UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
645
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. Critical 9.8

    CVE-2021-44617 · GLPI

    A SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in plugins/ramo/ramoapirest.php/getOutdated.

    Published 28 Mar 2022 · NVD
  2. Medium 6.5

    CVE-2022-26252 · aaPanel

    aaPanel v6.8.21 was discovered to be vulnerable to directory traversal. This vulnerability allows attackers to obtain the root user private SSH key(id_rsa).

    Published 27 Mar 2022 · NVD
  3. Critical 9.8

    CVE-2022-22274 · SonicWall SonicOS

    A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution in the firewall.

    Published 25 Mar 2022 · NVD
  4. Low 3.7

    CVE-2022-24784 · Statamic

    Discoverability of user password hash via REST API

    Published 25 Mar 2022 · Fixed in 3.2.39, 3.3.2 · NVD, Project advisories (GitHub)
  5. High 8.8

    CVE-2022-0983 · Moodle

    An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.

    Published 25 Mar 2022 · Fixed in 3.9.13, 3.10.10, 3.11.6 · NVD
  6. High 7.5

    CVE-2021-3422 · Splunk Enterprise

    The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS…

    Published 25 Mar 2022 · Fixed in 7.3.9, 8.0.9, 8.1.3 · NVD
  7. Critical 10.0

    CVE-2022-24783 · Deno

    Sandbox bypass leading to arbitrary code execution

    Published 25 Mar 2022 · Fixed in 1.20.3 · NVD, Project advisories (GitHub)
  8. High 7.5

    CVE-2021-43091 · YesWiki

    An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form.

    Published 25 Mar 2022 · NVD
  9. High 7.5

    CVE-2018-25032 · MariaDB, Python

    zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

    Published 25 Mar 2022 · Fixed in 10.7.5, 10.8.4, 10.9.2 · NVD
  10. Medium 4.3

    CVE-2022-24782 · Discourse

    Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch, and 2.9.0.beta3 and prior in the `tests-passed` branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to category settings, they may have category membership for a secure category. The name of this secure…

    Published 24 Mar 2022 · NVD
  11. Medium 6.1

    CVE-2022-1058 · Gitea

    Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.

    Published 24 Mar 2022 · Fixed in 1.16.5 · NVD
  12. Medium 5.9

    CVE-2022-24769 · runc, Docker Engine, containerd

    Default inheritable capabilities for linux container should be empty

    Published 24 Mar 2022 · Fixed in 1.1.2, 20.10.14 · NVD, Project advisories (GitHub)
  13. High 8.8

    CVE-2022-24768 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. Versions starting with 0.8.0 and 0.5.0 contain limited versions of this issue. To perform exploits, an authorized Argo CD user must have…

    Published 23 Mar 2022 · Fixed in 2.1.14, 2.2.8, 2.3.2 · NVD
  14. Medium 4.9

    CVE-2022-24731 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can…

    Published 23 Mar 2022 · Fixed in 2.1.11, 2.2.6 · NVD
  15. Medium 6.5

    CVE-2022-24730 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been granted…

    Published 23 Mar 2022 · Fixed in 2.1.11, 2.2.6 · NVD
  16. Medium 5.5

    CVE-2021-4219 · ImageMagick

    A flaw was found in ImageMagick. The vulnerability occurs due to improper use of open functions and leads to a denial of service. This flaw allows an attacker to crash the system.

    Published 23 Mar 2022 · Fixed in 6.9.12-9, 7.1.0-19 · NVD
  17. High 7.4

    CVE-2021-3618 · nginx, vsftpd

    ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS…

    Published 23 Mar 2022 · Fixed in 1.21.0, 3.0.4 · NVD
  18. High 8.1

    CVE-2021-44759 · Apache Traffic Server

    Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the middle attack. This issue affects Apache Traffic Server 8.0.0 to 8.1.0.

    Published 23 Mar 2022 · NVD
  19. High 7.5

    CVE-2021-44040 · Apache Traffic Server

    Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.

    Published 23 Mar 2022 · NVD
  20. Medium 6.8

    CVE-2021-25220 · BIND 9

    BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made…

    Published 23 Mar 2022 · Fixed in 9.11.37, 9.16.27 · NVD
  21. High 7.5

    CVE-2022-0635 · BIND 9

    Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a failed assertion check.

    Published 23 Mar 2022 · NVD
  22. Medium 5.3

    CVE-2022-0396 · BIND 9

    BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection.

    Published 23 Mar 2022 · Fixed in 9.16.27 · NVD
  23. High 7.5

    CVE-2022-0667 · BIND 9

    When the vulnerability is triggered the BIND process will exit. BIND 9.18.0

    Published 22 Mar 2022 · NVD
  24. Medium 5.4

    CVE-2022-0765 · Loco Translate (WordPress plugin)

    Loco Translate: Cross-site Scripting

    Published 22 Mar 2022 · Fixed in 2.6.1 · WPVulnerability
  25. Critical 9.8

    CVE-2022-26148 · Grafana

    An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.

    Published 21 Mar 2022 · NVD
  26. High 7.5

    CVE-2022-24775 · Drupal

    guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.

    Published 21 Mar 2022 · Fixed in 9.2.16, 9.3.9 · NVD
  27. High 8.8

    CVE-2022-0415 · Gogs

    Remote command execution in file uploading

    Published 21 Mar 2022 · Fixed in 0.12.6 · NVD, Project advisories (GitHub)
  28. Critical 9.8

    CVE-2022-26265 · Contao

    Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.

    Published 18 Mar 2022 · NVD
  29. Medium 4.9

    CVE-2022-1003 · Mattermost

    One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capabilities in a way that allows them to override certain restricted configurations like EnableUploads.

    Published 18 Mar 2022 · Fixed in 6.4.0 · NVD
  30. Medium 5.4

    CVE-2022-1002 · Mattermost

    Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with special permissions to invite guest users to inject unescaped HTML content in the email invitations.

    Published 18 Mar 2022 · Fixed in 6.4.0 · NVD
  31. Critical 9.8

    CVE-2022-0547 · OpenVPN

    OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.

    Published 18 Mar 2022 · Fixed in 2.4.12, 2.5.6 · NVD
  32. Medium 4.3

    CVE-2021-43961 · Sonatype Nexus Repository

    Sonatype Nexus Repository Manager 3.36.0 allows HTML Injection.

    Published 17 Mar 2022 · Fixed in 3.38.0 · NVD
  33. High 8.8

    CVE-2022-26504 · Veeam Backup & Replication

    Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe

    Published 17 Mar 2022 · Fixed in 10.0.1.4854, 11.0.1.1261 · NVD
  34. Critical 9.8Actively exploited

    CVE-2022-26501 · Veeam Backup & Replication

    Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).

    Published 17 Mar 2022 · Fixed in 10.0.1.4854, 11.0.1.1261 · NVD
  35. High 8.8Actively exploited

    CVE-2022-26500 · Veeam Backup & Replication

    Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.

    Published 17 Mar 2022 · Fixed in 10.0.1.4854, 11.0.1.1261 · NVD
  36. High 7.5

    CVE-2022-24729 · Drupal

    CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

    Published 16 Mar 2022 · Fixed in 9.2.15, 9.3.8 · NVD
  37. Medium 5.4

    CVE-2022-24728 · Drupal

    CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version…

    Published 16 Mar 2022 · Fixed in 9.2.15, 9.3.8 · NVD
  38. Medium 6.5

    CVE-2022-0959 · pgAdmin

    A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write.

    Published 16 Mar 2022 · Fixed in 6.7 · NVD
  39. High 8.1

    CVE-2021-41987 · MikroTik RouterOS

    In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code execution. The attacker must know the scep_server_name value. This affects RouterOS 6.46.8, 6.47.9, and 6.47.10.

    Published 16 Mar 2022 · NVD
  40. High 8.8

    CVE-2020-25721 · Samba

    Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets.

    Published 16 Mar 2022 · Fixed in 4.13.14, 4.14.10, 4.15.2 · NVD
  41. Medium 6.1

    CVE-2022-0986 · Hestia Control Panel

    Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.

    Published 16 Mar 2022 · Fixed in 1.5.11 · NVD
  42. Medium 5.4

    CVE-2022-0705 · Pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

    Published 16 Mar 2022 · NVD
  43. Medium 5.4

    CVE-2022-0704 · Pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

    Published 16 Mar 2022 · NVD
  44. Medium 5.4

    CVE-2022-0911 · Pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

    Published 16 Mar 2022 · NVD
  45. Medium 5.3

    CVE-2021-29134 · Gitea

    The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.

    Published 15 Mar 2022 · Fixed in 1.13.6 · NVD
  46. Medium 5.4

    CVE-2022-0970 · Grav

    Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.

    Published 15 Mar 2022 · Fixed in 1.7.31 · NVD
  47. High 7.5

    CVE-2022-0778 · MariaDB, Node.js, OpenSSL

    The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a…

    Published 15 Mar 2022 · Fixed in 14.19.1, 16.14.2, 17.7.2 · NVD
  48. Medium 5.4

    CVE-2022-0894 · Pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

    Published 15 Mar 2022 · NVD
  49. Medium 5.4

    CVE-2022-0893 · Pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

    Published 15 Mar 2022 · NVD
  50. High 8.8

    CVE-2021-43305 · ClickHouse

    Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits. This issue is very similar to CVE-2021-43304, but the vulnerable copy operation is in a…

    Published 14 Mar 2022 · Fixed in 21.10.2.15 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.