UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
650
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. High 7.5

    CVE-2022-33105 · Redis

    Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID.

    Published 23 Jun 2022 · NVD
  2. Medium 6.1

    CVE-2022-34305 · Apache Tomcat

    In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.

    Published 23 Jun 2022 · NVD
  3. High 8.1

    CVE-2022-31092 · Pimcore

    Improper quoting of columns when using setOrderBy() or setGroupBy() on listing classes

    Published 22 Jun 2022 · Fixed in 10.4.4 · NVD, Project advisories (GitHub)
  4. High 7.3

    CVE-2022-2068 · OpenSSL

    In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly…

    Published 21 Jun 2022 · Fixed in 1.0.2zf, 1.1.1p, 3.0.4 · NVD
  5. High 7.7

    CVE-2022-31090 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 20 Jun 2022 · Fixed in 2.2.3 · WPVulnerability
  6. Medium 4.8

    CVE-2022-2099 · WooCommerce

    WooCommerce: Improper Encoding or Escaping of Output

    Published 20 Jun 2022 · Fixed in 6.6.0 · NVD, WPVulnerability
  7. Medium 5.5

    CVE-2014-125025 · FFmpeg

    A vulnerability classified as problematic has been found in FFmpeg 2.0. This affects the function decode_pulses. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue.

    Published 19 Jun 2022 · NVD
  8. High 7.8

    CVE-2014-125024 · FFmpeg

    A vulnerability was found in FFmpeg 2.0. It has been rated as critical. Affected by this issue is the function lag_decode_frame. The manipulation leads to memory corruption. The attack may be launched remotely. It is recommended to apply a patch to fix this issue.

    Published 19 Jun 2022 · NVD
  9. Medium 5.5

    CVE-2014-125023 · FFmpeg

    A vulnerability was found in FFmpeg 2.0. It has been declared as problematic. Affected by this vulnerability is the function truemotion1_decode_header of the component Truemotion1 Handler. The manipulation leads to memory corruption. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.

    Published 19 Jun 2022 · NVD
  10. Medium 5.5

    CVE-2014-125022 · FFmpeg

    A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is the function shorten_decode_frame of the component Bitstream Buffer. The manipulation leads to memory corruption. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.

    Published 19 Jun 2022 · NVD
  11. Medium 5.5

    CVE-2014-125021 · FFmpeg

    A vulnerability was found in FFmpeg 2.0 and classified as problematic. This issue affects the function cmv_process_header. The manipulation leads to memory corruption. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue.

    Published 19 Jun 2022 · NVD
  12. High 7.8

    CVE-2014-125020 · FFmpeg

    A vulnerability has been found in FFmpeg 2.0 and classified as critical. This vulnerability affects the function decode_update_thread_context. The manipulation leads to memory corruption. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue.

    Published 19 Jun 2022 · NVD
  13. Medium 5.5

    CVE-2014-125019 · FFmpeg

    A vulnerability, which was classified as problematic, was found in FFmpeg 2.0. This affects the function decode_nal_unit of the component Slice Segment Handler. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue.

    Published 19 Jun 2022 · NVD
  14. Medium 5.5

    CVE-2014-125018 · FFmpeg

    A vulnerability, which was classified as problematic, has been found in FFmpeg 2.0. Affected by this issue is the function decode_slice_header. The manipulation leads to memory corruption. The attack may be launched remotely. It is recommended to apply a patch to fix this issue.

    Published 19 Jun 2022 · NVD
  15. High 7.8

    CVE-2014-125017 · FFmpeg

    A vulnerability classified as critical was found in FFmpeg 2.0. This vulnerability affects the function rpza_decode_stream. The manipulation leads to memory corruption. The attack can be initiated remotely. The name of the patch is Fixes Invalid Writes. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  16. Medium 5.5

    CVE-2014-125016 · FFmpeg

    A vulnerability was found in FFmpeg 2.0. It has been rated as problematic. This issue affects the function ff_init_buffer_info of the file utils.c. The manipulation leads to memory corruption. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  17. High 7.8

    CVE-2014-125015 · FFmpeg

    A vulnerability classified as critical has been found in FFmpeg 2.0. Affected is the function read_var_block_data. The manipulation leads to memory corruption. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  18. Medium 5.5

    CVE-2014-125014 · FFmpeg

    A vulnerability classified as problematic was found in FFmpeg 2.0. Affected by this vulnerability is an unknown functionality of the component HEVC Video Decoder. The manipulation leads to memory corruption. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  19. Medium 5.5

    CVE-2014-125013 · FFmpeg

    A vulnerability was found in FFmpeg 2.0 and classified as problematic. This issue affects the function msrle_decode_frame of the file libavcodec/msrle.c. The manipulation leads to memory corruption. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  20. Medium 5.5

    CVE-2014-125012 · FFmpeg

    A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is an unknown function of the file libavcodec/dxtroy.c. The manipulation leads to integer coercion error. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  21. High 7.8

    CVE-2014-125011 · FFmpeg

    A vulnerability was found in FFmpeg 2.0. It has been declared as problematic. Affected by this vulnerability is the function decode_frame of the file libavcodec/ansi.c. The manipulation leads to integer coercion error. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  22. Medium 5.5

    CVE-2014-125010 · FFmpeg

    A vulnerability was found in FFmpeg 2.0. It has been rated as critical. Affected by this issue is the function decode_slice_header of the file libavcodec/h64.c. The manipulation leads to memory corruption. The attack may be launched remotely. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  23. Medium 5.5

    CVE-2014-125009 · FFmpeg

    A vulnerability classified as problematic has been found in FFmpeg 2.0. This affects the function add_yblock of the file libavcodec/snow.h. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  24. Medium 5.5

    CVE-2014-125008 · FFmpeg

    A vulnerability classified as problematic has been found in FFmpeg 2.0. Affected is the function vorbis_header of the file libavformat/oggparsevorbis.c. The manipulation leads to memory corruption. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  25. Medium 5.5

    CVE-2014-125007 · FFmpeg

    A vulnerability classified as problematic was found in FFmpeg 2.0. Affected by this vulnerability is the function intra_pred of the file libavcodec/hevcpred_template.c. The manipulation leads to memory corruption. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  26. Medium 5.5

    CVE-2014-125006 · FFmpeg

    A vulnerability, which was classified as problematic, has been found in FFmpeg 2.0. Affected by this issue is the function output_frame of the file libavcodec/h264.c. The manipulation leads to memory corruption. The attack may be launched remotely. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  27. Medium 5.5

    CVE-2014-125005 · FFmpeg

    A vulnerability, which was classified as problematic, was found in FFmpeg 2.0. This affects the function decode_vol_header of the file libavcodec/mpeg4videodec.c. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  28. Medium 5.5

    CVE-2014-125004 · FFmpeg

    A vulnerability has been found in FFmpeg 2.0 and classified as problematic. This vulnerability affects the function decode_hextile of the file libavcodec/vmnc.c. The manipulation leads to memory corruption. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  29. Medium 5.5

    CVE-2014-125003 · FFmpeg

    A vulnerability was found in FFmpeg 2.0 and classified as problematic. This issue affects the function get_siz of the file libavcodec/jpeg2000dec.c. The manipulation leads to memory corruption. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  30. Medium 5.5

    CVE-2014-125002 · FFmpeg

    A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is the function dnxhd_init_rc of the file libavcodec/dnxhdenc.c. The manipulation leads to memory corruption. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.

    Published 18 Jun 2022 · NVD
  31. Medium 6.5

    CVE-2021-46784 · Squid

    SQUID-2021:7 Denial of Service in Gopher Processing

    Published 17 Jun 2022 · Fixed in 5.6 · NVD, Project advisories (GitHub)
  32. High 7.5

    CVE-2022-31083 · Parse Server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake certificate accessible via certain Apple domains and providing the URL to that certificate in an…

    Published 17 Jun 2022 · Fixed in 4.10.11, 5.2.2 · NVD
  33. High 7.5

    CVE-2022-32276 · Grafana

    Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. NOTE: the vendor considers this a UI bug, not a vulnerability

    Published 17 Jun 2022 · NVD
  34. High 7.8

    CVE-2022-32547 · ImageMagick

    In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte alignment at MagickCore/property.c. Whenever crafted or untrusted input is processed by ImageMagick, this causes a negative impact to application availability or other problems related to undefined behavior.

    Published 16 Jun 2022 · Fixed in 6.9.12-45, 7.1.0-30 · NVD
  35. High 7.8

    CVE-2022-32546 · ImageMagick

    A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.

    Published 16 Jun 2022 · Fixed in 6.9.12-44, 7.1.0-29 · NVD
  36. High 7.8

    CVE-2022-32545 · ImageMagick

    A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to undefined behavior.

    Published 16 Jun 2022 · Fixed in 6.9.12-43, 7.1.0-28 · NVD
  37. Medium 5.5

    CVE-2022-2085 · Ghostscript

    A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buffer device, it relies on an init_device_procs defined for the device that uses it as a prototype that depends upon the number of bits per pixel. For bpp > 64, mem_x_device is used and does not have an init_device_procs defined. This flaw…

    Published 16 Jun 2022 · NVD
  38. High 7.8

    CVE-2017-20052 · Python

    A vulnerability classified as problematic was found in Python 2.7.13. This vulnerability affects unknown code of the component pgAdmin4. The manipulation leads to uncontrolled search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

    Published 16 Jun 2022 · NVD
  39. High 8.8

    CVE-2022-31626 · PHP

    In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.

    Published 16 Jun 2022 · Fixed in 7.4.30, 8.0.20, 8.1.7 · NVD
  40. High 8.1

    CVE-2022-31625 · PHP

    In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.

    Published 16 Jun 2022 · Fixed in 7.4.30, 8.0.20, 8.1.7 · NVD
  41. Medium 5.5

    CVE-2022-30184 · .NET

    .NET and Visual Studio Information Disclosure Vulnerability

    Published 15 Jun 2022 · NVD
  42. Medium 5.5

    CVE-2022-21166 · VMware ESXi, Xen

    Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

    Published 15 Jun 2022 · NVD
  43. Medium 5.5

    CVE-2022-21127 · Xen

    Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

    Published 15 Jun 2022 · NVD
  44. Medium 5.5

    CVE-2022-21125 · VMware ESXi, Xen

    Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

    Published 15 Jun 2022 · NVD
  45. Medium 5.5

    CVE-2022-21123 · VMware ESXi, Xen

    Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

    Published 15 Jun 2022 · NVD
  46. Critical 10.0

    CVE-2022-32158 · Splunk Enterprise

    Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on all other Universal Forwarder endpoints subscribed to the deployment server.

    Published 15 Jun 2022 · Fixed in 9.0 · NVD
  47. High 7.5

    CVE-2022-32157 · Splunk Enterprise

    Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients…

    Published 15 Jun 2022 · Fixed in 9.0 · NVD
  48. High 8.1

    CVE-2022-32156 · Splunk Enterprise

    In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface (CLI) did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation for the Splunk CLI…

    Published 15 Jun 2022 · Fixed in 9.0 · NVD
  49. High 7.5

    CVE-2022-32155 · Splunk Enterprise

    In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environment. In 9.0, the universal forwarder now binds the management port to localhost preventing remote logins by default. If…

    Published 15 Jun 2022 · Fixed in 9.0 · NVD
  50. High 8.1

    CVE-2022-32154 · Splunk Enterprise

    Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands…

    Published 15 Jun 2022 · Fixed in 9.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.