UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
235
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Medium 5.4

    CVE-2021-44855 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stored XSS via a URL to the Upload Image feature.

    Published 26 Dec 2022 · Fixed in 1.35.5, 1.36.3 · NVD
  2. Medium 5.3

    CVE-2021-44854 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results from private wikis.

    Published 26 Dec 2022 · Fixed in 1.35.5, 1.36.3 · NVD
  3. High 7.5

    CVE-2022-43551 · curl

    A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII…

    Published 23 Dec 2022 · Fixed in 7.87.0 · NVD
  4. Medium 5.9

    CVE-2022-3590 · WordPress

    WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

    Published 14 Dec 2022 · NVD
  5. High 7.5

    CVE-2022-3996 · OpenSSL

    If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by…

    Published 13 Dec 2022 · NVD
  6. High 8.1

    CVE-2022-43548 · Node.js

    A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was…

    Published 5 Dec 2022 · Fixed in 14.21.1, 16.18.1 · NVD
  7. Medium 6.5

    CVE-2022-35260 · curl

    curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user…

    Published 5 Dec 2022 · Fixed in 7.86.0 · NVD
  8. Medium 6.5

    CVE-2022-35256 · Node.js

    The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

    Published 5 Dec 2022 · Fixed in 14.20.1, 16.17.1, 18.9.1 · NVD
  9. Critical 9.1

    CVE-2022-35255 · Node.js

    A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be…

    Published 5 Dec 2022 · Fixed in 16.17.1, 18.9.1 · NVD
  10. Critical 9.8

    CVE-2022-32221 · curl

    When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free…

    Published 5 Dec 2022 · Fixed in 7.86.0 · NVD
  11. Medium 5.3

    CVE-2022-43504 · WordPress

    Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7.

    Published 5 Dec 2022 · Fixed in 5.8.6, 5.9.5, 6.0.3 · NVD
  12. Medium 6.1

    CVE-2022-43500 · WordPress

    Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.

    Published 5 Dec 2022 · Fixed in 5.8.6, 5.9.5, 6.0.3 · NVD
  13. Medium 6.1

    CVE-2022-43497 · WordPress

    Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.

    Published 5 Dec 2022 · Fixed in 5.8.6, 5.9.5, 6.0.3 · NVD
  14. Medium 4.3

    CVE-2022-46159 · Discourse

    Discourse is an open-source discussion platform. In version 2.8.13 and prior on the `stable` branch and version 2.9.0.beta14 and prior on the `beta` and `tests-passed` branches, any authenticated user can create an unlisted topic. These topics, which are not readily available to other users, can take up unnecessary site resources. A patch for this issue is available in the `main` branch of…

    Published 2 Dec 2022 · NVD
  15. Medium 5.3

    CVE-2022-41970 · Nextcloud

    Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and previews of documents (first page) can be downloaded without being watermarked. Versions 24.0.7 and 25.0.1 contain a fix for this issue. No known workarounds are available.

    Published 1 Dec 2022 · Fixed in 24.0.7 · NVD
  16. Low 2.7

    CVE-2022-41969 · Nextcloud

    Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Versions 23.0.11, 24.0.7, and 25.0.0 contain a fix for the issue. As a workaround, don't create user accounts with long passwords.

    Published 1 Dec 2022 · Fixed in 23.0.11, 24.0.7 · NVD
  17. Medium 5.3

    CVE-2022-41968 · Nextcloud

    Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can send unnecessary amounts of data against the database. Version 23.0.10 and 24.0.5 contain patches for the issue. No known workarounds are available.

    Published 1 Dec 2022 · Fixed in 23.0.10, 24.0.5 · NVD
  18. Medium 4.3

    CVE-2022-46150 · Discourse

    Discourse is an open-source discussion platform. Prior to version 2.8.13 of the `stable` branch and version 2.9.0.beta14 of the `beta` and `tests-passed` branches, unauthorized users may learn of the existence of hidden tags and that they have been applied to topics that they have access to. This issue is patched in version 2.8.13 of the `stable` branch and version 2.9.0.beta14 of the `beta` and…

    Published 29 Nov 2022 · Fixed in 2.8.13 · NVD
  19. Medium 5.4

    CVE-2022-46148 · Discourse

    Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the `stable` branch and versions 2.9.0.beta11 and prior on the `beta` and `tests-passed` branches, users composing malicious messages and navigating to drafts page could self-XSS. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. This issue…

    Published 29 Nov 2022 · NVD
  20. Medium 4.3

    CVE-2022-41944 · Discourse

    Discourse is an open-source discussion platform. In stable versions prior to 2.8.12 and beta or tests-passed versions prior to 2.9.0.beta.13, under certain conditions, a user can see notifications for topics they no longer have access to. If there is sensitive information in the topic title, it will therefore have been exposed. This issue is patched in stable version 2.8.12, beta version…

    Published 28 Nov 2022 · NVD
  21. Medium 4.3

    CVE-2022-41921 · Discourse

    Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial of service for other users when posting huge amounts of text. Users should upgrade to version 2.9.0.beta13, where a limit has been introduced. No known workarounds are available.

    Published 28 Nov 2022 · Fixed in 2.9.0 · NVD
  22. Medium 6.5

    CVE-2022-39346 · Nextcloud

    Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.

    Published 25 Nov 2022 · Fixed in 22.2.10, 23.0.7, 24.0.3 · NVD
  23. High 8.8

    CVE-2021-33621 · Ruby

    The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

    Published 18 Nov 2022 · Fixed in 2.7.7, 3.0.5, 3.1.3 · NVD
  24. High 7.5

    CVE-2022-42978 · Confluence

    In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access files on the remote system.

    Published 15 Nov 2022 · Fixed in 1.3.5 · NVD
  25. High 7.5

    CVE-2022-42977 · Confluence

    The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it. During export, the HTTP request has a fileName parameter that accepts any file on the system (e.g., an SSH private key) to be downloaded.

    Published 15 Nov 2022 · Fixed in 1.3.5 · NVD
  26. Medium 6.5

    CVE-2022-39385 · Discourse

    Discourse is the an open source discussion platform. In some rare cases users redeeming an invitation can be added as a participant to several private message topics that they should not be added to. They are not notified of this, it happens transparently in the background. This issue has been resolved in commit `a414520742` and will be included in future releases. Users are advised to upgrade.…

    Published 14 Nov 2022 · Fixed in 2.8.10 · NVD
  27. High 7.1

    CVE-2022-31630 · PHP

    In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.

    Published 14 Nov 2022 · Fixed in 7.4.33, 8.0.25, 8.1.12 · NVD
  28. Unrated

    WPV-2d3072452f6d · Yith Woocommerce Catalog Mode (WordPress plugin)

    Vulnerability in YITH WooCommerce Catalog Mode

    Published 11 Nov 2022 · Fixed in 2.16.1 · WPVulnerability
  29. Unrated

    WPV-29469e2f4254 · Yith Woocommerce Wishlist (WordPress plugin)

    Vulnerability in YITH WooCommerce Wishlist

    Published 11 Nov 2022 · Fixed in 3.15.0 · WPVulnerability
  30. Medium 4.6

    CVE-2022-44630 · Yith Woocommerce Catalog Mode (WordPress plugin), Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Catalog Mode: Cross-Site Request Forgery (CSRF)

    Published 11 Nov 2022 · Fixed in 2.16.1, 3.15.0 · WPVulnerability
  31. Low

    GHSA-vp35-85q5-9f25 · Docker Engine

    Container build can leak any path on the host into the container (using Git CVE-2022-39253)

    Published 10 Nov 2022 · Project advisories (GitHub)
  32. Medium 4.3

    CVE-2022-3819 · GitLab

    An improper authorization issue in GitLab CE/EE affecting all versions from 15.0 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a malicious users to set emojis on internal notes they don't have access to.

    Published 10 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  33. Medium 5.3

    CVE-2022-3818 · GitLab

    An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to cause performance issues and potentially a denial of service on the GitLab instance.

    Published 10 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  34. Medium 5.3

    CVE-2022-3793 · GitLab

    An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI/CD configuration file they don't have access to.

    Published 10 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  35. Critical 9.0

    CVE-2022-3726 · GitLab

    Lack of sand-boxing of OpenAPI documents in GitLab CE/EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick a user to click on the Swagger OpenAPI viewer and issue HTTP requests that affect the victim's account.

    Published 10 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  36. Medium 4.3

    CVE-2022-3706 · GitLab

    Improper authorization in GitLab CE/EE affecting all versions from 7.14 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user retrying a job in a downstream pipeline to take ownership of the retried jobs in the upstream pipeline even if the user doesn't have access to that project.

    Published 10 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  37. Medium 4.3

    CVE-2022-3413 · GitLab

    Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or Maintainers to view the group's Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above.

    Published 10 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  38. Medium 6.1

    CVE-2022-3486 · GitLab

    An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allows an attacker to redirect users to an arbitrary location if they trust the URL.

    Published 9 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  39. Medium 5.4

    CVE-2022-3483 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 15.3.5, all versions starting from 15.4 before 15.4.4, all versions starting from 15.5 before 15.5.2. A malicious maintainer could exfiltrate a Datadog integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server.

    Published 9 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  40. High 7.5

    CVE-2022-3285 · GitLab

    Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an unauthorized attacker to prevent access to GitLab

    Published 9 Nov 2022 · Fixed in 15.2.5, 15.3.4 · NVD
  41. Medium 6.1

    CVE-2022-3280 · GitLab

    An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick users into visiting a trustworthy URL and being redirected to arbitrary content.

    Published 9 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  42. Medium 5.4

    CVE-2022-3265 · GitLab

    A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.

    Published 9 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  43. Medium 5.3

    CVE-2022-2761 · GitLab

    An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to use GitLab Flavored Markdown (GFM) references in a Jira issue to disclose the names of resources they don't have access to.

    Published 9 Nov 2022 · Fixed in 15.3.5, 15.4.4, 15.5.2 · NVD
  44. High 7.5

    CVE-2022-45061 · Python

    An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they…

    Published 9 Nov 2022 · NVD
  45. Medium 6.1

    CVE-2022-27914 · Joomla!

    An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com_media.

    Published 8 Nov 2022 · Fixed in 4.2.5 · NVD
  46. High 7.8

    CVE-2022-42919 · Python

    Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine. Pickles can…

    Published 7 Nov 2022 · Fixed in 3.9.16, 3.10.9 · NVD
  47. Medium 5.4

    CVE-2022-2904 · GitLab

    A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 It was possible to exploit a vulnerability in the external status checks feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of…

    Published 2 Nov 2022 · Fixed in 15.2.5, 15.3.4 · NVD
  48. Medium 5.3

    CVE-2022-39378 · Discourse

    Discourse is a platform for community discussion. Under certain conditions, a user badge may have been awarded based on a user's activity in a topic with restricted access. Before this vulnerability was disclosed, the topic title of the topic associated with the user badge may be viewed by any user. If there are sensitive information in the topic title, it will therefore have been exposed. This…

    Published 2 Nov 2022 · Fixed in 2.8.9 · NVD
  49. High 8.8

    CVE-2022-39356 · Discourse

    Discourse is a platform for community discussion. Users who receive an invitation link that is not scoped to a single email address can enter any non-admin user's email and gain access to their account when accepting the invitation. All users should upgrade to the latest version. A workaround is temporarily disabling invitations with `SiteSetting.max_invites_per_day = 0` or scope them to…

    Published 2 Nov 2022 · Fixed in 2.8.10 · NVD
  50. Medium 4.9

    CVE-2022-39241 · Discourse

    Discourse is a platform for community discussion. A malicious admin could use this vulnerability to perform port enumeration on the local host or other hosts on the internal network, as well as against hosts on the Internet. Latest `stable`, `beta`, and `test-passed` versions are now patched. As a workaround, self-hosters can use `DISCOURSE_BLOCKED_IP_BLOCKS` env var (which overrides…

    Published 2 Nov 2022 · Fixed in 2.8.10 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.