Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,067
- Published in 7 days
- 645
- Critical in 30 days
- 382
- Actively exploited
- 421
Latest vulnerabilities
39,067 vulnerabilities- High 8.8
CVE-2021-43304 · ClickHouse
Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy<copy_amount>(op, ip, copy_end), don’t exceed the destination buffer’s limits.
Published 14 Mar 2022 · Fixed in 21.10.2.15 · NVD - Medium 6.5
CVE-2021-42391 · ClickHouse
Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.
Published 14 Mar 2022 · Fixed in 21.10.2.15 · NVD - Medium 6.5
CVE-2021-42390 · ClickHouse
Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.
Published 14 Mar 2022 · Fixed in 21.10.2.15 · NVD - Medium 6.5
CVE-2021-42389 · ClickHouse
Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.
Published 14 Mar 2022 · Fixed in 21.10.2.15 · NVD - High 8.1
CVE-2021-42388 · ClickHouse
Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation.
Published 14 Mar 2022 · Fixed in 21.10.2.15 · NVD - High 8.1
CVE-2021-42387 · ClickHouse
Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the upper bounds of the source of the copy operation.
Published 14 Mar 2022 · Fixed in 21.10.2.15 · NVD - Medium 6.1
CVE-2022-24749 · Sylius
Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. The issue…
Published 14 Mar 2022 · Fixed in 1.9.10, 1.10.11, 1.11.2 · NVD - High 8.2
CVE-2022-24743 · Sylius
Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue is fixed in versions 1.10.11 and 1.11.2. As a workaround, overwrite the…
Published 14 Mar 2022 · Fixed in 1.10.11, 1.11.2 · NVD - Medium 5.5
CVE-2022-24742 · Sylius
Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect to login page even browser back button is pressed. Another possibility is to set more strict cache…
Published 14 Mar 2022 · Fixed in 1.9.10, 1.10.11, 1.11.2 · NVD - Medium 6.1
CVE-2022-24733 · Sylius
Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. The issue is fixed in versions 1.9.10, 1.10.11,…
Published 14 Mar 2022 · Fixed in 1.9.10, 1.10.11, 1.11.2 · NVD - Critical 9.8
CVE-2022-23943 · Apache HTTP Server
Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.
Published 14 Mar 2022 · Fixed in 2.4.53 · NVD - Critical 9.1
CVE-2022-22721 · Apache HTTP Server
If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.
Published 14 Mar 2022 · NVD - Critical 9.8
CVE-2022-22720 · Apache HTTP Server
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
Published 14 Mar 2022 · NVD - High 7.5
CVE-2022-22719 · Apache HTTP Server
A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
Published 14 Mar 2022 · NVD - Low 3.7
CVE-2021-36368 · OpenSSH
An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to…
Published 13 Mar 2022 · Fixed in 8.9 · NVD - Critical 10.0
CVE-2022-24760 · Parse Server
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any…
Published 12 Mar 2022 · Fixed in 4.10.7 · NVD - Medium 6.1
CVE-2021-32478 · Moodle
The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.
Published 11 Mar 2022 · Fixed in 3.8.9, 3.9.7, 3.10.4 · NVD - Medium 4.3
CVE-2021-32477 · Moodle
The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default). Moodle versions 3.10 to 3.10.3 are affected.
Published 11 Mar 2022 · Fixed in 3.10.4 · NVD - High 7.5
CVE-2021-32476 · Moodle
A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
Published 11 Mar 2022 · Fixed in 3.8.9, 3.9.7, 3.10.4 · NVD - Medium 5.4
CVE-2021-32475 · Moodle
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
Published 11 Mar 2022 · Fixed in 3.8.9, 3.9.7, 3.10.4 · NVD - High 7.2
CVE-2021-32474 · Moodle
An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
Published 11 Mar 2022 · Fixed in 3.8.9, 3.9.7, 3.10.4 · NVD - Medium 5.3
CVE-2021-32473 · Moodle
It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected
Published 11 Mar 2022 · Fixed in 3.8.9, 3.9.7, 3.10.4 · NVD - Medium 4.3
CVE-2021-32472 · Moodle
Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6 and 3.8 to 3.8.8 are affected.
Published 11 Mar 2022 · Fixed in 3.8.9, 3.9.7, 3.10.4 · NVD - Critical 9.1
CVE-2022-0871 · Gogs
Improper PAM authorization handling
Published 11 Mar 2022 · Fixed in 0.12.5 · NVD, Project advisories (GitHub) - Medium 5.3
CVE-2022-0870 · Gogs
SSRF in repository migration
Published 11 Mar 2022 · Fixed in 0.12.5 · NVD, Project advisories (GitHub) - High 7.5
CVE-2020-36518 · Oracle WebLogic Server
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
Published 11 Mar 2022 · NVD - Medium 5.3
CVE-2021-41233 · Nextcloud
Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File Drop". For successful exploitation an attacker requires knowledge of the sharing link. It is recommended that users upgrade their Nextcloud…
Published 10 Mar 2022 · Fixed in 20.0.14, 21.0.6, 22.2.1 · NVD - Medium 5.3
CVE-2022-26847 · SPIP
SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects.
Published 10 Mar 2022 · Fixed in 3.2.14, 4.0.5 · NVD - High 8.8
CVE-2022-26846 · SPIP
SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code.
Published 10 Mar 2022 · Fixed in 3.2.14, 4.0.5 · NVD - High 7.0
CVE-2022-26488 · Python
In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non-administrative user can trigger a repair that incorrectly adds user-writable…
Published 10 Mar 2022 · NVD - Medium 6.5
CVE-2022-25244 · HashiCorp Vault
Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with `read` permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10.
Published 10 Mar 2022 · Fixed in 1.7.10, 1.8.9, 1.9.4 · NVD - Medium 6.5
CVE-2022-25243 · HashiCorp Vault
"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allow_subdomains is set to false. Fixed in Vault Enterprise 1.8.9 and 1.9.4.
Published 10 Mar 2022 · Fixed in 1.8.9, 1.9.4 · NVD - Medium 6.5
CVE-2022-0904 · Mattermost
A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted Apple Pages document.
Published 10 Mar 2022 · Fixed in 6.1.3, 6.2.3, 6.3.3 · NVD - High 7.5
CVE-2022-0903 · Mattermost
A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted POST body.
Published 10 Mar 2022 · Fixed in 6.1.3, 6.2.3, 6.3.3 · NVD - High 7.5
CVE-2022-0813 · phpMyAdmin
PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.
Published 10 Mar 2022 · NVD - Medium 6.5
CVE-2021-3733 · Python
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application…
Published 10 Mar 2022 · Fixed in 3.7.11, 3.8.10, 3.9.5 · NVD - High 7.1
CVE-2022-0905 · Gitea
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4.
Published 10 Mar 2022 · Fixed in 1.16.4 · NVD - Unrated
WPV-2aa264f95467 · WooCommerce
Vulnerability in WooCommerce
Published 10 Mar 2022 · Fixed in 6.3.1 · WPVulnerability - Unrated
WPV-07ccc3b2848a · WooCommerce
Vulnerability in WooCommerce
Published 10 Mar 2022 · Fixed in 6.3.1 · WPVulnerability - Medium 6.1
CVE-2022-0864 · UpdraftPlus
UpdraftPlus: WP Backup & Migration Plugin: Cross-site Scripting
Published 10 Mar 2022 · Fixed in 1.22.9 · NVD, WPVulnerability - Medium 6.5
CVE-2022-24741 · Nextcloud
Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended that the Nextcloud Server is upgraded to 21.0.8 , 22.2.4 or 23.0.1. Users unable to upgrade should disable preview generation with the…
Published 9 Mar 2022 · Fixed in 21.0.8, 22.2.4 · NVD - High 7.2
CVE-2022-24734 · MyBB
ACP Settings management RCE
Published 9 Mar 2022 · Fixed in 1.8.30 · NVD, Project advisories (GitHub) - Medium 4.4
CVE-2022-0022 · Palo Alto Networks PAN-OS
Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal (non-FIPS-CC) operational mode. An attacker must have access to the account password hashes to take advantage of this…
Published 9 Mar 2022 · Fixed in 8.1.21, 9.1.11, 10.0.7 · NVD - Medium 6.3
CVE-2022-24512 · .NET
.NET and Visual Studio Remote Code Execution Vulnerability
Published 9 Mar 2022 · NVD - High 7.5
CVE-2022-24464 · .NET
.NET and Visual Studio Denial of Service Vulnerability
Published 9 Mar 2022 · NVD - Medium 6.5
CVE-2022-24463 · Microsoft Exchange Server
Microsoft Exchange Server Spoofing Vulnerability
Published 9 Mar 2022 · NVD - High 8.8
CVE-2022-23277 · Microsoft Exchange Server
Microsoft Exchange Server Remote Code Execution Vulnerability
Published 9 Mar 2022 · NVD - High 7.5
CVE-2022-24748 · Shopware
Modify Customers, create Orders without App Permission
Published 9 Mar 2022 · Fixed in 6.4.8.2 · NVD, Project advisories (GitHub) - Medium 5.3
CVE-2022-24747 · Shopware
HTTP caching is marking private HTTP headers as public
Published 9 Mar 2022 · Fixed in 6.4.8.2 · NVD, Project advisories (GitHub) - Medium 6.1
CVE-2022-24746 · Shopware
HTML injection possibility in voucher code form
Published 9 Mar 2022 · Fixed in 6.4.8.1 · NVD, Project advisories (GitHub)
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.