Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,067
- Published in 7 days
- 650
- Critical in 30 days
- 382
- Actively exploited
- 421
Latest vulnerabilities
39,067 vulnerabilities- High 7.1
CVE-2022-1944 · GitLab
When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows users with the Developer role to open terminals on other Developers' running jobs
Published 6 Jun 2022 · Fixed in 14.9.5, 14.10.4 · NVD - Medium 5.4
CVE-2022-1940 · GitLab
A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf via specially crafted Jira Issues
Published 6 Jun 2022 · Fixed in 14.9.5, 14.10.4 · NVD - Medium 6.5
CVE-2022-1936 · GitLab
Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Deploy Token to misuse it from any location even when IP address restrictions were configured
Published 6 Jun 2022 · Fixed in 14.9.5, 14.10.4 · NVD - Medium 6.5
CVE-2022-1935 · GitLab
Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Trigger Token to misuse it from any location even when IP address restrictions were configured
Published 6 Jun 2022 · Fixed in 14.9.5, 14.10.4 · NVD - Medium 4.3
CVE-2022-1821 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. It may be possible for a subgroup member to access the members list of their parent group.
Published 6 Jun 2022 · Fixed in 14.9.5, 14.10.4 · NVD - Low 2.7
CVE-2022-1783 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. It may be possible for malicious group maintainers to add new members to a project within their group, through the REST API, even after their group owner enabled a setting to prevent members from…
Published 6 Jun 2022 · Fixed in 14.9.5, 14.10.4 · NVD - Critical 9.8Actively exploited
CVE-2022-26134 · Confluence
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before…
Published 3 Jun 2022 · Fixed in 7.15.2, 7.16.4, 7.17.4 · NVD - Medium 6.1
CVE-2022-29718 · Caddy, github.com/caddyserver/caddy
Open redirect in caddy
Published 2 Jun 2022 · Fixed in 2.5.0 · NVD, OSV.dev and GitHub - Medium 6.5
CVE-2022-1982 · Mattermost
Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post.
Published 2 Jun 2022 · Fixed in 6.3.8, 6.4.3 · NVD - Medium 4.3
CVE-2022-30115 · curl
Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in…
Published 2 Jun 2022 · Fixed in 7.83.1 · NVD - High 7.5
CVE-2022-27782 · curl
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.
Published 2 Jun 2022 · Fixed in 7.83.1 · NVD - High 7.5
CVE-2022-27781 · curl
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.
Published 2 Jun 2022 · Fixed in 7.83.1 · NVD - High 7.5
CVE-2022-27780 · curl
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and…
Published 2 Jun 2022 · Fixed in 7.83.1 · NVD - Medium 5.3
CVE-2022-27779 · curl
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check…
Published 2 Jun 2022 · Fixed in 7.83.1 · NVD - High 8.1
CVE-2022-27778 · curl, MySQL
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.
Published 2 Jun 2022 · NVD - Medium 6.5
CVE-2022-27776 · curl
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
Published 2 Jun 2022 · Fixed in 7.83.0 · NVD - High 7.5
CVE-2022-27775 · curl
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.
Published 2 Jun 2022 · NVD - Medium 5.7
CVE-2022-27774 · curl
An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.
Published 2 Jun 2022 · NVD - High 7.5
CVE-2021-40186 · DNN Platform
The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke. SSRF vulnerabilities allow the attacker to exploit the target system to make network requests on their behalf, allowing a range of possible attacks. In the most common scenario, the attacker exploits SSRF vulnerabilities to attack systems behind the…
Published 2 Jun 2022 · NVD - Medium 4.3
CVE-2022-29243 · Nextcloud
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are…
Published 31 May 2022 · Fixed in 22.2.7, 23.0.4 · NVD - High 8.8
CVE-2021-32546 · Gogs
Remote Command Execution in file editing
Published 31 May 2022 · Fixed in 0.12.8 · NVD, Project advisories (GitHub) - Critical 9.8
CVE-2022-1884 · Gogs
OS Command Injection in file uploading
Published 31 May 2022 · Fixed in 0.12.8 · NVD, Project advisories (GitHub) - Low
GHSA-pj96-4jhv-v792 · Gogs
XSS in cookies
Published 31 May 2022 · Fixed in 0.12.8 · Project advisories (GitHub) - Medium 6.5
CVE-2022-1285 · Gogs
SSRF in webhook
Published 31 May 2022 · Fixed in 0.12.8 · NVD, Project advisories (GitHub) - Medium 5.4
CVE-2022-1928 · Gitea
Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9.
Published 29 May 2022 · Fixed in 1.16.9 · NVD - High 8.1
CVE-2022-22576 · curl
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).
Published 26 May 2022 · Fixed in 7.83.0 · NVD - Medium 5.5
CVE-2022-31624 · MariaDB
MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c method log_statement_ex, the held lock lock_bigbuffer is not released correctly, which allows local users to trigger a denial of service due to the deadlock.
Published 25 May 2022 · Fixed in 10.4.22, 10.5.13, 10.6.5 · NVD - Medium 5.5
CVE-2022-31623 · MariaDB
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (i.e., going to the err label) while executing the method create_worker_threads, the held lock thd->ctrl_mutex is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug…
Published 25 May 2022 · Fixed in 10.5.14, 10.6.6, 10.7.2 · NVD - Medium 5.5
CVE-2022-31622 · MariaDB
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (pthread_create returns a nonzero value) while executing the method create_worker_threads, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not…
Published 25 May 2022 · Fixed in 10.5.14, 10.6.6, 10.7.2 · NVD - Medium 5.5
CVE-2022-31621 · MariaDB
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability…
Published 25 May 2022 · Fixed in 10.4.22, 10.5.13, 10.6.5 · NVD - High 8.1
CVE-2022-29248 · Drupal
Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains. The cookie middleware is disabled by default, so most library…
Published 25 May 2022 · Fixed in 9.2.20, 9.3.14 · NVD - Medium 6.1
CVE-2022-29710 · LimeSurvey
A cross-site scripting (XSS) vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below allows attackers to execute arbitrary web scripts or HTML via a crafted plugin.
Published 25 May 2022 · NVD - Medium 6.8
CVE-2022-21951 · Rancher
Weave CNI password is not configured when a cluster is created from an RKE template
Published 24 May 2022 · Fixed in 2.5.14, 2.6.5 · NVD, Project advisories (GitHub) - Medium 5.3
CVE-2022-22306 · Fortinet FortiOS
An improper certificate validation vulnerability [CWE-295] in FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 through 6.4.8, 7.0.0 may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the FortiGate and some peers such as private SDNs and external cloud platforms.
Published 24 May 2022 · Fixed in 6.4.9 · NVD - Medium 5.3
CVE-2022-31263 · Mastodon
app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions.
Published 24 May 2022 · Fixed in 3.5.0 · NVD - Medium 6.1
CVE-2022-25772 · Mautic
XSS vulnerability in tracking pixel functionality
Published 23 May 2022 · Fixed in 4.3.0 · NVD, Project advisories (GitHub) - Medium 4.8
CVE-2021-27914 · Mautic
XSS vulnerability in installer
Published 23 May 2022 · Fixed in 4.3.0 · NVD, Project advisories (GitHub) - Medium 6.5
CVE-2021-41834 · JFrog Artifactory
JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any artifact that exists in the Artifactory deployment due to improper permissions validation.
Published 23 May 2022 · Fixed in 6.23.38, 7.28.0 · NVD - Medium 5.9
CVE-2022-22365 · IBM WebSphere Application Server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application (AjaxProxy.war) deployed, is vulnerable to spoofing by allowing a man-in-the-middle attacker to spoof SSL server hostnames. IBM X-Force ID: 220904.
Published 20 May 2022 · NVD - Medium 4.3
CVE-2022-29163 · Nextcloud
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Versions 22.2.6 and 23.0.3 contain a patch for this issue. There are currently no known workarounds.
Published 20 May 2022 · Fixed in 22.2.6, 23.0.3 · NVD - Critical 10.0
CVE-2022-29165 · Argo CD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 and prior to versions 2.1.15, 2.2.9, and 2.3.4 which would allow unauthenticated users to impersonate as any Argo CD user or role, including the `admin` user, by sending a specifically crafted JSON Web Token (JWT) along with the request. In…
Published 20 May 2022 · Fixed in 2.1.15, 2.2.9, 2.3.4 · NVD - Critical 9.8
CVE-2022-28660 · Grafana
The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1.3.1, and 1.4.0 contain the bugfix. This affects -auth.type=enterprise in microservices mode
Published 20 May 2022 · Fixed in 1.2.1 · NVD - Medium 4.3
CVE-2022-24905 · Argo CD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was found in Argo CD prior to versions 2.3.4, 2.2.9, and 2.1.15 that allows an attacker to spoof error messages on the login screen when single sign on (SSO) is enabled. In order to exploit this vulnerability, an attacker would have to trick the victim to visit a specially crafted URL which contains the…
Published 20 May 2022 · Fixed in 2.1.15, 2.2.9, 2.3.4 · NVD - Medium 4.3
CVE-2022-24904 · Argo CD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a…
Published 20 May 2022 · Fixed in 2.1.15, 2.2.9, 2.3.4 · NVD - High 8.8
CVE-2022-28961 · SPIP
Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where parameters.
Published 19 May 2022 · NVD - High 8.8
CVE-2022-28960 · SPIP
A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire.
Published 19 May 2022 · Fixed in 3.2.8 · NVD - Medium 6.1
CVE-2022-28959 · SPIP
Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to execute arbitrary web scripts or HTML.
Published 19 May 2022 · NVD - High 7.5
CVE-2022-30618 · Strapi
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permissions). There are many scenarios in which such details from API users can leak in the JSON response within the admin panel, either through…
Published 19 May 2022 · Fixed in 3.6.10, 4.1.10 · NVD - High 8.8
CVE-2022-30617 · Strapi
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to the authenticated user. For example, a low-privileged “author” role account can view these details in the JSON response for an “editor” or “super…
Published 19 May 2022 · Fixed in 3.6.10 · NVD - High 8.8
CVE-2022-1423 · GitLab
Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows a malicious actor with Developer privileges to perform cache poisoning leading to arbitrary code execution in protected branches
Published 19 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.