UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
235
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Medium 6.1

    CVE-2022-34912 · MediaWiki

    An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped.

    Published 2 Jul 2022 · Fixed in 1.37.3 · NVD
  2. Medium 6.1

    CVE-2022-34911 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is not escaped: SpecialCreateAccount::successfulAction() calls ::showSuccessPage() with a message as…

    Published 2 Jul 2022 · Fixed in 1.35.7, 1.37.3 · NVD
  3. High 7.5

    CVE-2022-32091 · MariaDB

    MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc.

    Published 1 Jul 2022 · Fixed in 10.7.5, 10.8.4, 10.9.2 · NVD
  4. High 7.5

    CVE-2022-32089 · MariaDB

    MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.

    Published 1 Jul 2022 · Fixed in 10.7.5, 10.8.4, 10.9.2 · NVD
  5. High 7.5

    CVE-2022-32088 · MariaDB

    MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort.

    Published 1 Jul 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  6. High 7.5

    CVE-2022-32087 · MariaDB

    MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args.

    Published 1 Jul 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  7. High 7.5

    CVE-2022-32086 · MariaDB

    MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field.

    Published 1 Jul 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  8. High 7.5

    CVE-2022-32085 · MariaDB

    MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor.

    Published 1 Jul 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  9. High 7.5

    CVE-2022-32084 · MariaDB

    MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.

    Published 1 Jul 2022 · Fixed in 10.7.5, 10.8.4, 10.9.2 · NVD
  10. High 7.5

    CVE-2022-32083 · MariaDB

    MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker.

    Published 1 Jul 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  11. High 7.5

    CVE-2022-32082 · MariaDB

    MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.

    Published 1 Jul 2022 · Fixed in 10.7.5, 10.8.4, 10.9.2 · NVD
  12. High 7.5

    CVE-2022-32081 · MariaDB

    MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc.

    Published 1 Jul 2022 · Fixed in 10.7.5, 10.8.4, 10.9.2 · NVD
  13. Medium 5.3

    CVE-2022-1954 · GitLab

    A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to make a GitLab instance inaccessible via specially crafted web server response headers

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  14. Medium 6.1

    CVE-2022-0167 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not disabling the Autocomplete attribute of fields related to sensitive information making it possible to be retrieved under certain conditions.

    Published 1 Jul 2022 · Fixed in 14.4.5, 14.5.3, 14.6.2 · NVD
  15. Medium 5.3

    CVE-2022-2270 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions starting from 15.1 before 15.1.1. GitLab was leaking Conan packages names due to incorrect permissions verification.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  16. High 7.5

    CVE-2022-2229 · GitLab

    An improper authorization issue in GitLab CE/EE affecting all versions from 13.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to extract the value of an unprotected variable they know the name of in public projects or private projects they're a member of.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  17. Medium 6.5

    CVE-2022-2228 · GitLab

    Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker with the appropriate access tokens to obtain CI variables in a group with using IP-based access restrictions even if the GitLab Runner is calling from outside the allowed IP range

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  18. Medium 5.3

    CVE-2022-1999 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. Under certain conditions, using the REST API an unprivileged user was able to change labels description.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  19. Low 2.7

    CVE-2022-1981 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. In GitLab, if a group enables the setting to restrict access to users belonging to specific domains, that allow-list may be bypassed if a Maintainer uses the 'Invite a group' feature to invite a group that has members that don't comply with domain…

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  20. Medium 5.3

    CVE-2022-1963 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions starting from 15.1 before 15.1.1. GitLab reveals if a user has enabled two-factor authentication on their account in the HTML source, to unauthenticated users.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  21. Medium 5.3

    CVE-2022-2281 · GitLab

    An information disclosure vulnerability in GitLab EE affecting all versions from 12.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows disclosure of release titles if group milestones are associated with any project releases.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  22. Medium 6.1

    CVE-2022-2250 · GitLab

    An open redirect vulnerability in GitLab EE/CE affecting all versions from 11.1 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to redirect users to an arbitrary location if they trust the URL.

    Published 1 Jul 2022 · Fixed in 14.0.5, 14.10.5, 15.0.4 · NVD
  23. Medium 4.3

    CVE-2022-2244 · GitLab

    An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows project memebers with reporter role to manage issues in project's error tracking feature.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  24. Medium 4.3

    CVE-2022-2243 · GitLab

    An access control vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows authenticated users to enumerate issues in non-linked sentry projects.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  25. Medium 5.4

    CVE-2022-2235 · GitLab

    Insufficient sanitization in GitLab EE's external issue tracker affecting all versions from 14.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to perform cross-site scripting when a victim clicks on a maliciously crafted ZenTao link

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  26. Medium 4.8

    CVE-2022-2230 · GitLab

    A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  27. Medium 4.3

    CVE-2022-2227 · GitLab

    Improper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows a previous maintainer of a project with a specific runner to access job and project meta data under certain conditions

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  28. High 8.8

    CVE-2022-2185 · GitLab

    A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  29. Medium 4.3

    CVE-2022-1983 · GitLab

    Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker already in possession of a valid Deploy Key or a Deploy Token to misuse it from any location to access Container Registries even when IP address restrictions were configured.

    Published 1 Jul 2022 · Fixed in 14.10.5, 15.0.4 · NVD
  30. Critical 9.8

    CVE-2022-2274 · OpenSSL

    The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the…

    Published 1 Jul 2022 · NVD
  31. High 7.5

    CVE-2022-34750 · MediaWiki

    An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of-service attack vectors within the Wikibase and WikibaseLexeme extensions. This is related to Special:NewLexeme and Special:NewProperty.

    Published 28 Jun 2022 · NVD
  32. Medium 5.7

    CVE-2022-31096 · Discourse

    Discourse is an open source discussion platform. Under certain conditions, a logged in user can redeem an invite with an email that either doesn't match the invite's email or does not adhere to the email domain restriction of an invite link. The impact of this flaw is aggravated when the invite has been configured to add the user that accepts the invite into restricted groups. Once a user has…

    Published 27 Jun 2022 · NVD
  33. Medium 6.1

    CVE-2022-2090 · Woo Discount Rules (WordPress plugin)

    Discount Rules for WooCommerce: Cross-site Scripting

    Published 27 Jun 2022 · Fixed in 2.4.2 · WPVulnerability
  34. High 7.5

    CVE-2022-33105 · Redis

    Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID.

    Published 23 Jun 2022 · NVD
  35. Medium 6.1

    CVE-2022-34305 · Apache Tomcat

    In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.

    Published 23 Jun 2022 · NVD
  36. High 7.3

    CVE-2022-2068 · OpenSSL

    In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly…

    Published 21 Jun 2022 · Fixed in 1.0.2zf, 1.1.1p, 3.0.4 · NVD
  37. High 7.7

    CVE-2022-31090 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 20 Jun 2022 · Fixed in 2.2.3 · WPVulnerability
  38. Medium 4.8

    CVE-2022-2099 · WooCommerce

    WooCommerce: Improper Encoding or Escaping of Output

    Published 20 Jun 2022 · Fixed in 6.6.0 · NVD, WPVulnerability
  39. High 7.8

    CVE-2017-20052 · Python

    A vulnerability classified as problematic was found in Python 2.7.13. This vulnerability affects unknown code of the component pgAdmin4. The manipulation leads to uncontrolled search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

    Published 16 Jun 2022 · NVD
  40. High 8.8

    CVE-2022-31626 · PHP

    In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.

    Published 16 Jun 2022 · Fixed in 7.4.30, 8.0.20, 8.1.7 · NVD
  41. High 8.1

    CVE-2022-31625 · PHP

    In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.

    Published 16 Jun 2022 · Fixed in 7.4.30, 8.0.20, 8.1.7 · NVD
  42. Medium 5.5

    CVE-2022-30184 · .NET

    .NET and Visual Studio Information Disclosure Vulnerability

    Published 15 Jun 2022 · NVD
  43. Medium 5.3

    CVE-2022-31060 · Discourse

    Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches of Discourse. As a workaround, one may disable…

    Published 14 Jun 2022 · Fixed in 2.8.4 · NVD
  44. Unrated

    WPV-c5e3a8961a8a · Flexible Shipping (WordPress plugin)

    Vulnerability in Weight Based Shipping Table Rate for WooCommerce – Flexible Shipping

    Published 14 Jun 2022 · Fixed in 4.11.9 · WPVulnerability
  45. Unrated

    WPV-a5039dad8eaf · Flexible Shipping (WordPress plugin)

    Vulnerability in Weight Based Shipping Table Rate for WooCommerce – Flexible Shipping

    Published 14 Jun 2022 · Fixed in 4.11.9 · WPVulnerability
  46. Medium 6.1

    CVE-2022-29455 · Elementor

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 13 Jun 2022 · Fixed in 3.5.6 · NVD, WPVulnerability
  47. Critical 9.8

    CVE-2022-31813 · Apache HTTP Server

    Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.

    Published 9 Jun 2022 · Fixed in 2.4.54 · NVD
  48. High 7.5

    CVE-2022-30556 · Apache HTTP Server

    Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.

    Published 9 Jun 2022 · Fixed in 2.4.54 · NVD
  49. High 7.5

    CVE-2022-30522 · Apache HTTP Server

    If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.

    Published 9 Jun 2022 · NVD
  50. High 7.5

    CVE-2022-29404 · Apache HTTP Server

    In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.

    Published 9 Jun 2022 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.