UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
645
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. Medium 5.4

    CVE-2021-41032 · Fortinet FortiOS

    An improper access control vulnerability [CWE-284] in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricted user profile to gather sensitive information and modify the SSL-VPN tunnel status of other VDOMs using specific CLI commands.

    Published 4 May 2022 · Fixed in 6.4.9, 7.0.4 · NVD
  2. High 7.5

    CVE-2022-24901 · Parse Server

    Improper validation of the Apple certificate URL in the Apple Game Center authentication adapter allows attackers to bypass authentication, making the server vulnerable to DoS attacks. The vulnerability has been fixed by improving the URL validation and adding additional checks of the resource the URL points to before downloading it.

    Published 4 May 2022 · Fixed in 4.10.10, 5.2.1 · NVD
  3. High 7.5

    CVE-2022-27313 · Gitea

    An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configuration file.

    Published 3 May 2022 · NVD
  4. High 7.5

    CVE-2021-46440 · Strapi

    Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a cleartext password, leading to getting API documentation for further API attacks.

    Published 3 May 2022 · Fixed in 3.6.9, 4.1.5 · NVD
  5. High 7.5

    CVE-2022-1473 · OpenSSL

    The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial…

    Published 3 May 2022 · Fixed in 3.0.3 · NVD
  6. Medium 5.9

    CVE-2022-1434 · OpenSSL

    The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such that the modified data would still pass the MAC integrity check. Note that data sent from an…

    Published 3 May 2022 · Fixed in 3.0.3 · NVD
  7. Medium 5.3

    CVE-2022-1343 · OpenSSL

    The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this…

    Published 3 May 2022 · Fixed in 3.0.3 · NVD
  8. High 7.3

    CVE-2022-1292 · OpenSSL, MySQL

    The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL…

    Published 3 May 2022 · Fixed in 1.0.2ze, 1.1.1o, 3.0.3 · NVD
  9. High 7.5

    CVE-2022-20760 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the DNS inspection handler of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service condition (DoS) on an affected device. This vulnerability is due to a lack of proper processing of incoming requests. An attacker could exploit this vulnerability by sending…

    Published 3 May 2022 · Fixed in 9.15.1.21, 9.16.2.14, 9.17.1.7 · NVD
  10. High 8.8

    CVE-2022-20759 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15. This vulnerability is due to improper separation of authentication and authorization scopes. An attacker could exploit…

    Published 3 May 2022 · Fixed in 9.15.1.21, 9.16.2.14, 9.17.1.7 · NVD
  11. High 7.5

    CVE-2022-20745 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this…

    Published 3 May 2022 · Fixed in 9.15.1.21, 9.16.2.14, 9.17.1.7 · NVD
  12. High 7.4

    CVE-2022-20742 · Cisco ASA and Firepower Threat Defense

    A vulnerability in an IPsec VPN library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to read or modify data within an IPsec IKEv2 VPN tunnel. This vulnerability is due to an improper implementation of Galois/Counter Mode (GCM) ciphers. An attacker in a man-in-the-middle position could exploit…

    Published 3 May 2022 · Fixed in 9.15.1.21, 9.16.2.14, 9.17.1.7 · NVD
  13. High 7.1

    CVE-2022-20737 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the handler for HTTP authentication for resources accessed through the Clientless SSL VPN portal of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device or to obtain portions of process memory from an affected device. This vulnerability is due to insufficient bounds…

    Published 3 May 2022 · Fixed in 9.15.1.21, 9.16.2.14, 9.17.1.7 · NVD
  14. High 8.6

    CVE-2022-20715 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the remote access SSL VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validation of errors that are logged as a result of client connections that are made…

    Published 3 May 2022 · Fixed in 9.15.1.21, 9.16.2.14, 9.17.1.7 · NVD
  15. Medium 6.5

    CVE-2022-29824 · libxml2

    In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

    Published 3 May 2022 · Fixed in 2.9.14 · NVD
  16. Medium 5.5

    CVE-2022-1475 · FFmpeg

    An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729_parse() in llibavcodec/g729_parser.c when processing a specially crafted file.

    Published 2 May 2022 · Fixed in 4.4.2 · NVD
  17. High 8.8

    CVE-2022-23064 · Snipe-IT

    In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.

    Published 2 May 2022 · NVD
  18. Medium 5.4

    CVE-2021-4200 · Rancher

    A Improper Privilege Management vulnerability in SUSE Rancher allows write access to the Catalog for any user when restricted-admin role is enabled. This issue affects: SUSE Rancher Rancher versions prior to 2.5.13; Rancher versions prior to 2.6.4.

    Published 2 May 2022 · Fixed in 2.5.13, 2.6.4 · NVD
  19. High 7.2

    CVE-2021-36784 · Rancher

    A Improper Privilege Management vulnerability in SUSE Rancher allows users with the restricted-admin role to escalate to full admin. This issue affects: SUSE Rancher Rancher versions prior to 2.5.13; Rancher versions prior to 2.6.4.

    Published 2 May 2022 · Fixed in 2.5.13, 2.6.4 · NVD
  20. High 7.5

    CVE-2021-36778 · Rancher

    A Incorrect Authorization vulnerability in SUSE Rancher allows administrators of third-party repositories to gather credentials that are sent to their servers. This issue affects: SUSE Rancher Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3.

    Published 2 May 2022 · Fixed in 2.5.12, 2.6.3 · NVD
  21. High 7.5

    CVE-2022-28323 · MediaWiki

    An issue was discovered in MediaWiki through 1.37.2. The SecurePoll extension allows a leak because sorting by timestamp is supported,

    Published 30 Apr 2022 · NVD
  22. Medium 4.3

    CVE-2022-0984 · Moodle

    Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.

    Published 29 Apr 2022 · Fixed in 3.9.13, 3.10.10, 3.11.6 · NVD
  23. High 8.8

    CVE-2022-1227 · Podman

    A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.

    Published 29 Apr 2022 · Fixed in 4.0.0 · NVD
  24. High 7.1

    CVE-2022-1114 · ImageMagick

    A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.

    Published 29 Apr 2022 · Fixed in 6.9.12-43, 7.1.0-28 · NVD
  25. Medium 4.3

    CVE-2022-0985 · Moodle

    Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability.

    Published 29 Apr 2022 · Fixed in 3.9.13, 3.10.10, 3.11.6 · NVD
  26. Medium 6.1

    CVE-2022-29907 · MediaWiki

    The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages.

    Published 29 Apr 2022 · NVD
  27. Critical 9.8

    CVE-2022-29906 · MediaWiki

    The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin user.

    Published 29 Apr 2022 · NVD
  28. Medium 4.3

    CVE-2022-29905 · MediaWiki

    The FanBoxes extension for MediaWiki through 1.37.2 (before 027ffb0b9d6fe0d823810cf03f5b562a212162d4) allows Special:UserBoxes CSRF.

    Published 29 Apr 2022 · NVD
  29. Critical 9.8

    CVE-2022-29904 · MediaWiki

    The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with certain '-' and '_' constraints.

    Published 29 Apr 2022 · NVD
  30. Medium 4.3

    CVE-2022-29903 · MediaWiki

    The Private Domains extension for MediaWiki through 1.37.2 (before 1ad65d4c1c199b375ea80988d99ab51ae068f766) allows CSRF for editing pages that store the extension's configuration. The attacker must trigger a POST request to Special:PrivateDomains.

    Published 29 Apr 2022 · NVD
  31. High 7.5

    CVE-2022-24892 · Shopware

    Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be requested. All tokens can be used to change the password. This makes it possible for an attacker to take over the victim's account if they somehow gain access to the victims email account and find an unused password reset token in the emails.…

    Published 28 Apr 2022 · Fixed in 5.7.9 · NVD
  32. High 7.5

    CVE-2022-24879 · Shopware

    Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery (CSRF) token validation. Under certain circumstances, the CSRF tokens were not generated anew and not validated correctly. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security…

    Published 28 Apr 2022 · Fixed in 5.7.9 · NVD
  33. Medium 6.5

    CVE-2022-1511 · Snipe-IT

    Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4.

    Published 28 Apr 2022 · Fixed in 5.4.4 · NVD
  34. Medium 6.1

    CVE-2022-24873 · Shopware

    Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cross-site scripting in the storefront. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.

    Published 28 Apr 2022 · Fixed in 5.7.9 · NVD
  35. High 8.8

    CVE-2022-1509 · Hestia Control Panel

    Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context.

    Published 28 Apr 2022 · Fixed in 1.5.12 · NVD
  36. Medium 6.1

    CVE-2022-24891 · Oracle WebLogic Server

    ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause "javascript:" URLs to fail to be correctly sanitized. This issue is…

    Published 27 Apr 2022 · NVD
  37. Medium 5.5

    CVE-2022-24736 · Redis

    Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable,…

    Published 27 Apr 2022 · Fixed in 6.2.7 · NVD
  38. High 7.8

    CVE-2022-24735 · Redis

    Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. The Lua script execution environment in Redis provides some measures that prevent a script from creating side…

    Published 27 Apr 2022 · Fixed in 6.2.7 · NVD
  39. High 7.5

    CVE-2022-22275 · SonicWall SonicOS

    Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake potentially resulting in Denial of Service (DoS) attack if a target host is vulnerable.

    Published 27 Apr 2022 · NVD
  40. Medium 4.3

    CVE-2022-24889 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 , 22.2.4, and 23.0.1.

    Published 27 Apr 2022 · Fixed in 21.0.8, 22.2.4, 23.0.1 · NVD
  41. Medium 4.3

    CVE-2022-24888 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is possible to create files and folders that have leading and trailing \n, \r, \t, and \v characters. The server rejects files and folders that have these characters in the middle of their names, so this might be an opportunity for…

    Published 27 Apr 2022 · Fixed in 21.0.8, 22.2.4, 23.0.1 · NVD
  42. Medium 5.4

    CVE-2022-1173 · Grav

    stored xss in GitHub repository getgrav/grav prior to 1.7.33.

    Published 26 Apr 2022 · Fixed in 1.7.33 · NVD
  43. Critical 9.8Actively exploited

    CVE-2022-24706 · Apache CouchDB

    In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

    Published 26 Apr 2022 · Fixed in 3.2.2 · NVD
  44. Critical 9.8

    CVE-2022-23457 · Oracle WebLogic Server

    ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an…

    Published 25 Apr 2022 · NVD
  45. High 7.5

    CVE-2021-35250 · SolarWinds Serv-U

    A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installation and server files. This issue has been resolved in Serv-U 15.3 Hotfix 1.

    Published 25 Apr 2022 · NVD
  46. Medium 4.9

    CVE-2022-0477 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.6.4, all versions starting from 14.7.0 before 14.7.1. GitLab was not correctly handling bulk requests to delete existing packages from the package registries which could result in a Denial of Service under specific conditions.

    Published 25 Apr 2022 · Fixed in 14.5.4, 14.6.4 · NVD
  47. Medium 6.1

    CVE-2022-26597 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the site name.

    Published 25 Apr 2022 · Fixed in 7.3 · NVD
  48. Medium 6.1

    CVE-2022-26596 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.

    Published 25 Apr 2022 · NVD
  49. Medium

    CVE-2021-20323 · Keycloak

    Reflected XSS on clients-registrations endpoint

    Published 25 Apr 2022 · Fixed in 18.0.0 · Project advisories (GitHub)
  50. Low

    CVE-2020-10734 · Keycloak

    OIDC Logout redirects can happen even if no id_token_hint is provided

    Published 25 Apr 2022 · Fixed in 18.0.0 · Project advisories (GitHub)

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.