UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
644
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. Medium 6.1

    CVE-2022-21261 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the…

    Published 19 Jan 2022 · NVD
  2. Medium 6.1

    CVE-2022-21260 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the…

    Published 19 Jan 2022 · NVD
  3. Medium 6.1

    CVE-2022-21259 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the…

    Published 19 Jan 2022 · NVD
  4. Medium 6.1

    CVE-2022-21258 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). The supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability…

    Published 19 Jan 2022 · NVD
  5. Medium 6.1

    CVE-2022-21257 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the…

    Published 19 Jan 2022 · NVD
  6. Medium 4.9

    CVE-2022-21256 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 19 Jan 2022 · NVD
  7. Medium 5.3

    CVE-2022-21254 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 19 Jan 2022 · NVD
  8. Medium 4.9

    CVE-2022-21253 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 19 Jan 2022 · NVD
  9. Medium 6.5

    CVE-2022-21252 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete…

    Published 19 Jan 2022 · NVD
  10. Low 2.7

    CVE-2022-21249 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service…

    Published 19 Jan 2022 · NVD
  11. Low 3.7

    CVE-2022-21248 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle…

    Published 19 Jan 2022 · NVD
  12. Medium 4.3

    CVE-2022-21245 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert…

    Published 19 Jan 2022 · NVD
  13. Medium 4.3

    CVE-2022-21673 · Grafana

    Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token (and no other user credentials) will forward the OAuth Identity of the most recently logged-in user. This can allow API token holders to retrieve data for which they may not have intended…

    Published 18 Jan 2022 · Fixed in 7.5.13, 8.3.4 · NVD
  14. High 7.4

    CVE-2022-22691 · Umbraco CMS

    The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. A related vulnerability (CVE-2022-22690) could allow this flaw to…

    Published 18 Jan 2022 · Fixed in 9.2.0 · NVD
  15. High 7.5

    CVE-2022-22690 · Umbraco CMS

    Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to the site. For example, when a user resets their password and the application builds a password reset URL or when the administrator invites users to the site. For Umbraco versions less than 9.2.0, if the Application URL is…

    Published 18 Jan 2022 · Fixed in 9.2.0 · NVD
  16. High 7.5

    CVE-2022-0244 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorrect handling of file.

    Published 18 Jan 2022 · NVD
  17. Medium 6.5

    CVE-2022-0172 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.2 · NVD
  18. High 8.0

    CVE-2022-0154 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their GitHub project imported on another GitLab user account.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.2 · NVD
  19. Medium 6.5

    CVE-2022-0152 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to unauthorized access to some particular fields through the GraphQL API.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.2 · NVD
  20. Medium 4.9

    CVE-2022-0151 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not correctly handling requests to delete existing packages which could result in a Denial of Service under specific conditions.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.2 · NVD
  21. Medium 4.3

    CVE-2022-0125 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not verifying that a maintainer of a project had the right access to import members from a target project.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.2 · NVD
  22. Medium 4.3

    CVE-2022-0124 · GitLab

    An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is incorrectly validating user input and allows to craft malicious URLs that are sent to slack.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.1 · NVD
  23. Medium 4.3

    CVE-2022-0093 · GitLab

    An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab allows a user with an expired password to access sensitive information through RSS feeds.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.1 · NVD
  24. Medium 6.5

    CVE-2022-0090 · GitLab

    An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way that it doesn't ignore replacement references with git sub-commands, allowing a malicious user to spoof the contents of their commits in the UI.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.1 · NVD
  25. Medium 5.4

    CVE-2021-39946 · GitLab

    Improper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed an attacker to exploit XSS by abusing the generation of the HTML code related to emojis

    Published 18 Jan 2022 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  26. Medium 6.5

    CVE-2021-39942 · GitLab

    A denial of service vulnerability in GitLab CE/EE affecting all versions starting from 12.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows low-privileged users to bypass file size limits in the NPM package repository to potentially cause denial of service.

    Published 18 Jan 2022 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  27. Medium 4.3

    CVE-2021-39927 · GitLab

    Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and between 14.6.0 and 14.6.1 would fail to protect against attacks sending requests to localhost on port 80 or 443 if GitLab was configured to run on a port other than 80 or 443

    Published 18 Jan 2022 · NVD
  28. Medium 4.3

    CVE-2021-39892 · GitLab

    In all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from projects that they don't have a maintainer role on and disclose email addresses of those users.

    Published 18 Jan 2022 · Fixed in 14.1.7, 14.2.5 · NVD
  29. Medium 5.7

    CVE-2021-37865 · Mattermost

    Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.

    Published 18 Jan 2022 · NVD
  30. Medium 6.5

    CVE-2021-37864 · Mattermost

    Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs.

    Published 18 Jan 2022 · NVD
  31. High 8.8

    CVE-2022-23307 · Apache Log4j, Oracle WebLogic Server

    CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

    Published 18 Jan 2022 · Fixed in 2.0 · NVD
  32. Critical 9.8

    CVE-2022-23305 · Apache Log4j, Oracle WebLogic Server

    By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be…

    Published 18 Jan 2022 · NVD
  33. High 8.8

    CVE-2022-23302 · Apache Log4j, Oracle WebLogic Server

    JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar…

    Published 18 Jan 2022 · NVD
  34. High 7.8

    CVE-2022-0263 · Pimcore

    Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.

    Published 18 Jan 2022 · Fixed in 10.2.7 · NVD
  35. Medium 6.1

    CVE-2022-0262 · Pimcore

    Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7.

    Published 18 Jan 2022 · Fixed in 10.2.7 · NVD
  36. Medium 4.3

    CVE-2021-4146 · Pimcore

    Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6.

    Published 18 Jan 2022 · Fixed in 10.2.6 · NVD
  37. Medium 5.4

    CVE-2022-0260 · Pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7.

    Published 18 Jan 2022 · Fixed in 10.2.7 · NVD
  38. Medium 4.3

    CVE-2022-21683 · Wagtail

    Comment reply notifications sent to incorrect users

    Published 18 Jan 2022 · Fixed in 2.15.2 · NVD, Project advisories (GitHub)
  39. High 8.8

    CVE-2022-0258 · Pimcore

    pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command

    Published 17 Jan 2022 · Fixed in 10.2.8 · NVD
  40. Medium 5.4

    CVE-2022-0257 · Pimcore

    pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    Published 17 Jan 2022 · Fixed in 10.2.8 · NVD
  41. Medium 5.4

    CVE-2022-0256 · Pimcore

    pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    Published 17 Jan 2022 · Fixed in 10.2.8 · NVD
  42. Critical 9.8

    CVE-2022-0224 · Dolibarr ERP CRM

    dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command

    Published 14 Jan 2022 · Fixed in 15.0.0 · NVD
  43. Medium 5.3

    CVE-2022-21677 · Discourse

    Discourse is an open source discussion platform. Discourse groups can be configured with varying visibility levels for the group as well as the group members. By default, a newly created group has its visibility set to public and the group's members visibility set to public as well. However, a group's visibility and the group's members visibility can be configured such that it is restricted to…

    Published 14 Jan 2022 · NVD
  44. High 8.8

    CVE-2021-32650 · October CMS

    Arbitrary code execution

    Published 14 Jan 2022 · NVD, Project advisories (GitHub)
  45. High 8.8

    CVE-2021-32649 · October CMS

    Authenticated file write leads to remote code execution

    Published 14 Jan 2022 · Fixed in 1.0.473, 1.1.6 · NVD, Project advisories (GitHub)
  46. Critical 9.8

    CVE-2022-23219 · GNU C Library

    The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

    Published 14 Jan 2022 · Fixed in 2.31 · NVD
  47. Critical 9.8

    CVE-2022-23218 · GNU C Library

    The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

    Published 14 Jan 2022 · Fixed in 2.31 · NVD
  48. High 7.5

    CVE-2022-20698 · ClamAV

    A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper checks that may result in an invalid pointer read. An attacker could exploit this vulnerability by sending a…

    Published 14 Jan 2022 · Fixed in 0.103.5, 0.104.2 · NVD
  49. Medium 5.4

    CVE-2022-0178 · Snipe-IT

    Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.

    Published 13 Jan 2022 · Fixed in 5.3.8 · NVD
  50. High 8.8

    CVE-2022-21684 · Discourse

    Discourse is an open source discussion platform. Versions prior to 2.7.13 in `stable`, 2.8.0.beta11 in `beta`, and 2.8.0.beta11 in `tests-passed` allow some users to log in to a community before they should be able to do so. A user invited via email to a forum with `must_approve_users` enabled is going to be automatically logged in, bypassing the check that does not allow unapproved users to…

    Published 13 Jan 2022 · Fixed in 2.7.13 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.