UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
645
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. Low 2.7

    CVE-2022-21423 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial…

    Published 19 Apr 2022 · NVD
  2. Medium 5.0

    CVE-2022-21418 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash…

    Published 19 Apr 2022 · NVD
  3. Medium 4.9

    CVE-2022-21417 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 19 Apr 2022 · NVD
  4. Medium 4.9

    CVE-2022-21415 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 19 Apr 2022 · NVD
  5. Medium 4.9

    CVE-2022-21414 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 19 Apr 2022 · NVD
  6. Medium 4.9

    CVE-2022-21413 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 19 Apr 2022 · NVD
  7. Medium 4.9

    CVE-2022-21412 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 19 Apr 2022 · NVD
  8. Medium 4.6

    CVE-2022-1385 · Mattermost

    Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.

    Published 19 Apr 2022 · Fixed in 6.5.0 · NVD
  9. High 8.8

    CVE-2022-1384 · Mattermost

    Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities.

    Published 19 Apr 2022 · Fixed in 6.5.0 · NVD
  10. Medium 4.3

    CVE-2022-26595 · Liferay Portal / DXP

    Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.

    Published 19 Apr 2022 · NVD
  11. Medium 5.4

    CVE-2022-26593 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of a asset category.

    Published 19 Apr 2022 · Fixed in 7.3, 7.3.7 · NVD
  12. Medium 5.3

    CVE-2022-27652 · Docker Engine

    A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when…

    Published 18 Apr 2022 · Fixed in 20.10.14 · NVD
  13. Medium 6.5

    CVE-2011-1762 · WordPress

    A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission.

    Published 18 Apr 2022 · Fixed in 3.0.6, 3.1.2 · NVD
  14. Medium 5.4

    CVE-2022-1380 · Snipe-IT

    Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.

    Published 16 Apr 2022 · Fixed in 5.4.3 · NVD
  15. High 8.8

    CVE-2022-27426 · Chamilo LMS

    A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file.

    Published 15 Apr 2022 · NVD
  16. Critical 9.8

    CVE-2022-27423 · Chamilo LMS

    Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php.

    Published 15 Apr 2022 · NVD
  17. Medium 6.1

    CVE-2022-27422 · Chamilo LMS

    A reflected cross-site scripting (XSS) vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL.

    Published 15 Apr 2022 · NVD
  18. High 7.2

    CVE-2022-27421 · Chamilo LMS

    Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin.

    Published 15 Apr 2022 · NVD
  19. Medium 6.1

    CVE-2022-26594 · Liferay Portal / DXP

    Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form builder, or (2) App Builder module's object form view's form builder.

    Published 15 Apr 2022 · Fixed in 7.3.7 · NVD
  20. Medium 5.4

    CVE-2022-24855 · Metabase

    Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_internal` that can allow for cross site scripting (XSS) attacks, potentially leading to phishing attempts with malicious links that could lead to account takeover. Users are advised to either upgrade immediately, or block access in your firewall…

    Published 14 Apr 2022 · Fixed in 1.40.8, 1.41.7, 1.42.4 · NVD
  21. High 8.8

    CVE-2022-24854 · Metabase

    Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach this database to a second database, and then it can query across all the tables. To be able to do…

    Published 14 Apr 2022 · Fixed in 0.42.4, 1.41.7, 1.42.4 · NVD
  22. Medium 5.3

    CVE-2022-24853 · Metabase

    Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result in file access on windows, which allows enabling an `NTLM relay attack`, potentially allowing an…

    Published 14 Apr 2022 · Fixed in 1.40.8, 1.41.7, 1.42.4 · NVD
  23. Medium 4.3

    CVE-2022-24850 · Discourse

    Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has access to the category. As a result, a normal user is able to see whether a group has read/write permissions in the category even though the information should only be available to the users that can manage a category. This issue is patched in the latest stable,…

    Published 14 Apr 2022 · Fixed in 2.8.2 · NVD
  24. Medium 5.3

    CVE-2022-24824 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown the crawler view of the site instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. There are no known…

    Published 14 Apr 2022 · Fixed in 2.8.3 · NVD
  25. High 7.5

    CVE-2022-27457 · MariaDB

    MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  26. High 7.5

    CVE-2022-27456 · MariaDB

    MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  27. High 7.5

    CVE-2022-27455 · MariaDB

    MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  28. High 7.5

    CVE-2022-27452 · MariaDB

    MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  29. High 7.5

    CVE-2022-27451 · MariaDB

    MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  30. High 7.5

    CVE-2022-27449 · MariaDB

    MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  31. High 7.5

    CVE-2022-27448 · MariaDB

    There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  32. High 7.5

    CVE-2022-27447 · MariaDB

    MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  33. High 7.5

    CVE-2022-27446 · MariaDB

    MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  34. High 7.5

    CVE-2022-27445 · MariaDB

    MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  35. High 7.5

    CVE-2022-27444 · MariaDB

    MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  36. Medium 5.4

    CVE-2022-1351 · Pimcore

    Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4.

    Published 14 Apr 2022 · Fixed in 10.4.0 · NVD
  37. Critical 9.8

    CVE-2022-27479 · Apache Superset

    Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.

    Published 13 Apr 2022 · Fixed in 1.4.2 · NVD
  38. Medium 5.9

    CVE-2022-0023 · Palo Alto Networks PAN-OS

    An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-the-middle (MITM) to send specifically crafted traffic to the firewall that causes the service to restart unexpectedly. Repeated attempts to send this request result in denial-of-service to all PAN-OS services by restarting the device in…

    Published 13 Apr 2022 · Fixed in 9.1.13, 10.0.10, 10.1.5 · NVD
  39. Medium 6.5

    CVE-2022-1337 · Mattermost

    The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files.

    Published 13 Apr 2022 · Fixed in 6.2.5, 6.3.5, 6.4.2 · NVD
  40. Medium 4.3

    CVE-2022-1332 · Mattermost

    One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents.

    Published 13 Apr 2022 · Fixed in 6.2.5, 6.3.5, 6.4.2 · NVD
  41. High 7.6

    CVE-2015-20107 · Python

    In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

    Published 13 Apr 2022 · Fixed in 3.10.8 · NVD
  42. Medium 6.1

    CVE-2020-29653 · Froxlor

    Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.

    Published 13 Apr 2022 · NVD
  43. High 7.5

    CVE-2022-1339 · Pimcore

    SQL injection in ElementController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data

    Published 13 Apr 2022 · Fixed in 10.3.5 · NVD
  44. High 8.8

    CVE-2022-1329 · Elementor

    Elementor Website Builder – more than just a page builder: Unrestricted Upload of File with Dangerous Type

    Published 13 Apr 2022 · NVD, WPVulnerability
  45. High 7.5

    CVE-2022-27387 · MariaDB

    MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  46. High 7.5

    CVE-2022-27386 · MariaDB

    MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  47. High 7.5

    CVE-2022-27385 · MariaDB

    An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.4.22, 10.5.13, 10.6.5 · NVD
  48. High 7.5

    CVE-2022-27384 · MariaDB

    An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.6.8, 10.7.4, 10.8.3 · NVD
  49. High 7.5

    CVE-2022-27383 · MariaDB

    MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.6.8, 10.7.4, 10.8.3 · NVD
  50. High 7.5

    CVE-2022-27382 · MariaDB

    MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.