UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
645
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. Medium 4.3

    CVE-2022-0740 · GitLab

    Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting from version 7.8.0 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 makes it possible to close Asana tasks from unrestricted branches.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  2. Critical 9.8

    CVE-2022-26969 · Directus

    Insecure default value for CORS configuration

    Published 4 Apr 2022 · Fixed in 9.6.1, 9.7.0 · NVD, Project advisories (GitHub)
  3. High

    CVE-2022-24814 · Directus

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus

    Published 4 Apr 2022 · Fixed in 9.6.1 · Project advisories (GitHub)
  4. High 8.8

    CVE-2021-36776 · Rancher

    A Improper Access Control vulnerability in SUSE Rancher allows remote attackers impersonate arbitrary users. This issue affects: SUSE Rancher Rancher versions prior to 2.5.10.

    Published 4 Apr 2022 · Fixed in 2.5.10 · NVD
  5. High 8.8

    CVE-2021-36775 · Rancher

    a Improper Access Control vulnerability in SUSE Rancher allows users to keep privileges that should have been revoked. This issue affects: SUSE Rancher Rancher versions prior to 2.4.18; Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3.

    Published 4 Apr 2022 · Fixed in 2.4.18, 2.5.12, 2.6.3 · NVD
  6. Medium 6.1

    CVE-2022-28378 · Craft CMS

    Craft CMS before 3.7.29 allows XSS.

    Published 3 Apr 2022 · Fixed in 3.7.29 · NVD
  7. Critical 9.8Actively exploited

    CVE-2022-22965 · Oracle WebLogic Server

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there…

    Published 1 Apr 2022 · NVD
  8. High 7.5

    CVE-2022-0741 · GitLab

    Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables via specially crafted email addresses.

    Published 1 Apr 2022 · Fixed in 14.6.5, 14.7.4, 14.8.2 · NVD
  9. Medium 5.7

    CVE-2022-0489 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a DOS by using the math feature with a specific formula in issue comments.

    Published 1 Apr 2022 · Fixed in 14.6.5, 14.8.2 · NVD
  10. High 7.6

    CVE-2022-0425 · GitLab

    A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery (SSRF) attacks.

    Published 1 Apr 2022 · NVD
  11. Medium 4.3

    CVE-2022-0390 · GitLab

    Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retrieve issue details when it was linked to an item from the vulnerability dashboard.

    Published 1 Apr 2022 · NVD
  12. Medium 4.3

    CVE-2022-0373 · GitLab

    Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk email address

    Published 1 Apr 2022 · Fixed in 14.7.1 · NVD
  13. High 7.5

    CVE-2021-39908 · GitLab

    In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 certain Unicode characters can be abused to commit malicious code into projects without being noticed in merge request or source code viewer UI.

    Published 1 Apr 2022 · Fixed in 14.2.6, 14.3.4 · NVD
  14. Medium

    GHSA-hwm2-4ph6-w6m5 · Rancher

    Restricted PodSecurityPolicy does not prevent containers from running as a privileged user

    Published 31 Mar 2022 · Fixed in 2.6.4 · Project advisories (GitHub)
  15. High 7.5

    CVE-2021-37517 · Dolibarr ERP CRM

    An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the application allows email addresses as usernames, which can cause a Denial of Service.

    Published 31 Mar 2022 · NVD
  16. High 8.8

    CVE-2021-36625 · Dolibarr ERP CRM

    An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statement.

    Published 31 Mar 2022 · NVD
  17. High 8.8

    CVE-2022-26019 · pfSense

    Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result in arbitrary command execution.

    Published 31 Mar 2022 · Fixed in 2.6.0 · NVD
  18. High 8.8

    CVE-2022-24299 · pfSense

    Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command.

    Published 31 Mar 2022 · Fixed in 2.6.0 · NVD
  19. Medium 4.3

    CVE-2022-27907 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF.

    Published 30 Mar 2022 · Fixed in 3.38.0 · NVD
  20. Medium 6.1

    CVE-2022-23801 · Joomla!

    An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media.

    Published 30 Mar 2022 · NVD
  21. Medium 6.1

    CVE-2022-23800 · Joomla!

    An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components.

    Published 30 Mar 2022 · NVD
  22. Critical 9.8

    CVE-2022-23799 · Joomla!

    An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data.

    Published 30 Mar 2022 · NVD
  23. Medium 6.1

    CVE-2022-23798 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.

    Published 30 Mar 2022 · NVD
  24. Critical 9.8

    CVE-2022-23797 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection.

    Published 30 Mar 2022 · NVD
  25. Medium 6.1

    CVE-2022-23796 · Joomla!

    An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using com_fields.

    Published 30 Mar 2022 · NVD
  26. Critical 9.8

    CVE-2022-23795 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.

    Published 30 Mar 2022 · NVD
  27. Medium 5.3

    CVE-2022-23794 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application.

    Published 30 Mar 2022 · NVD
  28. High 7.5

    CVE-2022-23793 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path.

    Published 30 Mar 2022 · NVD
  29. High 7.4

    CVE-2022-1155 · Snipe-IT

    Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.

    Published 30 Mar 2022 · Fixed in 5.3.10 · NVD
  30. Critical 9.8

    CVE-2022-28209 · MediaWiki

    An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof extension is incorrect.

    Published 30 Mar 2022 · NVD
  31. Critical 9.8

    CVE-2022-28206 · MediaWiki

    An issue was discovered in MediaWiki through 1.37.1. ImportPlanValidator.php in the FileImporter extension mishandles the check for edit rights.

    Published 30 Mar 2022 · NVD
  32. Critical 9.8

    CVE-2022-28205 · MediaWiki

    An issue was discovered in MediaWiki through 1.37.1. The CentralAuth extension mishandles a ttl issue for groups expiring in the future.

    Published 30 Mar 2022 · NVD
  33. Medium 6.1

    CVE-2022-28202 · MediaWiki

    An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.

    Published 30 Mar 2022 · Fixed in 1.35.6, 1.36.4, 1.37.2 · NVD
  34. Medium 6.5

    CVE-2022-23183 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Missing Authorization

    Published 30 Mar 2022 · Fixed in 5.12.1 · NVD, WPVulnerability
  35. Medium 6.5Actively exploited

    CVE-2022-22948 · VMware vCenter Server

    The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.

    Published 29 Mar 2022 · NVD
  36. High 8.8

    CVE-2022-0751 · GitLab

    Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with misleading content which could trick unsuspecting users into executing arbitrary commands

    Published 28 Mar 2022 · Fixed in 14.6.5, 14.7.4, 14.8.2 · NVD
  37. High 7.5

    CVE-2022-0738 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. GitLab was leaking user passwords when adding mirrors with SSH credentials under specific conditions.

    Published 28 Mar 2022 · Fixed in 14.6.5, 14.7.4, 14.8.2 · NVD
  38. Critical 9.8

    CVE-2022-0735 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An unauthorised user was able to steal runner registration tokens through an information disclosure vulnerability using quick actions commands.

    Published 28 Mar 2022 · Fixed in 14.6.5, 14.7.4, 14.8.2 · NVD
  39. Medium 6.5

    CVE-2022-0549 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under certain conditions, GitLab REST API may allow unprivileged users to add other users to groups even if that is not possible to do through the Web UI.

    Published 28 Mar 2022 · Fixed in 14.6.5, 14.7.4, 14.8.2 · NVD
  40. Medium 4.3

    CVE-2022-0488 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. It was possible to trigger a timeout on a page with markdown by using a specific amount of block-quotes.

    Published 28 Mar 2022 · NVD
  41. High 8.8

    CVE-2022-0427 · GitLab

    Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover

    Published 28 Mar 2022 · Fixed in 14.5.4, 14.6.4, 14.7.1 · NVD
  42. Medium 4.3

    CVE-2022-0371 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 before 14.6.4, all versions starting from 14.7 before 14.7.1. GitLab search may allow authenticated users to search other users by their respective private emails even if a user set their email to private.

    Published 28 Mar 2022 · Fixed in 14.5.4, 14.6.4, 14.7.1 · NVD
  43. Medium 4.3

    CVE-2022-0344 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a Merge Request and later moved to a public project

    Published 28 Mar 2022 · Fixed in 14.5.4, 14.6.4 · NVD
  44. Medium 6.1

    CVE-2022-0283 · GitLab

    An issue has been discovered affecting GitLab versions prior to 13.5. An open redirect vulnerability was fixed in GitLab integration with Jira that a could cause the web application to redirect the request to the attacker specified URL.

    Published 28 Mar 2022 · Fixed in 14.5.4, 14.6.4 · NVD
  45. Critical 9.1

    CVE-2022-0249 · GitLab

    A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked.

    Published 28 Mar 2022 · NVD
  46. High 8.1

    CVE-2022-0136 · GitLab

    A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature.

    Published 28 Mar 2022 · NVD
  47. Medium 6.8

    CVE-2022-0123 · GitLab

    An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.

    Published 28 Mar 2022 · Fixed in 14.4.5, 14.5.3, 14.6.1 · NVD
  48. Medium 5.3

    CVE-2021-4191 · GitLab

    An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API.

    Published 28 Mar 2022 · Fixed in 14.6.5, 14.7.4, 14.8.2 · NVD
  49. Medium 4.3

    CVE-2021-39876 · GitLab

    In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups.

    Published 28 Mar 2022 · Fixed in 14.1.7, 14.2.5, 14.3.1 · NVD
  50. Critical 9.8

    CVE-2022-25757 · Apache APISIX

    In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the body_schema validation in the request-validation plugin. For example, `{"string_payload":"bad","string_payload":"good"}` can be used to hide the "bad" input. Systems satisfy three conditions below…

    Published 28 Mar 2022 · Fixed in 2.13.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.