UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
645
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. Medium 5.5

    CVE-2021-46659 · MariaDB

    MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW.

    Published 29 Jan 2022 · Fixed in 10.5.14, 10.6.6, 10.7.2 · NVD
  2. Medium 5.5

    CVE-2021-46658 · MariaDB

    save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_window_func=true for a subquery.

    Published 29 Jan 2022 · Fixed in 10.4.21, 10.5.12, 10.6.3 · NVD
  3. Medium 5.5

    CVE-2021-46657 · MariaDB

    get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.

    Published 29 Jan 2022 · Fixed in 10.4.20, 10.5.11, 10.6.2 · NVD
  4. High

    CVE-2022-23601 · Symfony

    CSRF token missing in forms

    Published 29 Jan 2022 · Project advisories (GitHub)
  5. Medium 5.9

    CVE-2022-21721 · Next.js

    Denial of Service Vulnerability in next.js

    Published 28 Jan 2022 · Fixed in 12.0.9 · OSV.dev and GitHub
  6. Medium 5.9

    CVE-2021-4160 · OpenSSL

    There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to…

    Published 28 Jan 2022 · Fixed in 1.1.1m · NVD
  7. High 7.2

    CVE-2020-28885 · Liferay Portal / DXP

    Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject commands through the Gogo Shell module to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to access and execute commands in Gogo Shell and therefore not a design fla

    Published 28 Jan 2022 · NVD
  8. High 7.2

    CVE-2020-28884 · Liferay Portal / DXP

    Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flaw.

    Published 28 Jan 2022 · NVD
  9. Medium 4.9

    CVE-2022-21720 · GLPI

    GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Entities` update right prevents exploitation of this vulnerability.

    Published 28 Jan 2022 · Fixed in 9.5.7 · NVD
  10. Medium 6.1

    CVE-2022-21719 · GLPI

    GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. Version 9.5.7 contains a patch for this issue. There are no known workarounds.

    Published 28 Jan 2022 · Fixed in 9.5.7 · NVD
  11. High 7.2

    CVE-2021-46088 · Zabbix

    Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user.

    Published 27 Jan 2022 · NVD
  12. Medium 5.4

    CVE-2022-0348 · Pimcore

    Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.

    Published 27 Jan 2022 · Fixed in 10.2 · NVD
  13. High 7.0

    CVE-2022-23181 · Apache Tomcat

    The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

    Published 27 Jan 2022 · NVD
  14. High 7.5

    CVE-2022-23990 · Expat

    Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

    Published 26 Jan 2022 · Fixed in 2.4.4 · NVD
  15. Medium 5.5

    CVE-2021-22570 · MySQL

    Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

    Published 26 Jan 2022 · NVD
  16. High 8.8

    CVE-2021-44123 · SPIP

    SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it.

    Published 26 Jan 2022 · NVD
  17. High 8.8

    CVE-2021-44122 · SPIP

    SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire_.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated…

    Published 26 Jan 2022 · NVD
  18. Medium 5.4

    CVE-2021-44120 · SPIP

    SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site and wants to read the author's information, the malicious code will be executed. The "Who are you"…

    Published 26 Jan 2022 · NVD
  19. Medium 5.4

    CVE-2021-44118 · SPIP

    SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users (stored XSS).

    Published 26 Jan 2022 · NVD
  20. Medium 5.4

    CVE-2022-0251 · Pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10.

    Published 26 Jan 2022 · Fixed in 10.2.0 · NVD
  21. Critical 9.8

    CVE-2022-21686 · PrestaShop

    Server Side Twig Template Injection

    Published 26 Jan 2022 · Fixed in 1.7.8.3 · NVD, Project advisories (GitHub)
  22. Critical 9.1

    CVE-2022-23959 · Varnish Cache

    In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.

    Published 26 Jan 2022 · Fixed in 6.0.10, 7.0.2 · NVD
  23. Medium 5.3

    CVE-2022-23032 · F5 BIG-IP

    In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP Edge Client on Mac and Windows is vulnerable to a DNS rebinding attack. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 25 Jan 2022 · NVD
  24. Medium 5.3

    CVE-2022-23030 · F5 BIG-IP

    On version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when the BIG-IP Virtual Edition (VE) uses the ixlv driver (which is used in SR-IOV mode and requires Intel X710/XL710/XXV710 family of network adapters on the Hypervisor) and TCP Segmentation Offload configuration is enabled, undisclosed requests may cause an increase in CPU resource…

    Published 25 Jan 2022 · NVD
  25. Medium 5.3

    CVE-2022-23029 · F5 BIG-IP

    On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 25 Jan 2022 · NVD
  26. Medium 5.3

    CVE-2022-23027 · F5 BIG-IP

    On BIG-IP versions 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, 13.1.x beginning in 13.1.3.6, 12.1.5.3-12.1.6, and 11.6.5.2, when a FastL4 profile and an HTTP, FIX, and/or hash persistence profile are configured on the same virtual server, undisclosed requests can cause the virtual server to stop processing new client connections. Note: Software versions which have reached End of Technical…

    Published 25 Jan 2022 · NVD
  27. High 7.5

    CVE-2022-23025 · F5 BIG-IP

    On BIG-IP version 16.1.x before 16.1.1, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, when a SIP ALG profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 25 Jan 2022 · NVD
  28. Medium 6.5

    CVE-2022-23023 · F5 BIG-IP

    On BIG-IP version 16.1.x before 16.1.2.1, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, and BIG-IQ all versions of 8.x and 7.x, undisclosed requests by an authenticated iControl REST user can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 25 Jan 2022 · NVD
  29. High 7.5

    CVE-2022-23022 · F5 BIG-IP

    On BIG-IP version 16.1.x before 16.1.2, when an HTTP profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 25 Jan 2022 · Fixed in 16.1.2 · NVD
  30. High 7.5

    CVE-2022-23021 · F5 BIG-IP

    On BIG-IP version 16.1.x before 16.1.2, when any of the following configurations are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate: HTTP redirect rule in an LTM policy, BIG-IP APM Access Profile, and Explicit HTTP Proxy in HTTP Profile. Note: Software versions which have reached End of Technical Support (EoTS) are not…

    Published 25 Jan 2022 · Fixed in 16.1.2 · NVD
  31. High 7.5

    CVE-2022-23020 · F5 BIG-IP

    On BIG-IP version 16.1.x before 16.1.2, when the 'Respond on Error' setting is enabled on the Request Logging profile and configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 25 Jan 2022 · Fixed in 16.1.2 · NVD
  32. High 7.5

    CVE-2022-23019 · F5 BIG-IP

    On BIG-IP version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a message routing type virtual server is configured with both Diameter Session and Router Profiles, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 25 Jan 2022 · Fixed in 14.1.4.4, 15.1.4.1, 16.1.2 · NVD
  33. High 7.5

    CVE-2022-23017 · F5 BIG-IP

    On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when a virtual server is configured with a DNS profile with the Rapid Response Mode setting enabled and is configured on a BIG-IP system, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical…

    Published 25 Jan 2022 · Fixed in 14.1.4.5, 15.1.4.1, 16.1.0 · NVD
  34. High 7.5

    CVE-2022-23016 · F5 BIG-IP

    On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP SSL Forward Proxy with TLS 1.3 is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 25 Jan 2022 · Fixed in 15.1.4.1, 16.1.2 · NVD
  35. High 7.5

    CVE-2022-23015 · F5 BIG-IP

    On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, and 14.1.2.6-14.1.4.4, when a Client SSL profile is configured on a virtual server with Client Certificate Authentication set to request/require and Session Ticket enabled and configured, processing SSL traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support…

    Published 25 Jan 2022 · Fixed in 14.1.4.4, 15.1.4.1, 16.1.0 · NVD
  36. Medium 6.5

    CVE-2022-23014 · F5 BIG-IP

    On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP APM portal access is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 25 Jan 2022 · Fixed in 15.1.4.1, 16.1.2 · NVD
  37. High 7.5

    CVE-2022-23012 · F5 BIG-IP

    On BIG-IP versions 15.1.x before 15.1.4.1 and 14.1.x before 14.1.4.5, when the HTTP/2 profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 25 Jan 2022 · Fixed in 14.1.4.5, 15.1.4.1 · NVD
  38. High 7.5

    CVE-2022-23011 · F5 BIG-IP

    On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while processing TCP traffic due to an issue in the SYN Cookie Protection feature. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 25 Jan 2022 · Fixed in 14.1.3, 15.1.4 · NVD
  39. High 7.5

    CVE-2022-23010 · F5 BIG-IP

    On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile and an HTTP profile are configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published 25 Jan 2022 · Fixed in 14.1.4.4, 15.1.4.1, 16.1.0 · NVD
  40. High 8.8

    CVE-2022-0335 · Moodle

    A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.

    Published 25 Jan 2022 · Fixed in 3.9.12, 3.10.9, 3.11.5 · NVD
  41. Medium 4.3

    CVE-2022-0334 · Moodle

    A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.

    Published 25 Jan 2022 · Fixed in 3.10.9, 3.11.5 · NVD
  42. Low 3.8

    CVE-2022-0333 · Moodle

    A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.

    Published 25 Jan 2022 · Fixed in 3.9.12, 3.10.9, 3.11.5 · NVD
  43. Critical 9.8

    CVE-2022-0332 · Moodle

    A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.

    Published 25 Jan 2022 · Fixed in 3.11.5 · NVD
  44. High 8.8

    CVE-2021-39031 · IBM WebSphere Application Server

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources. IBM X-Force ID: 213875.

    Published 25 Jan 2022 · NVD
  45. Medium 4.6

    CVE-2022-23035 · Xen

    Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative operation in particular when cleaning up after the guest's use of the device. In the case where an interrupt is not quiescent yet at the time this cleanup gets invoked, the cleanup attempt may be scheduled to be retried. When multiple…

    Published 25 Jan 2022 · NVD
  46. Medium 5.5

    CVE-2022-23034 · Xen

    A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappings for the case where a PV guest would have the IOMMU enabled. PV guests can request two forms of mappings. When both are in use for any individual mapping, unmapping of such a mapping can be requested in two steps. The reference count for such a mapping would then mistakenly be…

    Published 25 Jan 2022 · Fixed in 4.13.0 · NVD
  47. High 7.8

    CVE-2022-23033 · Xen

    arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when…

    Published 25 Jan 2022 · NVD
  48. Medium 5.4

    CVE-2022-0268 · Grav

    Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28.

    Published 25 Jan 2022 · Fixed in 1.7.28 · NVD
  49. Medium 6.5

    CVE-2022-23437 · Oracle WebLogic Server

    There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

    Published 24 Jan 2022 · NVD
  50. Critical 9.8

    CVE-2022-23852 · Expat

    Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

    Published 24 Jan 2022 · Fixed in 2.4.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.