UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,067
Published in 7 days
644
Critical in 30 days
382
Actively exploited
421

Latest vulnerabilities

39,067 vulnerabilities
  1. Medium 6.1

    CVE-2021-44178 · Adobe Experience Manager

    AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a reflected Cross-Site Scripting (XSS) vulnerability via the itemResourceType parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser

    Published 13 Jan 2022 · NVD
  2. Medium 6.1

    CVE-2021-44177 · Adobe Experience Manager

    AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jan 2022 · NVD
  3. Medium 6.1

    CVE-2021-44176 · Adobe Experience Manager

    AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jan 2022 · NVD
  4. Medium 6.1

    CVE-2021-43765 · Adobe Experience Manager

    AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jan 2022 · NVD
  5. Medium 5.4

    CVE-2021-43764 · Adobe Experience Manager

    AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jan 2022 · NVD
  6. Medium 6.5

    CVE-2021-43762 · Adobe Experience Manager

    AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a dispatcher bypass vulnerability that could be abused to evade security controls. Sensitive areas of the web application may be exposed through exploitation of the vulnerability.

    Published 13 Jan 2022 · NVD
  7. Medium 5.4

    CVE-2021-43761 · Adobe Experience Manager

    AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jan 2022 · NVD
  8. Critical 9.8

    CVE-2021-40722 · Adobe Experience Manager

    AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.

    Published 13 Jan 2022 · NVD
  9. Medium 4.3

    CVE-2022-21678 · Discourse

    Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version…

    Published 13 Jan 2022 · Fixed in 2.7.13 · NVD
  10. Medium 5.3Actively exploited

    CVE-2022-23134 · Zabbix

    After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

    Published 13 Jan 2022 · NVD
  11. Medium 5.4

    CVE-2022-23133 · Zabbix

    An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts.

    Published 13 Jan 2022 · NVD
  12. High 7.3

    CVE-2022-23132 · Zabbix

    During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level

    Published 13 Jan 2022 · NVD
  13. Critical 9.8Actively exploited

    CVE-2022-23131 · Zabbix

    In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the…

    Published 13 Jan 2022 · NVD
  14. Medium 4.3

    CVE-2022-20612 · Jenkins

    A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.

    Published 12 Jan 2022 · NVD
  15. Medium 5.4

    CVE-2022-0179 · Snipe-IT

    snipe-it is vulnerable to Missing Authorization

    Published 12 Jan 2022 · Fixed in 5.3.7 · NVD
  16. Critical 9.0

    CVE-2022-21969 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 11 Jan 2022 · NVD
  17. Critical 9.0

    CVE-2022-21855 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 11 Jan 2022 · NVD
  18. Critical 9.0

    CVE-2022-21846 · Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Published 11 Jan 2022 · NVD
  19. High 7.5

    CVE-2021-34704 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this vulnerability by sending a malicious…

    Published 11 Jan 2022 · Fixed in 9.15.1.17, 9.16.2 · NVD
  20. High 7.5

    CVE-2021-1573 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this vulnerability by sending a malicious…

    Published 11 Jan 2022 · Fixed in 9.14.3, 9.15.1.17, 9.16.1.28 · NVD
  21. Low 2.5

    CVE-2021-43566 · Samba

    All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack to succeed.

    Published 11 Jan 2022 · Fixed in 4.13.16 · NVD
  22. Medium 4.3

    CVE-2022-0174 · Dolibarr ERP CRM

    Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr.

    Published 10 Jan 2022 · Fixed in 15.0.0 · NVD
  23. High 8.8

    CVE-2022-22827 · Expat

    storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    Published 10 Jan 2022 · Fixed in 2.4.3 · NVD
  24. High 8.8

    CVE-2022-22826 · Expat

    nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    Published 10 Jan 2022 · Fixed in 2.4.3 · NVD
  25. High 8.8

    CVE-2022-22825 · Expat

    lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    Published 10 Jan 2022 · Fixed in 2.4.3 · NVD
  26. Critical 9.8

    CVE-2022-22824 · Expat

    defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    Published 10 Jan 2022 · Fixed in 2.4.3 · NVD
  27. Critical 9.8

    CVE-2022-22823 · Expat

    build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    Published 10 Jan 2022 · Fixed in 2.4.3 · NVD
  28. Critical 9.8

    CVE-2022-22822 · Expat

    addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    Published 10 Jan 2022 · Fixed in 2.4.3 · NVD
  29. Medium 4.8

    CVE-2021-46150 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling, as demonstrated by an XSS payload in MediaWiki:October.

    Published 10 Jan 2022 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD
  30. High 7.5

    CVE-2021-46149 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplished by searching for a very long key in a Language Name Search.

    Published 10 Jan 2022 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD
  31. Medium 6.5

    CVE-2021-46148 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (e.g., IP addresses and User-Agent headers for election traffic) on a testwiki SecurePoll instance.

    Published 10 Jan 2022 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD
  32. High 8.8

    CVE-2021-46147 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF.

    Published 10 Jan 2022 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD
  33. Medium 5.4

    CVE-2021-46146 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The WikibaseMediaInfo component is vulnerable to XSS via the caption fields for a given media file.

    Published 10 Jan 2022 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD
  34. Medium 5.3Actively exploited

    CVE-2021-35247 · SolarWinds Serv-U

    Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends…

    Published 10 Jan 2022 · Fixed in 15.3 · NVD
  35. High 8.8

    CVE-2021-20048 · SonicWall SonicOS

    A Stack-based buffer overflow in the SonicOS SessionID HTTP response header allows a remote authenticated attacker to cause Denial of Service (DoS) and potentially results in code execution in the firewall. This vulnerability affected SonicOS Gen 5, Gen 6 and Gen 7 firmware versions.

    Published 10 Jan 2022 · NVD
  36. High 8.8

    CVE-2021-20046 · SonicWall SonicOS

    A Stack-based buffer overflow in the SonicOS HTTP Content-Length response header allows a remote authenticated attacker to cause Denial of Service (DoS) and potentially results in code execution in the firewall. This vulnerability affected SonicOS Gen 5, Gen 6 and Gen 7 firmware versions.

    Published 10 Jan 2022 · NVD
  37. High 8.8

    CVE-2021-21408 · Smarty

    Access to restricted PHP code by dynamic static class access

    Published 10 Jan 2022 · Fixed in 3.1.43, 4.0.3 · NVD, Project advisories (GitHub)
  38. Medium 4.7

    CVE-2021-25103 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Cross-site Scripting

    Published 10 Jan 2022 · Fixed in 2.9.7 · WPVulnerability
  39. High 8.8

    CVE-2021-29454 · Smarty

    Sandbox Escape by math function

    Published 9 Jan 2022 · Fixed in 3.1.42, 4.0.2 · NVD, Project advisories (GitHub)
  40. Low 3.0

    CVE-2021-25743 · Kubernetes

    kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.

    Published 7 Jan 2022 · NVD
  41. High 7.5

    CVE-2022-21661 · WordPress

    WordPress: SQL Injection through WP_Query

    Published 6 Jan 2022 · Fixed in 5.6.7, 5.7.5, 5.8.3 · NVD, WordPress
  42. Medium 5.4

    CVE-2022-21662 · WordPress

    WordPress: Stored XSS through authenticated users

    Published 6 Jan 2022 · Fixed in 5.8.3 · NVD, WordPress
  43. High 7.2

    CVE-2022-21663 · WordPress

    WordPress: Authenticated Object Injection in Multisites

    Published 6 Jan 2022 · Fixed in 5.8.3 · NVD, WordPress
  44. High 8.8

    CVE-2022-21664 · WordPress

    WordPress: SQL injection due to improper sanitization in WP_Meta_Query

    Published 6 Jan 2022 · Fixed in 5.8.3 · NVD, WordPress
  45. Medium 5.9

    CVE-2022-22707 · lighttpd

    In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1), as demonstrated by remote denial of service (daemon crash) in a non-default configuration. The non-default configuration requires handling of the Forwarded header in a somewhat unusual manner. Also, a 32-bit system is much more likely…

    Published 6 Jan 2022 · NVD
  46. High 7.8

    CVE-2021-46143 · Expat

    In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

    Published 6 Jan 2022 · Fixed in 2.4.3 · NVD
  47. High 7.2

    CVE-2021-43947 · Jira

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution (RCE) vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.

    Published 6 Jan 2022 · Fixed in 8.13.15, 8.20.3 · NVD
  48. High 8.1

    CVE-2022-21652 · Shopware

    Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing…

    Published 5 Jan 2022 · Fixed in 5.7.7 · NVD
  49. Medium 6.1

    CVE-2022-21651 · Shopware

    Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplete URL handling in the shopware router. This issue has been resolved in version 5.7.7. There is no workaround and users are advised to upgrade as soon as possible.

    Published 5 Jan 2022 · Fixed in 5.7.7 · NVD
  50. Medium 4.3

    CVE-2022-21642 · Discourse

    Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this issue and users are advised to upgrade.

    Published 5 Jan 2022 · Fixed in 2.7.13 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.