UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
645
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. Medium 6.5

    CVE-2022-0708 · Mattermost

    Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure.

    Published 21 Feb 2022 · NVD
  2. Medium 4.3

    CVE-2021-44141 · Samba

    All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.

    Published 21 Feb 2022 · Fixed in 4.15.5 · NVD
  3. High 8.8

    CVE-2021-44142 · Samba

    The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to…

    Published 21 Feb 2022 · Fixed in 4.13.17, 4.14.12, 4.15.5 · NVD
  4. High 8.8

    CVE-2021-45008 · Plesk

    Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users

    Published 21 Feb 2022 · NVD
  5. Medium 6.5

    CVE-2021-45007 · Plesk

    Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user and admin panel. NOTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users

    Published 20 Feb 2022 · NVD
  6. High 7.8

    CVE-2022-25365 · Docker Engine

    Docker Desktop before 4.5.1 on Windows allows attackers to move arbitrary files. NOTE: this issue exists because of an incomplete fix for CVE-2022-23774.

    Published 19 Feb 2022 · Fixed in 4.5.1 · NVD
  7. High 7.5

    CVE-2017-0371 · MediaWiki

    MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.

    Published 18 Feb 2022 · Fixed in 1.23.16, 1.27.2, 1.28.1 · NVD
  8. High 7.8

    CVE-2022-24052 · MariaDB

    MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of…

    Published 18 Feb 2022 · Fixed in 10.5.14, 10.6.6, 10.7.2 · NVD
  9. High 7.8

    CVE-2022-24051 · MariaDB

    MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of a user-supplied string before using…

    Published 18 Feb 2022 · Fixed in 10.5.14, 10.6.6, 10.7.2 · NVD
  10. High 7.8

    CVE-2022-24050 · MariaDB

    MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of validating the existence of an object prior to performing…

    Published 18 Feb 2022 · Fixed in 10.5.14, 10.6.6, 10.7.2 · NVD
  11. High 7.8

    CVE-2022-24048 · MariaDB

    MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of…

    Published 18 Feb 2022 · Fixed in 10.5.14, 10.6.6, 10.7.2 · NVD
  12. High 8.8

    CVE-2020-25722 · Samba

    Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.

    Published 18 Feb 2022 · Fixed in 4.13.14, 4.14.10, 4.15.2 · NVD
  13. High 7.2

    CVE-2020-25719 · Samba

    A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.

    Published 18 Feb 2022 · Fixed in 4.13.14, 4.14.10, 4.15.2 · NVD
  14. High 8.8

    CVE-2020-25718 · Samba

    A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.

    Published 18 Feb 2022 · Fixed in 4.13.14, 4.14.10, 4.15.2 · NVD
  15. High 8.1

    CVE-2020-25717 · Samba

    A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.

    Published 18 Feb 2022 · Fixed in 4.13.14, 4.14.10, 4.15.2 · NVD
  16. Medium 5.9

    CVE-2016-2124 · Samba

    A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.

    Published 18 Feb 2022 · Fixed in 4.13.14, 4.14.10, 4.15.2 · NVD
  17. Critical 9.8

    CVE-2022-25315 · Expat

    In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

    Published 18 Feb 2022 · Fixed in 2.4.5 · NVD
  18. High 7.5

    CVE-2022-25314 · Expat

    In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.

    Published 18 Feb 2022 · Fixed in 2.4.5 · NVD
  19. Medium 6.5

    CVE-2022-25313 · Expat

    In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

    Published 18 Feb 2022 · Fixed in 2.4.5 · NVD
  20. Medium 5.3

    CVE-2022-0622 · Snipe-IT

    Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.

    Published 17 Feb 2022 · NVD
  21. Medium 6.5

    CVE-2022-25270 · Drupal

    The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

    Published 17 Feb 2022 · Fixed in 9.2.13, 9.3.6 · NVD
  22. Medium 6.5

    CVE-2022-0633 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Incorrect Authorization

    Published 17 Feb 2022 · Fixed in 1.22.3, 2.22.3 · NVD, WPVulnerability
  23. High 7.5

    CVE-2022-25271 · Drupal

    Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.

    Published 16 Feb 2022 · Fixed in 7.88, 9.2.13, 9.3.6 · NVD
  24. Critical 9.9

    CVE-2021-3781 · Ghostscript

    A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

    Published 16 Feb 2022 · NVD
  25. Critical 9.8Actively exploited

    CVE-2022-24086 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

    Published 16 Feb 2022 · Fixed in 2.3.0 · NVD
  26. Medium 6.5

    CVE-2021-3557 · Argo CD

    A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster including all secrets which might enable privilege escalations. The highest threat from this vulnerability is to data confidentiality.

    Published 16 Feb 2022 · Fixed in 1.1.1 · NVD
  27. High 7.5

    CVE-2021-22050 · VMware ESXi

    ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. A malicious actor with network access to ESXi may exploit this issue to create a denial-of-service condition by overwhelming rhttpproxy service with multiple requests.

    Published 16 Feb 2022 · NVD
  28. High 7.5

    CVE-2021-22043 · VMware ESXi

    VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled. A malicious actor with access to settingsd, may exploit this issue to escalate their privileges by writing arbitrary files.

    Published 16 Feb 2022 · NVD
  29. High 7.8

    CVE-2021-22042 · VMware ESXi

    VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within the VMX process only, may be able to access settingsd service running as a high privileged user.

    Published 16 Feb 2022 · NVD
  30. Medium 6.7

    CVE-2021-22041 · VMware ESXi

    VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

    Published 16 Feb 2022 · NVD
  31. Medium 6.7

    CVE-2021-22040 · VMware ESXi

    VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

    Published 16 Feb 2022 · NVD
  32. High 7.5

    CVE-2022-23632 · Traefik

    Wrong TLS configuration choice

    Published 16 Feb 2022 · Fixed in 2.6.1 · NVD, Project advisories (GitHub)
  33. Critical 9.8

    CVE-2022-25236 · Expat

    xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

    Published 16 Feb 2022 · Fixed in 2.4.5 · NVD
  34. Critical 9.8

    CVE-2022-25235 · Expat

    xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

    Published 16 Feb 2022 · Fixed in 2.4.5 · NVD
  35. High 8.8

    CVE-2022-0611 · Snipe-IT

    Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.

    Published 16 Feb 2022 · Fixed in 5.3.11 · NVD
  36. Medium 6.5

    CVE-2022-23641 · Discourse

    Discourse is an open source discussion platform. In versions prior to 2.8.1 in the `stable` branch, 2.9.0.beta2 in the `beta` branch, and 2.9.0.beta2 in the `tests-passed` branch, users can trigger a Denial of Service attack by posting a streaming URL. Parsing Oneboxes in the background job trigger an infinite loop, which cause memory leaks. This issue is patched in version 2.8.1 of the `stable`…

    Published 15 Feb 2022 · Fixed in 2.8.1 · NVD
  37. Medium 5.4

    CVE-2022-24590 · Backdrop CMS

    A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML.

    Published 15 Feb 2022 · NVD
  38. Medium 6.5

    CVE-2021-43941 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and ImporterValueMappingsPage.jspa) via a Cross-Site Request Forgery (CSRF) vulnerability in the jira-importers-plugin. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.

    Published 15 Feb 2022 · Fixed in 8.13.5, 8.20.3 · NVD
  39. High 7.8

    CVE-2021-43940 · Confluence

    Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.

    Published 15 Feb 2022 · Fixed in 7.4.10, 7.12.3 · NVD
  40. Medium 4.3

    CVE-2021-43953 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/ViewInstrumentation.jspa endpoint. The affected versions are before version 8.13.16, and from version 8.14.0 before 8.20.5.

    Published 15 Feb 2022 · Fixed in 8.13.16, 8.20.5 · NVD
  41. Medium 4.3

    CVE-2021-43952 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/RestoreDefaults.jspa endpoint. The affected versions are before version 8.21.0.

    Published 15 Feb 2022 · Fixed in 8.13.18, 8.20.6 · NVD
  42. Medium 6.5

    CVE-2022-0579 · Snipe-IT

    Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.

    Published 14 Feb 2022 · Fixed in 5.3.9 · NVD
  43. Medium 4.3

    CVE-2021-45346 · SQLite

    A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give…

    Published 14 Feb 2022 · NVD
  44. Medium 4.3

    CVE-2022-0569 · Snipe-IT

    Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9.

    Published 14 Feb 2022 · Fixed in 5.3.9 · NVD
  45. Medium 6.4

    CVE-2022-0565 · Pimcore

    Cross-site Scripting in Packagist pimcore/pimcore prior to 10.3.1.

    Published 14 Feb 2022 · Fixed in 10.3.1 · NVD
  46. High

    CVE-2022-23633 · Ruby on Rails

    Possible exposure of information vulnerability in Action Pack

    Published 11 Feb 2022 · Fixed in 5.2.6.2 · Project advisories (GitHub)
  47. Medium 5.4

    CVE-2022-23707 · Kibana

    An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject malicious javascript into the index pattern which could execute against other users

    Published 11 Feb 2022 · Fixed in 7.17.0 · NVD
  48. High 7.5

    CVE-2020-13677 · Drupal

    Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.

    Published 11 Feb 2022 · Fixed in 8.9.19, 9.1.13, 9.2.6 · NVD
  49. Medium 6.5

    CVE-2020-13676 · Drupal

    The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

    Published 11 Feb 2022 · Fixed in 8.9.19, 9.1.13, 9.2.6 · NVD
  50. Critical 9.8

    CVE-2020-13675 · Drupal

    Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.

    Published 11 Feb 2022 · Fixed in 8.9.19, 9.1.13, 9.2.6 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.