UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
645
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. High 7.5

    CVE-2022-27381 · MariaDB

    An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  2. High 7.5

    CVE-2022-27380 · MariaDB

    An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  3. High 7.5

    CVE-2022-27379 · MariaDB

    An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  4. High 7.5

    CVE-2022-27378 · MariaDB

    An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.6.8, 10.7.4, 10.8.3 · NVD
  5. High 7.5

    CVE-2022-27377 · MariaDB

    MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  6. High 7.5

    CVE-2022-27376 · MariaDB

    MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  7. High 8.8

    CVE-2022-24842 · MinIO

    MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials. This in turn allows the user to escalate privilege to that of the root user. This vulnerability has been…

    Published 12 Apr 2022 · Fixed in 2022-04-12t06-55-35z · NVD
  8. Critical 9.8

    CVE-2022-28397 · Ghost

    An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional.

    Published 12 Apr 2022 · NVD
  9. Critical 9.8

    CVE-2022-27952 · Payload CMS

    An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.

    Published 12 Apr 2022 · NVD
  10. Critical 9.8

    CVE-2022-27263 · Strapi

    An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.

    Published 12 Apr 2022 · NVD
  11. Critical 9.8

    CVE-2022-27139 · Ghost

    An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploading of SVG files to Ghost does not represent a remote code execution vulnerability. SVGs are not…

    Published 12 Apr 2022 · NVD
  12. High 8.8

    CVE-2022-24812 · Grafana

    Grafana is an open-source platform for monitoring and observability. When fine-grained access control is enabled and a client uses Grafana API Key to make requests, the permissions for that API Key are cached for 30 seconds for the given organization. Because of the way the cache ID is constructed, the consequent requests with any API Key evaluate to the same permissions as the previous…

    Published 12 Apr 2022 · Fixed in 8.4.6 · NVD
  13. Critical 9.8

    CVE-2021-31805 · Apache Struts

    The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

    Published 12 Apr 2022 · NVD
  14. High 7.5

    CVE-2021-32040 · MongoDB

    It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB Server v4.4 versions prior to and including 4.4.28,…

    Published 12 Apr 2022 · Fixed in 4.2.16, 4.4.11, 5.0.4 · NVD
  15. High 7.5

    CVE-2022-24839 · Oracle WebLogic Server

    org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at…

    Published 11 Apr 2022 · NVD
  16. Medium 5.3

    CVE-2022-24804 · Discourse

    Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups. When a group with restricted visibility has been used to set the permissions of a category, the name of the group is leaked to any user that is able to see the category. To workaround the problem, a site administrator can remove groups…

    Published 11 Apr 2022 · Fixed in 2.8.3 · NVD
  17. Medium 4.3

    CVE-2022-1193 · GitLab

    Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain circumstances

    Published 11 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  18. Low 2.4

    CVE-2022-1157 · GitLab

    Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potential sensitive values in invalid URLs to be logged

    Published 11 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  19. High 8.8

    CVE-2021-32162 · Webmin

    A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature.

    Published 11 Apr 2022 · NVD
  20. Medium 6.1

    CVE-2021-32161 · Webmin

    A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.

    Published 11 Apr 2022 · NVD
  21. Medium 6.1

    CVE-2021-32160 · Webmin

    A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature.

    Published 11 Apr 2022 · NVD
  22. High 8.8

    CVE-2021-32159 · Webmin

    A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature.

    Published 11 Apr 2022 · NVD
  23. Medium 6.1

    CVE-2021-32158 · Webmin

    A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature.

    Published 11 Apr 2022 · NVD
  24. Critical 9.6

    CVE-2021-32157 · Webmin

    A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.

    Published 11 Apr 2022 · NVD
  25. High 8.8

    CVE-2021-32156 · Webmin

    A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.

    Published 11 Apr 2022 · NVD
  26. Unrated

    WPV-f53e350e5e88 · WooCommerce

    Vulnerability in WooCommerce

    Published 10 Apr 2022 · Fixed in 5.7.0 · WPVulnerability
  27. High 7.5

    CVE-2022-1219 · Pimcore

    SQL injection in RecyclebinController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data

    Published 8 Apr 2022 · Fixed in 10.3.5 · NVD
  28. Medium 6.5

    CVE-2021-41026 · Fortinet FortiWeb

    A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests.

    Published 6 Apr 2022 · Fixed in 6.3.16, 6.4.2 · NVD
  29. Medium 5.4

    CVE-2020-29013 · Fortinet FortiSandbox

    An improper input validation vulnerability in the sniffer interface of FortiSandbox before 3.2.2 may allow an authenticated attacker to silently halt the sniffer via specifically crafted requests.

    Published 6 Apr 2022 · NVD
  30. Medium 6.1

    CVE-2022-27463 · AVideo

    Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.

    Published 5 Apr 2022 · NVD
  31. Medium 6.1

    CVE-2022-27462 · AVideo

    Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php.

    Published 5 Apr 2022 · NVD
  32. High 7.0

    CVE-2022-26357 · Xen

    race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the housekeeping structures has a race, allowing for VT-d domain IDs to be leaked and flushes to be bypassed.

    Published 5 Apr 2022 · Fixed in 4.12.0, 4.16.0 · NVD
  33. Medium 5.6

    CVE-2022-26356 · Xen

    Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram (was named HVMOP_track_dirty_vram before Xen 4.9) is racy with ongoing log dirty hypercalls. A suitably timed call to XEN_DMOP_track_dirty_vram can enable log dirty while another CPU is still in the process of tearing down the structures related to a…

    Published 5 Apr 2022 · Fixed in 4.12.0, 4.14.0, 4.16.0 · NVD
  34. High 8.8

    CVE-2021-39114 · Confluence

    Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

    Published 5 Apr 2022 · Fixed in 7.4.11, 7.11.6, 7.12.5 · NVD
  35. High 7.5

    CVE-2021-43008 · Adminer

    Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.

    Published 5 Apr 2022 · NVD
  36. High 7.5

    CVE-2022-27649 · Podman

    A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when…

    Published 4 Apr 2022 · Fixed in 4.0.3 · NVD
  37. Medium 5.4

    CVE-2022-1190 · GitLab

    Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  38. Medium 4.3

    CVE-2022-1189 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 that allowed for an unauthorised user to read the the approval rules of a private project.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  39. Medium 5.3

    CVE-2022-1188 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 where a blind SSRF attack through the repository mirroring feature was possible.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  40. Medium 6.5

    CVE-2022-1185 · GitLab

    A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to crash the GitLab web application with a maliciously crafted RDoc file

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  41. Medium 6.1

    CVE-2022-1175 · GitLab

    Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  42. High 7.5

    CVE-2022-1174 · GitLab

    A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to trigger high CPU usage via a special crafted input added in Issues, Merge requests, Milestones, Snippets, Wiki pages, etc.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  43. Critical 9.8

    CVE-2022-1162 · GitLab

    A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  44. Medium 6.5

    CVE-2022-1148 · GitLab

    Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to steal a user's access token on an attacker-controlled private GitLab Pages website and reuse that token on the victim's other private websites

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  45. Medium 5.3

    CVE-2022-1121 · GitLab

    A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to cause unlimited resource consumption.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  46. Medium 6.5

    CVE-2022-1120 · GitLab

    Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  47. Low 2.7

    CVE-2022-1111 · GitLab

    A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 under certain conditions caused imported projects to show an incorrect user in the 'Access Granted' column in the project membership pages

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  48. Medium 4.3

    CVE-2022-1105 · GitLab

    An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  49. Medium 4.3

    CVE-2022-1100 · GitLab

    A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9.2. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  50. Medium 4.3

    CVE-2022-1099 · GitLab

    Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to impact the performance of GitLab

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.