UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
235
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Medium 4.9

    CVE-2022-21599 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Oct 2022 · NVD
  2. Medium 4.4

    CVE-2022-21595 · MariaDB, MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 18 Oct 2022 · Fixed in 10.5.14, 10.6.6, 10.7.2 · NVD
  3. Medium 4.9

    CVE-2022-21594 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 18 Oct 2022 · NVD
  4. Medium 4.3

    CVE-2022-21592 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 5.7.39 and prior and 8.0.29 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to…

    Published 18 Oct 2022 · NVD
  5. Medium 4.3

    CVE-2022-21589 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.39 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to…

    Published 18 Oct 2022 · NVD
  6. High 7.5

    CVE-2022-40696 · Advanced Custom Fields

    Advanced Custom Fields (ACF®): Exposure of Sensitive Information to an Unauthorized Actor

    Published 18 Oct 2022 · NVD, WPVulnerability
  7. Medium 4.3

    CVE-2022-3351 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. A user's primary email may be disclosed to an attacker through group member events webhooks.

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  8. Medium 4.3

    CVE-2022-3331 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab's Zentao integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Zentao project issues.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  9. Medium 4.3

    CVE-2022-3330 · GitLab

    It was possible for a guest user to read a todo targeting an inaccessible note in Gitlab CE/EE affecting all versions from 15.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1.

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  10. Medium 4.3

    CVE-2022-3325 · GitLab

    Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. Allowed for editing the approval rules via the API by an unauthorised user.

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  11. Medium 4.3

    CVE-2022-3293 · GitLab

    Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  12. Medium 6.5

    CVE-2022-3291 · GitLab

    Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 can leak sensitive information via cache

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  13. Medium 4.3

    CVE-2022-3288 · GitLab

    A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the content of the default branch would be expected.

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  14. Medium 5.3

    CVE-2022-3286 · GitLab

    Lack of IP address checking in GitLab EE affecting all versions from 14.2 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows a group member to bypass IP restrictions when using a deploy token

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  15. High 7.5

    CVE-2022-3283 · GitLab

    A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning an issue with special crafted content added to the description could have been used to trigger high CPU usage.

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  16. Medium 6.5

    CVE-2022-3279 · GitLab

    An unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to prevent access to job logs

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  17. Medium 6.5

    CVE-2022-3067 · GitLab

    An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. It was possible for an authenticated user to read arbitrary projects' content given the project's ID.

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  18. Medium 5.4

    CVE-2022-3066 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.0 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. It was possible for an unauthorised user to create issues in a project.

    Published 17 Oct 2022 · Fixed in 15.2.5, 15.3.4, 15.4.1 · NVD
  19. High 7.3

    CVE-2022-3060 · GitLab

    Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests

    Published 17 Oct 2022 · NVD
  20. High 7.5

    CVE-2022-3031 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It may be possible for an attacker to guess a user's password by brute force by sending crafted requests to a specific endpoint, even if the victim user has 2FA enabled on their account.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  21. Medium 4.3

    CVE-2022-3030 · GitLab

    An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosure of pipeline status to unauthorized users.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  22. Critical 9.9

    CVE-2022-2992 · GitLab

    A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  23. High 7.5

    CVE-2022-2931 · GitLab

    A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Malformed content added to the issue description could have been used to trigger high CPU usage.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  24. Medium 4.3

    CVE-2022-2908 · GitLab

    A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allowed an attacker to trigger high CPU usage via a special crafted input added in the Commit message field.

    Published 17 Oct 2022 · Fixed in 15.1.5, 15.2.3, 15.3.1 · NVD
  25. Critical 9.9

    CVE-2022-2884 · GitLab

    A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint

    Published 17 Oct 2022 · Fixed in 15.1.5, 15.2.3, 15.3.1 · NVD
  26. Medium 4.8

    CVE-2022-2865 · GitLab

    A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 and 15.3 prior to 15.3.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  27. Medium 4.3

    CVE-2022-2630 · GitLab

    An improper access control issue in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosure of confidential information via the Incident timeline events.

    Published 17 Oct 2022 · Fixed in 15.2.4, 15.3.2 · NVD
  28. Medium 6.5

    CVE-2022-2592 · GitLab

    A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prior to 15.3.2 allows an authenticated attacker to create a maliciously large Snippet which when requested with or without authentication places excessive load on the server, potential leading to Denial of Service.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  29. High 7.4

    CVE-2022-2533 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it…

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  30. High 8.0

    CVE-2022-2527 · GitLab

    An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2.which allowed an authenticated attacker to inject arbitrary content. A victim interacting with this content could lead to arbitrary requests.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  31. Medium 6.5

    CVE-2022-2455 · GitLab

    A business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2 allowed an authenticated and authorized user to exhaust server resources by importing a malicious project.

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  32. High 7.3

    CVE-2022-2428 · GitLab

    A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests

    Published 17 Oct 2022 · Fixed in 15.1.6, 15.2.4, 15.3.2 · NVD
  33. Medium 5.4

    CVE-2022-35698 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.

    Published 14 Oct 2022 · Fixed in 2.4.4 · NVD
  34. Medium 5.3

    CVE-2022-35689 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

    Published 14 Oct 2022 · Fixed in 2.4.4 · NVD
  35. High 7.8

    CVE-2022-41032 · .NET

    NuGet Client Elevation of Privilege Vulnerability

    Published 11 Oct 2022 · NVD
  36. High 7.5

    CVE-2022-3358 · OpenSSL

    OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5 incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(),…

    Published 11 Oct 2022 · Fixed in 3.0.6 · NVD
  37. Unrated

    WPV-bd4a99229dee · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 3 Oct 2022 · Fixed in 1.9 · WPVulnerability
  38. Unrated

    WPV-7527085ff0d4 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 3 Oct 2022 · Fixed in 1.9 · WPVulnerability
  39. Medium 4.3

    CVE-2022-39232 · Discourse

    Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete quotes won't break the app. As a workaround, the quote can be fixed via the rails console.

    Published 29 Sept 2022 · NVD
  40. Medium 4.3

    CVE-2022-39226 · Discourse

    Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a malicious actor can add large payloads of text into the Location and Website fields of a user profile, which causes issues for other users when loading that profile. A fix to limit the length of user input for these fields is…

    Published 29 Sept 2022 · Fixed in 2.8.9 · NVD
  41. Medium 4.3

    CVE-2022-36068 · Discourse

    Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed`…

    Published 29 Sept 2022 · Fixed in 2.8.9 · NVD
  42. High 7.2

    CVE-2022-36066 · Discourse

    Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on…

    Published 29 Sept 2022 · Fixed in 2.8.9 · NVD
  43. Medium 6.5

    CVE-2021-42049 · MediaWiki

    An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages where they suppressed information (such as PII). This allows oversighters to whitewash revisions.

    Published 29 Sept 2022 · NVD
  44. Medium 4.8

    CVE-2021-42048 · MediaWiki

    An issue was discovered in the Growth extension in MediaWiki through 1.36.2. Any admin can add arbitrary JavaScript code to the Newcomer home page footer, which can be executed by viewers with zero edits.

    Published 29 Sept 2022 · NVD
  45. Medium 5.4

    CVE-2021-42047 · MediaWiki

    An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard feature enabled, users can login with a mentor account and trigger an XSS payload (such as alert) via Growthexperiments-mentor-dashboard-mentee-overview-no-js-fallback.

    Published 29 Sept 2022 · NVD
  46. Medium 6.1

    CVE-2021-42046 · MediaWiki

    An issue was discovered in the GlobalWatchlist extension in MediaWiki through 1.36.2. The rev-deleted-user and ntimes messages were not properly escaped and allowed for users to inject HTML and JavaScript.

    Published 29 Sept 2022 · NVD
  47. Medium 5.4

    CVE-2021-42045 · MediaWiki

    An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote.

    Published 29 Sept 2022 · NVD
  48. Critical 9.8

    CVE-2016-2338 · Ruby

    An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

    Published 29 Sept 2022 · NVD
  49. Medium 6.5

    CVE-2022-31629 · PHP

    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

    Published 28 Sept 2022 · Fixed in 7.4.31, 8.0.24, 8.1.11 · NVD
  50. Medium 5.5

    CVE-2022-31628 · PHP

    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

    Published 28 Sept 2022 · Fixed in 7.4.31, 8.0.24, 8.1.11 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.