UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
645
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. Medium 6.5

    CVE-2020-13674 · Drupal

    The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.

    Published 11 Feb 2022 · Fixed in 8.9.19, 9.1.13, 9.2.6 · NVD
  2. Medium 6.1

    CVE-2020-13672 · Drupal

    Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.

    Published 11 Feb 2022 · Fixed in 8.9.14, 9.0.12, 9.1.7 · NVD
  3. High 7.5

    CVE-2020-13670 · Drupal

    Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

    Published 11 Feb 2022 · Fixed in 8.8.10, 8.9.6, 9.0.6 · NVD
  4. Medium 6.1

    CVE-2020-13669 · Drupal

    Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

    Published 11 Feb 2022 · Fixed in 8.8.10, 8.9.6, 9.0.6 · NVD
  5. Medium 6.1

    CVE-2020-13668 · Drupal

    Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

    Published 11 Feb 2022 · Fixed in 8.8.10, 8.9.6, 9.0.6 · NVD
  6. Critical 9.8Actively exploited

    CVE-2022-24112 · Apache APISIX

    An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction…

    Published 11 Feb 2022 · Fixed in 2.10.4, 2.12.1 · NVD
  7. Critical 9.8

    CVE-2022-24961 · Portainer

    In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days.

    Published 11 Feb 2022 · Fixed in 2.11.1 · NVD
  8. Critical 9.8

    CVE-2021-45364 · Statamic

    A Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php. NOTE: the vendor indicates that there was an error in publishing this CVE Record, and that all parties agree that the affected code was not used in any Statamic product

    Published 10 Feb 2022 · NVD
  9. Medium 6.5

    CVE-2022-0011 · Palo Alto Networks PAN-OS

    PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile. When the entries in these lists have a hostname pattern that does not…

    Published 10 Feb 2022 · Fixed in 9.1.12, 10.0.8, 10.1.3 · NVD
  10. High 7.5

    CVE-2022-0391 · Python

    A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions…

    Published 9 Feb 2022 · Fixed in 3.7.11, 3.8.11, 3.9.5 · NVD
  11. Medium 4.3

    CVE-2021-39943 · GitLab

    An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allowed a user to update the status of the check via an API call

    Published 9 Feb 2022 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  12. High 8.8

    CVE-2021-22954 · Concrete CMS

    A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.

    Published 9 Feb 2022 · Fixed in 9.0 · NVD
  13. Critical 9.8

    CVE-2021-45331 · Gitea

    An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once.

    Published 9 Feb 2022 · Fixed in 1.5.0 · NVD
  14. Critical 9.8

    CVE-2021-45330 · Gitea

    An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse.

    Published 9 Feb 2022 · NVD
  15. High 7.5

    CVE-2022-21986 · .NET

    .NET Denial of Service Vulnerability

    Published 9 Feb 2022 · Fixed in 5.0.14, 6.0.2 · NVD
  16. High 7.5

    CVE-2022-0538 · Jenkins

    Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.

    Published 9 Feb 2022 · Fixed in 2.319.3, 2.334 · NVD
  17. Medium 6.1Actively exploited

    CVE-2022-24682 · Zimbra Collaboration

    An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

    Published 9 Feb 2022 · Fixed in 8.8.15 · NVD
  18. Medium 6.1

    CVE-2021-45329 · Gitea

    Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.

    Published 8 Feb 2022 · Fixed in 1.5.1 · NVD
  19. Medium 5.4

    CVE-2022-21702 · Grafana

    Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set…

    Published 8 Feb 2022 · Fixed in 7.5.15, 8.3.5 · NVD
  20. Medium 6.1

    CVE-2021-45328 · Gitea

    Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.

    Published 8 Feb 2022 · Fixed in 1.4.3 · NVD
  21. Medium 5.4

    CVE-2022-0510 · Pimcore

    Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.

    Published 8 Feb 2022 · NVD
  22. Critical 9.8

    CVE-2021-45327 · Gitea

    Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code.

    Published 8 Feb 2022 · Fixed in 1.11.2 · NVD
  23. High 8.8

    CVE-2021-45326 · Gitea

    Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.

    Published 8 Feb 2022 · Fixed in 1.5.2 · NVD
  24. High 7.5

    CVE-2021-45325 · Gitea

    Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.

    Published 8 Feb 2022 · Fixed in 1.7.0 · NVD
  25. High 8.8

    CVE-2022-21703 · Grafana

    CVE-2022-21703: Grafana Cross Site Request Forgery (CSRF)

    Published 8 Feb 2022 · Fixed in 7.5.15, 8.3.5 · NVD, Project advisories (GitHub)
  26. Medium 4.3

    CVE-2022-21713 · Grafana

    CVE-2022-21713: Grafana Teams API IDOR

    Published 8 Feb 2022 · Fixed in 7.5.15, 8.3.5 · NVD, Project advisories (GitHub)
  27. Medium 5.4

    CVE-2022-0509 · Pimcore

    Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.

    Published 8 Feb 2022 · Fixed in 10.3.1 · NVD
  28. High 7.5

    CVE-2022-23913 · Apache ActiveMQ Artemis

    In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.

    Published 4 Feb 2022 · Fixed in 2.19.1 · NVD
  29. High 7.1

    CVE-2021-32036 · MongoDB

    An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions…

    Published 4 Feb 2022 · Fixed in 4.2.18, 4.4.10, 5.0.4 · NVD
  30. High 7.7

    CVE-2022-24348 · Argo CD

    Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.

    Published 4 Feb 2022 · Fixed in 2.1.9, 2.2.4 · NVD
  31. High 8.8

    CVE-2021-45268 · Backdrop CMS

    A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a session cookie of a high-privileged authenticated user who is entitled to install arbitrary add-ons

    Published 3 Feb 2022 · NVD
  32. Critical 9.8

    CVE-2022-24307 · Mastodon

    Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (JSON-LD signing has been supported since version 1.6.0.)

    Published 3 Feb 2022 · Fixed in 3.3.2, 3.4.6 · NVD
  33. Medium 6.1

    CVE-2022-0432 · Mastodon

    Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.

    Published 2 Feb 2022 · Fixed in 3.5.0 · NVD
  34. High 8.8

    CVE-2021-41018 · Fortinet FortiWeb

    A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.

    Published 2 Feb 2022 · Fixed in 6.2.7, 6.3.16, 6.4.2 · NVD
  35. High 7.2

    CVE-2021-36193 · Fortinet FortiWeb

    Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands.

    Published 2 Feb 2022 · Fixed in 6.2.6, 6.3.16, 6.4.2 · NVD
  36. High 8.8

    CVE-2021-43073 · Fortinet FortiWeb

    A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.

    Published 2 Feb 2022 · Fixed in 6.2.7, 6.3.17, 6.4.2 · NVD
  37. High 8.1

    CVE-2021-42753 · Fortinet FortiWeb

    An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.x, 6.1.x, 6.0.x, 5.9.x and 5.8.x may allow an authenticated attacker to perform an arbitrary file and directory deletion in the device filesystem.

    Published 2 Feb 2022 · Fixed in 6.3.16, 6.4.2 · NVD
  38. Medium 6.5

    CVE-2021-44451 · Apache Superset

    Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.

    Published 1 Feb 2022 · NVD
  39. High 7.5

    CVE-2021-43859 · Jenkins

    XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add…

    Published 1 Feb 2022 · Fixed in 2.319.3, 2.334 · NVD
  40. Low 3.1

    CVE-2020-8562 · Kubernetes

    As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16)…

    Published 1 Feb 2022 · NVD
  41. High 7.5

    CVE-2021-46669 · MariaDB

    MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used.

    Published 1 Feb 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  42. Medium 5.5

    CVE-2021-46668 · MariaDB

    MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures.

    Published 1 Feb 2022 · Fixed in 10.5.15, 10.6.7, 10.7.3 · NVD
  43. Medium 5.5

    CVE-2021-46667 · MariaDB

    MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.

    Published 1 Feb 2022 · Fixed in 10.4.22, 10.5.13, 10.6.5 · NVD
  44. Medium 5.5

    CVE-2021-46666 · MariaDB

    MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause.

    Published 1 Feb 2022 · Fixed in 10.4.20, 10.5.11, 10.6.2 · NVD
  45. Medium 5.5

    CVE-2021-46665 · MariaDB

    MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations.

    Published 1 Feb 2022 · Fixed in 10.5.15, 10.6.7, 10.7.3 · NVD
  46. Medium 5.5

    CVE-2021-46664 · MariaDB

    MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr.

    Published 1 Feb 2022 · Fixed in 10.5.15, 10.6.7, 10.7.3 · NVD
  47. Medium 5.5

    CVE-2021-46663 · MariaDB

    MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements.

    Published 1 Feb 2022 · Fixed in 10.5.15, 10.6.7, 10.7.3 · NVD
  48. Medium 5.5

    CVE-2021-46662 · MariaDB

    MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery.

    Published 1 Feb 2022 · Fixed in 10.4.22, 10.5.13, 10.6.5 · NVD
  49. Medium 5.5

    CVE-2021-46661 · MariaDB

    MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE).

    Published 1 Feb 2022 · Fixed in 10.5.15, 10.6.7, 10.7.3 · NVD
  50. Medium 4.3

    CVE-2022-0414 · Dolibarr ERP CRM

    Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0.

    Published 31 Jan 2022 · Fixed in 16.0.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.