UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
650
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. High 8.1

    CVE-2022-32153 · Splunk Enterprise

    Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and…

    Published 15 Jun 2022 · Fixed in 9.0 · NVD
  2. High 7.2

    CVE-2022-32152 · Splunk Enterprise

    Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and…

    Published 15 Jun 2022 · Fixed in 9.0 · NVD
  3. Critical 9.1

    CVE-2022-32151 · Splunk Enterprise

    The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203. Python 3 client libraries now verify server certificates by default and use the appropriate CA certificate stores for each…

    Published 15 Jun 2022 · Fixed in 9.0 · NVD
  4. Medium 6.6

    CVE-2022-24785 · Ghost

    Remote code execution in locale setting change

    Published 15 Jun 2022 · Fixed in 5.2.3 · Project advisories (GitHub)
  5. Medium 5.3

    CVE-2022-31060 · Discourse

    Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches of Discourse. As a workaround, one may disable…

    Published 14 Jun 2022 · Fixed in 2.8.4 · NVD
  6. High 7.2

    CVE-2022-31050 · TYPO3

    Insufficient Session Expiration in Admin Tool

    Published 14 Jun 2022 · Fixed in 9.5.35, 10.4.29, 11.5.11 · NVD, Project advisories (GitHub)
  7. Medium 5.4

    CVE-2022-31049 · TYPO3

    Cross-Site Scripting in Frontend Login Mailer

    Published 14 Jun 2022 · Fixed in 9.5.35, 10.4.29, 11.5.11 · NVD, Project advisories (GitHub)
  8. Medium 5.4

    CVE-2022-31048 · TYPO3

    Cross-Site Scripting in Form Framework

    Published 14 Jun 2022 · Fixed in 9.5.35, 10.4.29, 11.5.11 · NVD, Project advisories (GitHub)
  9. Medium 6.5

    CVE-2022-31047 · TYPO3

    Information Disclosure via Exception Handling/Logger

    Published 14 Jun 2022 · Fixed in 9.5.35, 10.4.29, 11.5.11 · NVD, Project advisories (GitHub)
  10. Medium 4.3

    CVE-2022-31046 · TYPO3

    Information Disclosure via Export Module

    Published 14 Jun 2022 · Fixed in 9.5.35, 10.4.29, 11.5.11 · NVD, Project advisories (GitHub)
  11. Unrated

    WPV-c5e3a8961a8a · Flexible Shipping (WordPress plugin)

    Vulnerability in Weight Based Shipping Table Rate for WooCommerce – Flexible Shipping

    Published 14 Jun 2022 · Fixed in 4.11.9 · WPVulnerability
  12. Unrated

    WPV-a5039dad8eaf · Flexible Shipping (WordPress plugin)

    Vulnerability in Weight Based Shipping Table Rate for WooCommerce – Flexible Shipping

    Published 14 Jun 2022 · Fixed in 4.11.9 · WPVulnerability
  13. Medium 5.4

    CVE-2022-2060 · Dolibarr ERP CRM

    Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.

    Published 13 Jun 2022 · Fixed in 16.0.0 · NVD
  14. Medium 4.8

    CVE-2022-29894 · Strapi

    Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege.

    Published 13 Jun 2022 · NVD
  15. Medium 6.1

    CVE-2022-29455 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 13 Jun 2022 · Fixed in 3.5.6 · NVD, WPVulnerability
  16. High 8.4

    CVE-2021-41641 · Deno

    Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory.

    Published 12 Jun 2022 · NVD
  17. High 7.5

    CVE-2022-30780 · lighttpd

    Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers.

    Published 11 Jun 2022 · NVD
  18. High 7.5

    CVE-2022-31043 · Drupal

    Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this…

    Published 10 Jun 2022 · Fixed in 9.2.21, 9.3.16 · NVD
  19. High 7.5

    CVE-2022-31042 · Drupal

    Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the `Cookie` header on. Prior to…

    Published 10 Jun 2022 · Fixed in 9.2.21, 9.3.16 · NVD
  20. Medium 6.5

    CVE-2022-29250 · GLPI

    GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user must be logged in.

    Published 9 Jun 2022 · NVD
  21. Medium 5.4

    CVE-2022-24876 · GLPI

    GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scripting vulnerability in Kanban by injecting HTML code in its user name. Users are advised to upgrade.…

    Published 9 Jun 2022 · NVD
  22. Critical 9.8

    CVE-2022-31813 · Apache HTTP Server

    Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.

    Published 9 Jun 2022 · Fixed in 2.4.54 · NVD
  23. High 7.5

    CVE-2022-30556 · Apache HTTP Server

    Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.

    Published 9 Jun 2022 · Fixed in 2.4.54 · NVD
  24. High 7.5

    CVE-2022-30522 · Apache HTTP Server

    If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.

    Published 9 Jun 2022 · NVD
  25. High 7.5

    CVE-2022-29404 · Apache HTTP Server

    In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.

    Published 9 Jun 2022 · NVD
  26. Critical 9.1

    CVE-2022-28615 · Apache HTTP Server

    Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.

    Published 9 Jun 2022 · Fixed in 2.4.54 · NVD
  27. Medium 5.3

    CVE-2022-28614 · Apache HTTP Server

    The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be…

    Published 9 Jun 2022 · NVD
  28. Medium 5.3

    CVE-2022-28330 · Apache HTTP Server

    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.

    Published 9 Jun 2022 · NVD
  29. High 7.5

    CVE-2022-26377 · Apache HTTP Server

    Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

    Published 9 Jun 2022 · Fixed in 2.4.54 · NVD
  30. Medium 6.7

    CVE-2022-26364 · Xen

    x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to…

    Published 9 Jun 2022 · NVD
  31. Medium 6.7

    CVE-2022-26363 · Xen

    x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to…

    Published 9 Jun 2022 · NVD
  32. Medium 6.4

    CVE-2022-26362 · Xen

    x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, the logic for acquiring a type reference has a race condition, whereby a safely…

    Published 9 Jun 2022 · NVD
  33. High 8.8

    CVE-2019-25067 · Podman

    A vulnerability, which was classified as critical, was found in Podman and Varlink 1.5.1. This affects an unknown part of the component API. The manipulation leads to Remote Privilege Escalation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-143949 was assigned to this vulnerability.

    Published 9 Jun 2022 · NVD
  34. High 7.5

    CVE-2022-29227 · Envoy

    Internal redirect crash for requests with body/trailers

    Published 9 Jun 2022 · Fixed in 1.22.1 · NVD, Project advisories (GitHub)
  35. High 7.5

    CVE-2022-29228 · Envoy

    oauth filter calls continueDecoding() from within decodeHeaders()

    Published 9 Jun 2022 · Fixed in 1.22.1 · NVD, Project advisories (GitHub)
  36. Critical 9.1

    CVE-2022-29226 · Envoy

    oauth filter allows trivial bypass

    Published 9 Jun 2022 · Fixed in 1.22.1 · NVD, Project advisories (GitHub)
  37. Medium 5.9

    CVE-2022-29224 · Envoy

    Segfault in GrpcHealthCheckerImpl

    Published 9 Jun 2022 · Fixed in 1.22.1 · NVD, Project advisories (GitHub)
  38. High 7.5

    CVE-2022-29225 · Envoy

    Decompressors can be zip bombed

    Published 9 Jun 2022 · Fixed in 1.22.1 · NVD, Project advisories (GitHub)
  39. Medium 6.1

    CVE-2022-30875 · Dolibarr ERP CRM

    Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page.

    Published 8 Jun 2022 · NVD
  40. High 8.1

    CVE-2022-1993 · Gogs

    Path Traversal in Git HTTP endpoints

    Published 8 Jun 2022 · Fixed in 0.12.8, 0.12.9 · NVD, Project advisories (GitHub)
  41. Critical 9.1

    CVE-2022-1992 · Gogs

    Path Traversal in file editor on Windows

    Published 8 Jun 2022 · Fixed in 0.12.9 · NVD, Project advisories (GitHub)
  42. Critical 9.8

    CVE-2022-1986 · Gogs

    OS Command Injection in file editor

    Published 8 Jun 2022 · Fixed in 0.12.9 · NVD, Project advisories (GitHub)
  43. Medium 5.4

    CVE-2022-31038 · Gogs

    XSS vulnerability in repository issue list

    Published 8 Jun 2022 · Fixed in 0.12.9 · NVD, Project advisories (GitHub)
  44. High 7.5

    CVE-2022-31028 · MinIO

    MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected. Users should upgrade to RELEASE.2022-06-02T02-11-04Z…

    Published 7 Jun 2022 · Fixed in 2022-06-02t02-11-04z · NVD
  45. Medium 5.3

    CVE-2022-31025 · Discourse

    Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the `stable` branch and 2.9.0beta5 on the `beta` and `tests-passed` branches, inviting users on sites that use single sign-on could bypass the `must_approve_users` check and invites by staff are always approved automatically. The issue is patched in Discourse version 2.8.4 on the `stable` branch and version…

    Published 7 Jun 2022 · Fixed in 2.8.4 · NVD
  46. Critical 9.1

    CVE-2022-25361 · WatchGuard Fireware OS

    WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited set of directories on the system. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

    Published 7 Jun 2022 · Fixed in 12.1.3, 12.5.9 · NVD
  47. High 7.5

    CVE-2022-32275 · Grafana

    Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content

    Published 6 Jun 2022 · NVD
  48. High 7.5

    CVE-2022-23712 · Elasticsearch

    A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.

    Published 6 Jun 2022 · Fixed in 8.2.1 · NVD
  49. High 8.8

    CVE-2022-1680 · GitLab

    An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature (available only on Premium+ subscriptions) may allow any owner of a Premium group to invite arbitrary users through their username…

    Published 6 Jun 2022 · Fixed in 14.9.5, 14.10.4 · NVD
  50. Medium 5.5

    CVE-2022-31030 · containerd

    containerd CRI plugin: Host memory exhaustion through ExecSync

    Published 6 Jun 2022 · Fixed in 1.5.13, 1.6.6 · NVD, Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.