UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
645
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. Medium 6.1

    CVE-2022-25261 · TeamCity

    JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS.

    Published 25 Feb 2022 · Fixed in 2021.2.2 · NVD
  2. High 8.8

    CVE-2022-24342 · TeamCity

    In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible.

    Published 25 Feb 2022 · Fixed in 2021.2.1 · NVD
  3. High 7.5

    CVE-2022-24341 · TeamCity

    In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user.

    Published 25 Feb 2022 · Fixed in 2021.2.1 · NVD
  4. Critical 9.8

    CVE-2022-24340 · TeamCity

    In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible.

    Published 25 Feb 2022 · Fixed in 2021.2.1 · NVD
  5. Medium 5.4

    CVE-2022-24339 · TeamCity

    JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS.

    Published 25 Feb 2022 · Fixed in 2021.2.1 · NVD
  6. Medium 6.1

    CVE-2022-24338 · TeamCity

    JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS.

    Published 25 Feb 2022 · Fixed in 2021.2.1 · NVD
  7. Medium 6.5

    CVE-2022-24337 · TeamCity

    In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions.

    Published 25 Feb 2022 · Fixed in 2021.2 · NVD
  8. Medium 5.3

    CVE-2022-24336 · TeamCity

    In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server.

    Published 25 Feb 2022 · Fixed in 2021.2.1 · NVD
  9. High 8.1

    CVE-2022-24335 · TeamCity

    JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC.

    Published 25 Feb 2022 · Fixed in 2021.2.1 · NVD
  10. Medium 5.3

    CVE-2022-24334 · TeamCity

    In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server.

    Published 25 Feb 2022 · Fixed in 2021.2.1 · NVD
  11. Medium 6.5

    CVE-2022-24333 · TeamCity

    In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible.

    Published 25 Feb 2022 · Fixed in 2021.2 · NVD
  12. Medium 5.3

    CVE-2022-24332 · TeamCity

    In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.

    Published 25 Feb 2022 · Fixed in 2021.2 · NVD
  13. Critical 9.8

    CVE-2022-24331 · TeamCity

    In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible.

    Published 25 Feb 2022 · Fixed in 2021.4 · NVD
  14. Medium 6.1

    CVE-2022-24330 · TeamCity

    In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible.

    Published 25 Feb 2022 · Fixed in 2021.2.1 · NVD
  15. High 8.8

    CVE-2022-24288 · Apache Airflow

    In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.

    Published 25 Feb 2022 · Fixed in 2.2.4 · NVD
  16. Medium 4.3

    CVE-2022-0746 · Dolibarr ERP CRM

    Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.

    Published 25 Feb 2022 · Fixed in 16.0.0 · NVD
  17. Medium 6.1

    CVE-2021-45229 · Apache Airflow

    It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.

    Published 25 Feb 2022 · NVD
  18. High 8.2

    CVE-2022-21824 · Node.js, MySQL

    Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys…

    Published 24 Feb 2022 · Fixed in 14.18.3, 16.13.2, 17.3.1 · NVD
  19. Medium 5.3

    CVE-2021-44533 · Node.js, MySQL

    Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject…

    Published 24 Feb 2022 · Fixed in 14.18.3, 16.13.2, 17.3.1 · NVD
  20. Medium 5.3

    CVE-2021-44532 · Node.js, MySQL

    Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js…

    Published 24 Feb 2022 · Fixed in 14.18.3, 16.13.2, 17.3.1 · NVD
  21. High 7.4

    CVE-2021-44531 · Node.js, MySQL

    Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI…

    Published 24 Feb 2022 · Fixed in 14.18.3, 16.13.2, 17.3.1 · NVD
  22. High 7.5

    CVE-2021-3610 · ImageMagick

    A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This issue is due to an incorrect setting of the pixel array size, which can lead to a crash and segmentation fault.

    Published 24 Feb 2022 · Fixed in 6.9.12-14, 7.0.11-14 · NVD
  23. Medium 6.5

    CVE-2021-3596 · ImageMagick

    A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt() and uses the value directly, which leads to a crash and segmentation fault.

    Published 24 Feb 2022 · Fixed in 7.0.10-31 · NVD
  24. Medium 5.4

    CVE-2021-39038 · IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID:…

    Published 24 Feb 2022 · Fixed in 9.0.5.12 · NVD
  25. Medium 6.5

    CVE-2022-25363 · WatchGuard Fireware OS

    WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to modify privileged management user credentials. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

    Published 24 Feb 2022 · Fixed in 12.1.3, 12.5.9, 12.7.2 · NVD
  26. High 8.8

    CVE-2022-25360 · WatchGuard Fireware OS

    WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary locations. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

    Published 24 Feb 2022 · Fixed in 12.1.3, 12.5.9, 12.7.2 · NVD
  27. High 8.8

    CVE-2022-25293 · WatchGuard Fireware OS

    A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

    Published 24 Feb 2022 · Fixed in 12.1.3, 12.5.9, 12.7.2 · NVD
  28. High 8.8

    CVE-2022-25292 · WatchGuard Fireware OS

    A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

    Published 24 Feb 2022 · Fixed in 12.1.3, 12.5.9, 12.7.2 · NVD
  29. High 8.8

    CVE-2022-25291 · WatchGuard Fireware OS

    An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow and potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

    Published 24 Feb 2022 · Fixed in 12.1.3, 12.5.9, 12.7.2 · NVD
  30. Medium 6.5

    CVE-2022-25290 · WatchGuard Fireware OS

    WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private keys. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

    Published 24 Feb 2022 · Fixed in 12.1.3, 12.5.9, 12.7.2 · NVD
  31. High 8.8Actively exploited

    CVE-2022-23176 · WatchGuard Fireware OS

    WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.

    Published 24 Feb 2022 · Fixed in 12.1.3, 12.5.7 · NVD
  32. High 8.8

    CVE-2021-44967 · LimeSurvey

    A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. NOTE: the Supplier's position is that plugins intentionally can contain arbitrary PHP code, and can only be installed by a superadmin, and therefore the security model is not violated by this finding.

    Published 24 Feb 2022 · NVD
  33. Medium 6.1

    CVE-2021-26092 · Fortinet FortiProxy, Fortinet FortiOS

    Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to perform a reflected Cross-site Scripting (XSS) attack by sending a request to the error page with…

    Published 24 Feb 2022 · NVD
  34. Medium 6.5

    CVE-2022-0731 · Dolibarr ERP CRM

    Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.

    Published 23 Feb 2022 · Fixed in 16.0.0 · NVD
  35. High 7.5

    CVE-2022-0736 · MLflow

    Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.

    Published 23 Feb 2022 · Fixed in 1.23.1 · NVD
  36. Medium 5.3

    CVE-2022-23655 · October CMS

    Compromised gateway causes data breach

    Published 23 Feb 2022 · Fixed in 1.0.475, 1.1.11 · NVD, Project advisories (GitHub)
  37. High 7.2

    CVE-2022-21705 · October CMS

    Authenticated remote code execution

    Published 23 Feb 2022 · Fixed in 1.0.474, 1.1.10, 2.1.27 · NVD, Project advisories (GitHub)
  38. Unrated

    WPV-b00d0b4a6105 · WooCommerce

    Vulnerability in WooCommerce

    Published 23 Feb 2022 · Fixed in 6.2.1 · WPVulnerability
  39. Unrated

    WPV-0159e64c8823 · WooCommerce

    Vulnerability in WooCommerce

    Published 23 Feb 2022 · Fixed in 6.2.1 · WPVulnerability
  40. Medium 6.5

    CVE-2022-23606 · Envoy

    Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a…

    Published 22 Feb 2022 · Fixed in 1.20.2 · NVD
  41. Medium 6.5

    CVE-2022-21657 · Envoy

    Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail…

    Published 22 Feb 2022 · Fixed in 1.18.6, 1.19.3, 1.20.2 · NVD
  42. Medium 5.9

    CVE-2022-21656 · Envoy

    Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default certificate validation routines has a "type confusion" bug when processing subjectAltNames. This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name. This confusion allows for the…

    Published 22 Feb 2022 · Fixed in 1.20.2 · NVD
  43. High 7.5

    CVE-2022-21655 · Envoy

    Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener.

    Published 22 Feb 2022 · Fixed in 1.19.3, 1.20.2, 1.21.1 · NVD
  44. Critical 9.8

    CVE-2022-21654 · Envoy

    Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.

    Published 22 Feb 2022 · Fixed in 1.19.3, 1.20.2, 1.21.1 · NVD
  45. High 7.5

    CVE-2021-43826 · Envoy

    Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling <envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_config>` and the downstream connection disconnects while the the upstream connection or http/2 stream is still being established. There are…

    Published 22 Feb 2022 · Fixed in 1.19.3, 1.20.2, 1.21.1 · NVD
  46. High 7.5

    CVE-2021-43825 · Envoy

    Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response data. Envoy tracks the amount of buffered request and response data and aborts the request if the amount of buffered data is over the limit by sending 413 or 500 responses. However when the buffer overflows while response…

    Published 22 Feb 2022 · Fixed in 1.19.3, 1.20.2, 1.21.1 · NVD
  47. High 7.5

    CVE-2021-43824 · Envoy

    Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade.

    Published 22 Feb 2022 · Fixed in 1.19.3, 1.20.2, 1.21.1 · NVD
  48. Medium 6.5

    CVE-2022-0665 · Pimcore

    Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2.

    Published 22 Feb 2022 · Fixed in 10.3.2 · NVD
  49. Unrated

    WPV-9cb7c43c7529 · WooCommerce

    Vulnerability in WooCommerce

    Published 22 Feb 2022 · Fixed in 6.2.1 · WPVulnerability
  50. Medium 4.3

    CVE-2022-0775 · WooCommerce

    WooCommerce: Incorrect Authorization

    Published 22 Feb 2022 · Fixed in 6.2.1 · NVD, WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.