UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
235
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Low 3.7

    CVE-2021-43980 · Apache Tomcat

    The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or…

    Published 28 Sept 2022 · NVD
  2. Low 3.7

    CVE-2022-35252 · curl

    When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

    Published 23 Sept 2022 · Fixed in 7.85.0 · NVD
  3. Critical 9.8

    CVE-2022-35951 · Redis

    Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an `XAUTOCLAIM` command on a stream key in a specific state, with a specially crafted `COUNT` argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This has been patched in Redis version 7.0.5.…

    Published 23 Sept 2022 · Fixed in 7.0.5 · NVD
  4. Critical 9.8

    CVE-2022-37026 · Erlang/OTP

    In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.

    Published 21 Sept 2022 · Fixed in 23.3.4.15, 24.3.4.2, 25.0.2 · NVD
  5. High 7.5

    CVE-2022-28204 · MediaWiki

    A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere&target=Property%3AP31&namespace=1&invert=1 can take more than thirty seconds. There is a DDoS risk.

    Published 19 Sept 2022 · Fixed in 1.37.2 · NVD
  6. High 7.5

    CVE-2022-28203 · MediaWiki

    A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.

    Published 19 Sept 2022 · Fixed in 1.35.6, 1.36.4, 1.37.2 · NVD
  7. Medium 4.4

    CVE-2022-28201 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinite recursion, because a bare local interwiki is mishandled for the mainpage message.

    Published 19 Sept 2022 · Fixed in 1.35.6, 1.36.4, 1.37.2 · NVD
  8. Unrated

    WPV-89669cfe12e4 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 19 Sept 2022 · Fixed in 1.7.5.5 · WPVulnerability
  9. Unrated

    WPV-2c98b88dfcab · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 19 Sept 2022 · Fixed in 1.7.5.5 · WPVulnerability
  10. Medium 5.3

    CVE-2022-39211 · Nextcloud

    Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue.

    Published 16 Sept 2022 · Fixed in 23.0.8, 24.0.4 · NVD
  11. High 7.5

    CVE-2022-36074 · Nextcloud

    Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade. This can lead to account access exposure and compromise. It is recommended that the Nextcloud Server is upgraded to 23.0.7 or 24.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded…

    Published 15 Sept 2022 · Fixed in 23.0.7, 24.0.3 · NVD
  12. High 7.5

    CVE-2022-38013 · .NET

    .NET Core and Visual Studio Denial of Service Vulnerability

    Published 13 Sept 2022 · NVD
  13. High 7.5

    CVE-2020-10735 · Python

    A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

    Published 9 Sept 2022 · Fixed in 3.8.14, 3.9.14, 3.10.7 · NVD
  14. Medium 6.3

    CVE-2022-36109 · Docker Engine

    Security vulnerability relating to supplementary group permissions

    Published 9 Sept 2022 · Fixed in 20.10.18 · NVD, Project advisories (GitHub)
  15. Medium 4.8

    CVE-2022-3144 · Wordfence Security

    Wordfence Security – Firewall, Malware Scan, and Login Security: Cross-site Scripting

    Published 6 Sept 2022 · Fixed in 7.6.1 · NVD, WPVulnerability
  16. Medium 5.4

    CVE-2022-38093 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Cross-Site Request Forgery (CSRF)

    Published 5 Sept 2022 · Fixed in 4.2.4 · WPVulnerability
  17. High 7.2

    CVE-2022-37458 · Discourse

    Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate.

    Published 2 Sept 2022 · NVD
  18. Medium 4.9

    CVE-2022-39194 · MediaWiki

    An issue was discovered in the MediaWiki through 1.38.2. The community configuration pages for the GrowthExperiments extension could cause a site to become unavailable due to insufficient validation when certain actions (including page moves) were performed.

    Published 2 Sept 2022 · NVD
  19. High 8.8

    CVE-2022-1552 · PostgreSQL

    A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary…

    Published 31 Aug 2022 · Fixed in 12.11, 13.7, 14.3 · NVD
  20. Medium 5.3

    CVE-2022-27911 · Joomla!

    An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing '_JEXEC or die check' caused by the PSR12 changes.

    Published 31 Aug 2022 · NVD
  21. Medium 5.5

    CVE-2022-38791 · MariaDB

    In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock.

    Published 27 Aug 2022 · Fixed in 10.6.9, 10.7.5, 10.8.4 · NVD
  22. Medium 5.9

    CVE-2021-43767 · PostgreSQL

    Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication with a 'clientcert' requirement or to use 'cert' authentication, a man-in-the-middle attacker can inject false responses to the client's first few queries. Despite the use of SSL certificate verification and encryption, Odyssey will pass…

    Published 25 Aug 2022 · Fixed in 11.14, 12.9, 13.5 · NVD
  23. Medium 5.3

    CVE-2021-4189 · Python

    A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning…

    Published 24 Aug 2022 · Fixed in 3.7.11, 3.8.9, 3.9.3 · NVD
  24. High 7.4

    CVE-2021-28861 · Python

    Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

    Published 23 Aug 2022 · Fixed in 3.8.14, 3.9.14, 3.10.6 · NVD
  25. Medium 5.3

    CVE-2022-35692 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to leak minor information of another user's account detials. Exploitation of this issue does not require user interaction.

    Published 19 Aug 2022 · Fixed in 2.4.4 · NVD
  26. High 8.0

    CVE-2022-2625 · PostgreSQL

    A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw…

    Published 18 Aug 2022 · Fixed in 12.12, 13.8, 14.5 · NVD
  27. Medium 5.3

    CVE-2022-34259 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

    Published 16 Aug 2022 · Fixed in 2.3.7, 2.4.3 · NVD
  28. Medium 4.8

    CVE-2022-34258 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 16 Aug 2022 · Fixed in 2.3.7, 2.4.3 · NVD
  29. Medium 6.1

    CVE-2022-34257 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 16 Aug 2022 · Fixed in 2.3.7, 2.4.3 · NVD
  30. Critical 9.8

    CVE-2022-34256 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to access other user's data. Exploitation of this issue does not require user interaction.

    Published 16 Aug 2022 · Fixed in 2.3.7, 2.4.3 · NVD
  31. High 8.8

    CVE-2022-34255 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in Privilege escalation. An attacker with a low privilege account could leverage this vulnerability to perform an account takeover for a victim. Exploitation of this issue does not require user interaction.

    Published 16 Aug 2022 · Fixed in 2.3.7, 2.4.3 · NVD
  32. High 8.8

    CVE-2022-34254 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could be abused by an attacker to inject malicious scripts into the vulnerable endpoint. A low privileged attacker could leverage this vulnerability to read local files and to perform…

    Published 16 Aug 2022 · Fixed in 2.3.7, 2.4.3 · NVD
  33. High 7.2

    CVE-2022-34253 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction.

    Published 16 Aug 2022 · Fixed in 2.3.7, 2.4.3 · NVD
  34. Medium 6.8

    CVE-2022-36376 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Server-Side Request Forgery (SSRF)

    Published 12 Aug 2022 · Fixed in 1.0.95.1 · WPVulnerability
  35. Medium 5.9

    CVE-2022-34716 · .NET

    .NET Spoofing Vulnerability

    Published 9 Aug 2022 · Fixed in 6.0.8 · NVD
  36. Medium 5.3

    CVE-2022-2539 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.6 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1, allowed a project member to filter issues by contact and organization.

    Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD
  37. Medium 5.3

    CVE-2022-2534 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was returning contributor emails due to improper data handling in the Datadog integration.

    Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD
  38. Medium 5.3

    CVE-2022-2531 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was not performing correct authentication on Grafana API under specific conditions allowing unauthenticated users to perform queries through a path traversal vulnerability.

    Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD
  39. Medium 6.5

    CVE-2022-2512 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. Membership changes are not reflected in TODO for confidential notes, allowing a former project members to read updates via TODOs.

    Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD
  40. High 7.5

    CVE-2022-2501 · GitLab

    An improper access control issue in GitLab EE affecting all versions from 12.0 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an attacker to bypass IP allow-listing and download artifacts. This attack only bypasses IP allow-listing, proper permissions are still required.

    Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD
  41. Medium 5.4

    CVE-2022-2500 · GitLab

    A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1. A stored XSS flaw in job error messages allows attackers to perform arbitrary actions on behalf of victims at client side.

    Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD
  42. Medium 4.3

    CVE-2022-2499 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 13.10 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab's Jira integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Jira issues.

    Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD
  43. High 7.5

    CVE-2022-2498 · GitLab

    An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 triggered new pipelines with the person who created the tag as the pipeline creator instead of the subscription's author.

    Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD
  44. Medium 6.4

    CVE-2022-2497 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. A malicious developer could exfiltrate an integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server.

    Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD
  45. Low 2.7

    CVE-2022-2459 · GitLab

    An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for email invited members to join a project even after the Group Owner has enabled the setting to prevent members from being added to projects in a group, if the invite was sent before the setting was…

    Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD
  46. Low 2.7

    CVE-2022-2456 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for malicious group or project maintainers to change their corresponding group or project visibility by crafting a malicious POST request.

    Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD
  47. Medium 4.5

    CVE-2022-2417 · GitLab

    Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an authenticated and authorised user to import a project that includes branch names which are 40 hexadecimal characters, which could be abused in supply chain attacks where a victim pinned to a specific Git commit of the project.

    Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD
  48. High 8.1

    CVE-2022-2326 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible to gain access to a private project through an email invite by using other user's email address as an unverified secondary email.

    Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD
  49. Low 3.8

    CVE-2022-2307 · GitLab

    A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted, though the APIs usable by that token are limited.

    Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD
  50. Medium 4.3

    CVE-2022-2303 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement enabled at the group level by using Resource Owner Password Credentials grant to obtain an access token without using 2FA.

    Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.