UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
645
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. Medium 5.4

    CVE-2022-1416 · GitLab

    Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling

    Published 19 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  2. High 7.5

    CVE-2022-1413 · GitLab

    Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 causes potentially sensitive integration properties to be disclosed in the web interface

    Published 19 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  3. Medium 4.9

    CVE-2021-45730 · JFrog Artifactory

    JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts configuration should only be available for Platform Administrators.

    Published 19 May 2022 · Fixed in 7.31.10 · NVD
  4. High 8.5

    CVE-2022-29170 · Grafana

    CVE-2022-29170: Grafana Enterprise datasource network restrictions bypass via HTTP redirects

    Published 19 May 2022 · Fixed in 7.5.16, 8.5.3 · NVD, Project advisories (GitHub)
  5. High 7.5

    CVE-2022-1183 · BIND 9

    On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0…

    Published 19 May 2022 · NVD
  6. Critical 9.8

    CVE-2022-30600 · Moodle

    A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.

    Published 18 May 2022 · Fixed in 3.9.14, 3.10.11, 3.11.7 · NVD
  7. Critical 9.8

    CVE-2022-30599 · Moodle

    A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.

    Published 18 May 2022 · Fixed in 3.9.14, 3.10.11, 3.11.7 · NVD
  8. Medium 4.3

    CVE-2022-30598 · Moodle

    A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it.

    Published 18 May 2022 · Fixed in 3.9.14, 3.10.11, 3.11.7 · NVD
  9. Medium 5.3

    CVE-2022-30597 · Moodle

    A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.

    Published 18 May 2022 · Fixed in 3.9.14, 3.10.11, 3.11.7 · NVD
  10. Medium 5.4

    CVE-2022-30596 · Moodle

    A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.

    Published 18 May 2022 · Fixed in 3.9.14, 3.10.11, 3.11.7 · NVD
  11. Medium 4.3

    CVE-2021-35249 · SolarWinds Serv-U

    This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data (read only operation). This UAC issue leads to a data leak to unauthorized users for a domain, with no log of them accessing the data unless they attempt to modify it.…

    Published 17 May 2022 · Fixed in 15.3.1 · NVD
  12. Medium 5.3

    CVE-2022-30689 · HashiCorp Vault

    HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3.

    Published 17 May 2022 · Fixed in 1.10.3 · NVD
  13. Medium 6.5

    CVE-2022-22475 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an authenticated user. IBM X-Force ID: 225603.

    Published 17 May 2022 · NVD
  14. High 8.8

    CVE-2022-29221 · Smarty

    PHP Code Injection by malicious block or filename

    Published 17 May 2022 · Fixed in 3.1.45, 4.1.1 · NVD, Project advisories (GitHub)
  15. High 8.8

    CVE-2022-0573 · JFrog Artifactory

    JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.

    Published 16 May 2022 · Fixed in 7.31.16, 7.33.12, 7.34.4 · NVD
  16. High 7.5

    CVE-2022-30781 · Gitea

    Gitea before 1.16.7 does not escape git fetch remote.

    Published 16 May 2022 · Fixed in 1.16.7 · NVD
  17. High 8.8

    CVE-2022-30708 · Webmin

    Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.

    Published 15 May 2022 · NVD
  18. Medium 6.5

    CVE-2022-22393 · IBM WebSphere Application Server

    IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.5 , with the adminCenter-1.0 feature configured, could allow an authenticated user to issue a request to obtain the status of HTTP/HTTPS ports which are accessible by the application server. IBM X-Force ID: 222078.

    Published 13 May 2022 · NVD
  19. High 8.6

    CVE-2022-25762 · Apache Tomcat

    If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result…

    Published 13 May 2022 · Fixed in 8.5.76, 9.0.21 · NVD
  20. Medium 6.1

    CVE-2022-28818 · Adobe ColdFusion

    ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 12 May 2022 · Fixed in 2018 · NVD
  21. Medium 6.1

    CVE-2022-29929 · TeamCity

    In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible

    Published 12 May 2022 · Fixed in 2022.04 · NVD
  22. Medium 4.9

    CVE-2022-29928 · TeamCity

    In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible

    Published 12 May 2022 · Fixed in 2022.04 · NVD
  23. Medium 6.1

    CVE-2022-29927 · TeamCity

    In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible

    Published 12 May 2022 · Fixed in 2022.04 · NVD
  24. High 7.5

    CVE-2022-29885 · Apache Tomcat

    The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running…

    Published 12 May 2022 · NVD
  25. High 7.8

    CVE-2022-29162 · runc

    Default inheritable capabilities for linux container should be empty

    Published 11 May 2022 · Fixed in 1.1.2 · NVD, Project advisories (GitHub)
  26. Medium 6.5

    CVE-2021-36614 · MikroTik RouterOS

    Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

    Published 11 May 2022 · Fixed in 6.48.2 · NVD
  27. Medium 6.5

    CVE-2021-36613 · MikroTik RouterOS

    Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).

    Published 11 May 2022 · Fixed in 6.48.2 · NVD
  28. High 7.2

    CVE-2022-0024 · Palo Alto Networks PAN-OS

    A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committed on both hardware and virtual firewalls. This issue does not impact Panorama appliances or Prisma…

    Published 11 May 2022 · Fixed in 9.1.13, 10.0.10, 10.1.5 · NVD
  29. Medium 4.3

    CVE-2022-1545 · GitLab

    It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note.

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  30. High 7.5

    CVE-2022-1510 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious text in the CI Editor and CI Pipeline details page allowing the attacker to cause uncontrolled resource consumption.

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  31. Medium 4.9

    CVE-2022-1460 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not performing correct authorizations on scheduled pipelines allowing a malicious user to run a pipeline in the context of another user.

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  32. Medium 6.1

    CVE-2022-1433 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 14.4 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. Missing invalidation of Markdown caching causes potential payloads from a previously exploitable XSS vulnerability (CVE-2022-1175) to persist and execute.

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  33. Medium 4.3

    CVE-2022-1428 · GitLab

    An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was incorrectly verifying throttling limits for authenticated package requests which resulted in limits not being enforced.

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  34. Low 3.7

    CVE-2022-1426 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly authenticating a user that had some certain amount of information which allowed an user to authenticate without a personal access token.

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  35. Medium 6.5

    CVE-2022-1406 · GitLab

    Improper input validation in GitLab CE/EE affecting all versions from 8.12 prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0 allows a Developer to read protected Group or Project CI/CD variables by importing a malicious project

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  36. Medium 5.3

    CVE-2022-1352 · GitLab

    Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that restricts access to issue only to project members.

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  37. Medium 4.3

    CVE-2022-1124 · GitLab

    An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0, allowing Guest project members to access trace log of jobs when it is enabled

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  38. Medium 6.1

    CVE-2021-43081 · Fortinet FortiProxy, Fortinet FortiOS

    An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.0.3 and below, 6.4.8 and below, 6.2.10 and below, 6.0.14 to 6.0.0. and in FortiProxy version 7.0.1 and below, 2.0.7 to 2.0.0 web filter override form may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.

    Published 11 May 2022 · Fixed in 6.4.9, 7.0.2, 7.0.4 · NVD
  39. High 7.5

    CVE-2022-29145 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 10 May 2022 · NVD
  40. High 7.5

    CVE-2022-29117 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 10 May 2022 · NVD
  41. High 7.5

    CVE-2022-23267 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 10 May 2022 · NVD
  42. High 8.2

    CVE-2022-21978 · Microsoft Exchange Server

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Published 10 May 2022 · NVD
  43. Medium 5.3

    CVE-2022-1431 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious requests to the PyPi API endpoint allowing the attacker to cause uncontrolled resource consumption.

    Published 10 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  44. Medium 4.3

    CVE-2022-1417 · GitLab

    Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9.4, and all versions starting from 14.10 before 14.10.1 allows non-project members to access contents of Project Members-only Wikis via malicious CI jobs

    Published 10 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  45. High 8.8

    CVE-2022-29933 · Craft CMS

    Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the…

    Published 9 May 2022 · NVD
  46. High 7.5

    CVE-2022-28739 · Ruby

    There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.

    Published 9 May 2022 · Fixed in 2.7.6, 3.0.4, 3.1.2 · NVD
  47. Critical 9.8

    CVE-2022-28738 · Ruby

    A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.

    Published 9 May 2022 · Fixed in 3.0.4, 3.1.2 · NVD
  48. High 7.8

    CVE-2022-28463 · ImageMagick

    ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.

    Published 8 May 2022 · Fixed in 6.9.12-44, 7.1.0-29 · NVD
  49. Medium 6.1

    CVE-2022-27183 · Splunk Enterprise

    The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, and not installed on Splunk Cloud Platform instances. Note that the Cloud Monitoring Console is not impacted.

    Published 6 May 2022 · Fixed in 8.1.4 · NVD
  50. High 8.8

    CVE-2022-26889 · Splunk Enterprise

    In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page (e.g., HTML Injection, XSS) or bypass SPL safeguards for risky commands. The attack is browser-based. An attacker cannot exploit the attack at will and requires the attacker to…

    Published 6 May 2022 · Fixed in 8.1.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.