1 Jul 2022 · Fixed in 10.7.5, 10.8.4, 10.9.2 · NVD
  47. High 7.5

    CVE-2022-32081 · MariaDB

    MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc.

    Published 1 Jul 2022 · Fixed in 10.7.5, 10.8.4, 10.9.2 · NVD
  48. Medium 5.3

    CVE-2022-1954 · GitLab

    A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to make a GitLab instance inaccessible via specially crafted web server response headers

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  49. Medium 6.1

    CVE-2022-0167 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not disabling the Autocomplete attribute of fields related to sensitive information making it possible to be retrieved under certain conditions.

    Published 1 Jul 2022 · Fixed in 14.4.5, 14.5.3, 14.6.2 · NVD
  50. Medium 5.3

    CVE-2022-2270 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions starting from 15.1 before 15.1.1. GitLab was leaking Conan packages names due to incorrect permissions verification.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.