UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
650
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. High 7.5

    CVE-2022-2229 · GitLab

    An improper authorization issue in GitLab CE/EE affecting all versions from 13.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to extract the value of an unprotected variable they know the name of in public projects or private projects they're a member of.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  2. Medium 6.5

    CVE-2022-2228 · GitLab

    Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker with the appropriate access tokens to obtain CI variables in a group with using IP-based access restrictions even if the GitLab Runner is calling from outside the allowed IP range

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  3. Medium 5.3

    CVE-2022-1999 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. Under certain conditions, using the REST API an unprivileged user was able to change labels description.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  4. Low 2.7

    CVE-2022-1981 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. In GitLab, if a group enables the setting to restrict access to users belonging to specific domains, that allow-list may be bypassed if a Maintainer uses the 'Invite a group' feature to invite a group that has members that don't comply with domain…

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  5. Medium 5.3

    CVE-2022-1963 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions starting from 15.1 before 15.1.1. GitLab reveals if a user has enabled two-factor authentication on their account in the HTML source, to unauthenticated users.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  6. Medium 5.3

    CVE-2022-2281 · GitLab

    An information disclosure vulnerability in GitLab EE affecting all versions from 12.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows disclosure of release titles if group milestones are associated with any project releases.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  7. Medium 6.1

    CVE-2022-2250 · GitLab

    An open redirect vulnerability in GitLab EE/CE affecting all versions from 11.1 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to redirect users to an arbitrary location if they trust the URL.

    Published 1 Jul 2022 · Fixed in 14.0.5, 14.10.5, 15.0.4 · NVD
  8. Medium 4.3

    CVE-2022-2244 · GitLab

    An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows project memebers with reporter role to manage issues in project's error tracking feature.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  9. Medium 4.3

    CVE-2022-2243 · GitLab

    An access control vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows authenticated users to enumerate issues in non-linked sentry projects.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  10. Medium 5.4

    CVE-2022-2235 · GitLab

    Insufficient sanitization in GitLab EE's external issue tracker affecting all versions from 14.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to perform cross-site scripting when a victim clicks on a maliciously crafted ZenTao link

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  11. Medium 4.8

    CVE-2022-2230 · GitLab

    A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  12. Medium 4.3

    CVE-2022-2227 · GitLab

    Improper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows a previous maintainer of a project with a specific runner to access job and project meta data under certain conditions

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  13. High 8.8

    CVE-2022-2185 · GitLab

    A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  14. Medium 4.3

    CVE-2022-1983 · GitLab

    Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker already in possession of a valid Deploy Key or a Deploy Token to misuse it from any location to access Container Registries even when IP address restrictions were configured.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  15. Critical 9.8

    CVE-2022-2274 · OpenSSL

    The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the…

    Published 1 Jul 2022 · NVD
  16. High 8.2

    CVE-2022-31112 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent`…

    Published 30 Jun 2022 · Fixed in 4.10.13, 5.2.4 · NVD
  17. Medium 6.5

    CVE-2022-26135 · Jira

    A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This…

    Published 30 Jun 2022 · Fixed in 8.13.22, 8.20.10, 8.22.4 · NVD
  18. High 7.2

    CVE-2022-2073 · Grav

    Code Injection in GitHub repository getgrav/grav prior to 1.7.34.

    Published 29 Jun 2022 · Fixed in 1.7.34 · NVD
  19. Medium 6.1

    CVE-2022-29272 · Nagios XI

    In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing.

    Published 29 Jun 2022 · NVD
  20. Medium 6.5

    CVE-2022-29271 · Nagios XI

    In Nagios XI through 5.8.5, a read-only Nagios user (due to an incorrect permission check) is able to schedule downtime for any host/services. This allows an attacker to permanently disable all monitoring checks.

    Published 29 Jun 2022 · NVD
  21. Medium 4.3

    CVE-2022-29270 · Nagios XI

    In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address.

    Published 29 Jun 2022 · NVD
  22. Medium 6.5

    CVE-2022-29269 · Nagios XI

    In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformatting/editing of emails from an official email address.

    Published 29 Jun 2022 · NVD
  23. Medium 5.4

    CVE-2022-28803 · Silverstripe CMS

    In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest (XHR).

    Published 29 Jun 2022 · Fixed in 4.10.9 · NVD
  24. Medium 5.4

    CVE-2022-25238 · Silverstripe CMS

    Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code.

    Published 28 Jun 2022 · NVD
  25. Medium 6.5

    CVE-2022-24444 · Silverstripe CMS

    Silverstripe silverstripe/framework through 4.10 allows Session Fixation.

    Published 28 Jun 2022 · NVD
  26. Medium 6.5

    CVE-2021-41559 · Silverstripe CMS

    Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML document.

    Published 28 Jun 2022 · Fixed in 4.10.9 · NVD
  27. Medium 5.3

    CVE-2022-31068 · GLPI

    GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated. This issue has been addressed in version 10.0.2 and all affected users are advised to upgrade.

    Published 28 Jun 2022 · Fixed in 10.0.2 · NVD
  28. Critical 9.8

    CVE-2022-31061 · GLPI

    GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions there is a SQL injection vulnerability which is possible on login page. No user credentials are required to exploit this vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

    Published 28 Jun 2022 · Fixed in 9.5.8, 10.0.2 · NVD
  29. Critical 9.8

    CVE-2022-31056 · GLPI

    GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and all affected users are advised to upgrade.

    Published 28 Jun 2022 · Fixed in 10.0.2 · NVD
  30. High 7.5

    CVE-2022-34750 · MediaWiki

    An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of-service attack vectors within the Wikibase and WikibaseLexeme extensions. This is related to Special:NewLexeme and Special:NewProperty.

    Published 28 Jun 2022 · NVD
  31. Medium 5.7

    CVE-2022-31096 · Discourse

    Discourse is an open source discussion platform. Under certain conditions, a logged in user can redeem an invite with an email that either doesn't match the invite's email or does not adhere to the email domain restriction of an invite link. The impact of this flaw is aggravated when the invite has been configured to add the user that accepts the invite into restricted groups. Once a user has…

    Published 27 Jun 2022 · NVD
  32. High 7.5

    CVE-2022-31089 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as single instance without redundancy, the…

    Published 27 Jun 2022 · Fixed in 4.10.12, 5.2.3 · NVD
  33. Medium 5.4

    CVE-2022-31057 · Shopware

    Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue.

    Published 27 Jun 2022 · Fixed in 5.7.12 · NVD
  34. Medium 4.3

    CVE-2022-31036 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a…

    Published 27 Jun 2022 · Fixed in 2.1.6 · NVD
  35. Medium 5.4

    CVE-2022-31035 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a `javascript:` link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). The script would be capable of doing anything…

    Published 27 Jun 2022 · Fixed in 2.1.16 · NVD
  36. High 8.1

    CVE-2022-31034 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in parameters in Oauth2/OIDC login flows. In each case, using a relatively-predictable (time-based) seed in a…

    Published 27 Jun 2022 · Fixed in 2.1.16 · NVD
  37. Medium 6.1

    CVE-2022-2090 · Woo Discount Rules (WordPress plugin)

    Discount Rules for WooCommerce: Cross-site Scripting

    Published 27 Jun 2022 · Fixed in 2.4.2 · WPVulnerability
  38. Medium 6.5

    CVE-2022-31016 · Argo CD

    Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to…

    Published 25 Jun 2022 · Fixed in 2.2.10, 2.3.5, 2.4.1 · NVD
  39. Medium 6.1

    CVE-2022-30120 · Concrete CMS

    XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS…

    Published 24 Jun 2022 · Fixed in 8.5.8, 9.1.0 · NVD
  40. Medium 6.1

    CVE-2022-30119 · Concrete CMS

    XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this…

    Published 24 Jun 2022 · Fixed in 8.5.8, 9.1.0 · NVD
  41. Medium 6.1

    CVE-2022-30118 · Concrete CMS

    Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet Explorer with the XSS protection disabled, editing a form control in an express entities form for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 can allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape…

    Published 24 Jun 2022 · Fixed in 8.5.8, 9.1.0 · NVD
  42. Critical 9.1

    CVE-2022-30117 · Concrete CMS

    Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changing isFullChunkFilePresent to have an early false return when input doesn't match expectations.Concrete…

    Published 24 Jun 2022 · Fixed in 8.5.8, 9.1.0 · NVD
  43. Critical 9.8

    CVE-2022-21829 · Concrete CMS

    Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H…

    Published 24 Jun 2022 · Fixed in 8.5.8, 9.1.0 · NVD
  44. Medium 6.5

    CVE-2013-1891 · OpenCart

    In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective and can be bypassed.

    Published 24 Jun 2022 · NVD
  45. High 7.5

    CVE-2022-34175 · Jenkins

    Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view.

    Published 23 Jun 2022 · NVD
  46. High 7.5

    CVE-2022-34174 · Jenkins

    In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm.

    Published 23 Jun 2022 · NVD
  47. Medium 5.4

    CVE-2022-34173 · Jenkins

    In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

    Published 23 Jun 2022 · NVD
  48. Medium 5.4

    CVE-2022-34172 · Jenkins

    In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability.

    Published 23 Jun 2022 · NVD
  49. Medium 5.4

    CVE-2022-34171 · Jenkins

    In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.

    Published 23 Jun 2022 · NVD
  50. Medium 5.4

    CVE-2022-34170 · Jenkins

    In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

    Published 23 Jun 2022 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.