UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
645
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. Low 3.5

    CVE-2022-24744 · Shopware

    User session is not logged out if the password is reset via password recovery

    Published 9 Mar 2022 · Fixed in 6.4.8.1 · NVD, Project advisories (GitHub)
  2. Medium 6.5

    CVE-2022-24745 · Shopware

    Guest session is shared between customers

    Published 9 Mar 2022 · Fixed in 6.4.8.2 · NVD, Project advisories (GitHub)
  3. Medium 4.3

    CVE-2021-41241 · Nextcloud

    Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the groupfolder but not specific subfolders. Due to a lacking permission check in affected versions, a user…

    Published 8 Mar 2022 · Fixed in 20.0.14, 21.0.6 · NVD
  4. Medium 5.3

    CVE-2021-41239 · Nextcloud

    Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no…

    Published 8 Mar 2022 · Fixed in 20.0.14, 21.0.6 · NVD
  5. High 7.2

    CVE-2021-43944 · Jira

    This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. The affected…

    Published 8 Mar 2022 · Fixed in 8.13.15, 8.20.3 · NVD
  6. High 8.8

    CVE-2022-0770 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Cross-Site Request Forgery (CSRF)

    Published 7 Mar 2022 · Fixed in 2.9.9 · WPVulnerability
  7. High 7.5

    CVE-2021-3737 · Python

    A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

    Published 4 Mar 2022 · Fixed in 3.7.11, 3.8.11, 3.9.6 · NVD
  8. Critical 9.8Actively exploited

    CVE-2022-26318 · WatchGuard Fireware OS

    On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

    Published 4 Mar 2022 · Fixed in 12.1.3, 12.5.9, 12.7.2 · NVD
  9. High 8.1

    CVE-2021-23214 · PostgreSQL

    When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

    Published 4 Mar 2022 · Fixed in 11.14, 12.9, 13.5 · NVD
  10. Medium 5.4

    CVE-2022-0832 · Pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.

    Published 4 Mar 2022 · Fixed in 10.3.3 · NVD
  11. Medium 5.4

    CVE-2022-0831 · Pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.

    Published 4 Mar 2022 · Fixed in 10.3.3 · NVD
  12. Medium 6.1

    CVE-2022-0752 · Hestia Control Panel

    Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9.

    Published 4 Mar 2022 · Fixed in 1.5.9 · NVD
  13. Medium 6.1

    CVE-2022-0838 · Hestia Control Panel

    Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10.

    Published 4 Mar 2022 · Fixed in 1.5.10 · NVD
  14. Medium 6.3

    CVE-2022-4974 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Missing Authorization

    Published 4 Mar 2022 · Fixed in 1.14.3 · WPVulnerability
  15. Medium 6.1

    CVE-2022-23710 · Kibana

    A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim’s browser.

    Published 3 Mar 2022 · NVD
  16. Medium 4.3

    CVE-2022-23709 · Kibana

    A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite existing ones. However, any new or modified rules would not be enabled, and a user with this privilege could not modify alerting connectors. This effectively means that Read users could disable…

    Published 3 Mar 2022 · Fixed in 7.17.1 · NVD
  17. Medium 4.3

    CVE-2022-23708 · Elasticsearch

    A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.

    Published 3 Mar 2022 · Fixed in 7.17.1 · NVD
  18. Medium 6.1

    CVE-2022-0753 · Hestia Control Panel

    Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9.

    Published 3 Mar 2022 · Fixed in 1.5.9 · NVD
  19. Medium 5.3

    CVE-2022-25146 · Liferay Portal / DXP

    The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.

    Published 3 Mar 2022 · Fixed in 7.4.3.9 · NVD
  20. Medium 5.4

    CVE-2021-38269 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 before fix pack 13, and 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the output of a Gogo Shell command.

    Published 3 Mar 2022 · NVD
  21. Medium 5.4

    CVE-2021-38267 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_portlet_BlogsAdminPortlet_title and _com_liferay_blogs_web_portlet_BlogsAdminPortlet_subtitle parameter.

    Published 3 Mar 2022 · Fixed in 7.3 · NVD
  22. Medium 5.4

    CVE-2021-38265 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.

    Published 3 Mar 2022 · NVD
  23. Medium 6.1

    CVE-2021-38264 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter. This issue is caused by an incomplete fix in CVE-2021-35463.

    Published 3 Mar 2022 · NVD
  24. Medium 6.1

    CVE-2021-38263 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20 and 7.2 before fix pack 10 allows remote attackers to inject arbitrary web script or HTML via the output of a script.

    Published 3 Mar 2022 · NVD
  25. High 8.8

    CVE-2021-3738 · Samba

    In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared, the user credentials state was only pointed at, and when one connection within that association group ended, the database would be…

    Published 2 Mar 2022 · Fixed in 4.13.14, 4.14.10, 4.15.2 · NVD
  26. Medium 6.5

    CVE-2021-3677 · PostgreSQL

    A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the…

    Published 2 Mar 2022 · Fixed in 11.13, 12.8, 13.4 · NVD
  27. High 7.5

    CVE-2021-38266 · Liferay Portal / DXP

    The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.

    Published 2 Mar 2022 · NVD
  28. Medium 5.9

    CVE-2021-23222 · PostgreSQL

    A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

    Published 2 Mar 2022 · Fixed in 11.14, 12.9, 13.5 · NVD
  29. High 7.5

    CVE-2021-23192 · Samba

    A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements.

    Published 2 Mar 2022 · Fixed in 4.13.14, 4.14.10, 4.15.2 · NVD
  30. High 7.5

    CVE-2022-0711 · HAProxy

    A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

    Published 2 Mar 2022 · Fixed in 2.2.21, 2.3.18, 2.4.13 · NVD
  31. Low 2.7

    CVE-2021-46270 · JFrog Artifactory

    JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all available repository names due to insufficient permission validation.

    Published 2 Mar 2022 · Fixed in 7.31.10 · NVD
  32. Medium 5.4

    CVE-2021-45074 · JFrog Artifactory

    JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a reauthentication on an active session or in the next UI session.

    Published 2 Mar 2022 · Fixed in 6.23.38, 7.29.3 · NVD
  33. Medium 6.5

    CVE-2021-38268 · Liferay Portal / DXP

    The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.

    Published 2 Mar 2022 · Fixed in 7.2.1, 7.3.7 · NVD
  34. High 7.5

    CVE-2022-23648 · containerd

    containerd CRI plugin: Insecure handling of image volumes

    Published 2 Mar 2022 · Fixed in 1.4.13, 1.5.10, 1.6.1 · NVD, Project advisories (GitHub)
  35. High 8.8

    CVE-2022-0819 · Dolibarr ERP CRM

    Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1.

    Published 2 Mar 2022 · Fixed in 15.0.1 · NVD
  36. High 8.1

    CVE-2022-0829 · Webmin

    Improper Authorization in GitHub repository webmin/webmin prior to 1.990.

    Published 2 Mar 2022 · Fixed in 1.990 · NVD
  37. High 8.8

    CVE-2022-0824 · Webmin

    Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.

    Published 2 Mar 2022 · Fixed in 1.990 · NVD
  38. Medium 4.5

    CVE-2020-15936 · Fortinet FortiOS

    A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 and below allows attacker to disclose sensitive information via SNI Client Hello TLS packets.

    Published 1 Mar 2022 · NVD
  39. Critical 9.1

    CVE-2022-25769 · Mautic

    Improper regex in htaccess file

    Published 28 Feb 2022 · Fixed in 3.3.5, 4.2.0 · NVD, Project advisories (GitHub)
  40. Medium 4.6

    CVE-2022-0743 · Grav

    Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.

    Published 28 Feb 2022 · Fixed in 1.7.31 · NVD
  41. High 7.5

    CVE-2020-22845 · MikroTik RouterOS

    A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted FTP requests.

    Published 28 Feb 2022 · NVD
  42. High 7.5

    CVE-2020-22844 · MikroTik RouterOS

    A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted SMB requests.

    Published 28 Feb 2022 · NVD
  43. Medium 4.8

    CVE-2021-43945 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScript via a Stored Cross-Site Scripting (SXSS) vulnerability in the /rest/jpo/1.0/hierarchyConfiguration endpoint. The affected versions are before version 8.20.3.

    Published 28 Feb 2022 · Fixed in 8.20.3 · NVD
  44. Unrated

    WPV-346aa6f53cbb · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Vulnerability in Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing

    Published 28 Feb 2022 · Fixed in 1.14.3 · WPVulnerability
  45. Unrated

    WPV-111e8cf7f970 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Vulnerability in Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing

    Published 28 Feb 2022 · Fixed in 1.14.3 · WPVulnerability
  46. Critical 9.8

    CVE-2021-21708 · PHP

    In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT…

    Published 27 Feb 2022 · Fixed in 7.4.28, 8.0.16, 8.1.3 · NVD
  47. Medium 6.7

    CVE-2022-0764 · Strapi

    Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.

    Published 26 Feb 2022 · Fixed in 4.1.0 · NVD
  48. High 7.5

    CVE-2022-23308 · libxml2

    valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

    Published 26 Feb 2022 · Fixed in 2.9.13 · NVD
  49. High 7.5

    CVE-2022-25264 · TeamCity

    In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases.

    Published 25 Feb 2022 · Fixed in 2021.2.3 · NVD
  50. Critical 9.8

    CVE-2022-25263 · TeamCity

    JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration.

    Published 25 Feb 2022 · Fixed in 2021.2.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.