UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
235
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Critical 9.1

    CVE-2022-28615 · Apache HTTP Server

    Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.

    Published 9 Jun 2022 · Fixed in 2.4.54 · NVD
  2. Medium 5.3

    CVE-2022-28614 · Apache HTTP Server

    The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be…

    Published 9 Jun 2022 · NVD
  3. Medium 5.3

    CVE-2022-28330 · Apache HTTP Server

    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.

    Published 9 Jun 2022 · NVD
  4. High 7.5

    CVE-2022-26377 · Apache HTTP Server

    Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.

    Published 9 Jun 2022 · Fixed in 2.4.54 · NVD
  5. Medium 5.3

    CVE-2022-31025 · Discourse

    Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the `stable` branch and 2.9.0beta5 on the `beta` and `tests-passed` branches, inviting users on sites that use single sign-on could bypass the `must_approve_users` check and invites by staff are always approved automatically. The issue is patched in Discourse version 2.8.4 on the `stable` branch and version…

    Published 7 Jun 2022 · Fixed in 2.8.4 · NVD
  6. High 7.5

    CVE-2022-23712 · Elasticsearch

    A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.

    Published 6 Jun 2022 · Fixed in 8.2.1 · NVD
  7. High 8.8

    CVE-2022-1680 · GitLab

    An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature (available only on Premium+ subscriptions) may allow any owner of a Premium group to invite arbitrary users through their username…

    Published 6 Jun 2022 · Fixed in 14.9.5, 14.10.4 · NVD
  8. High 7.1

    CVE-2022-1944 · GitLab

    When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows users with the Developer role to open terminals on other Developers' running jobs

    Published 6 Jun 2022 · Fixed in 14.9.5, 14.10.4 · NVD
  9. Medium 5.4

    CVE-2022-1940 · GitLab

    A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf via specially crafted Jira Issues

    Published 6 Jun 2022 · Fixed in 14.9.5, 14.10.4 · NVD
  10. Medium 6.5

    CVE-2022-1936 · GitLab

    Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Deploy Token to misuse it from any location even when IP address restrictions were configured

    Published 6 Jun 2022 · Fixed in 14.9.5, 14.10.4 · NVD
  11. Medium 6.5

    CVE-2022-1935 · GitLab

    Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Trigger Token to misuse it from any location even when IP address restrictions were configured

    Published 6 Jun 2022 · Fixed in 14.9.5, 14.10.4 · NVD
  12. Medium 4.3

    CVE-2022-1821 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. It may be possible for a subgroup member to access the members list of their parent group.

    Published 6 Jun 2022 · Fixed in 14.9.5, 14.10.4 · NVD
  13. Low 2.7

    CVE-2022-1783 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. It may be possible for malicious group maintainers to add new members to a project within their group, through the REST API, even after their group owner enabled a setting to prevent members from…

    Published 6 Jun 2022 · Fixed in 14.9.5, 14.10.4 · NVD
  14. Critical 9.8Actively exploited

    CVE-2022-26134 · Confluence

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before…

    Published 3 Jun 2022 · Fixed in 7.15.2, 7.16.4, 7.17.4 · NVD
  15. Medium 6.1

    CVE-2022-29718 · github.com/caddyserver/caddy, Caddy

    Open redirect in caddy

    Published 3 Jun 2022 · Fixed in 2.5.0 · OSV.dev and GitHub
  16. Medium 4.3

    CVE-2022-30115 · curl

    Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in…

    Published 2 Jun 2022 · Fixed in 7.83.1 · NVD
  17. High 7.5

    CVE-2022-27782 · curl

    libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.

    Published 2 Jun 2022 · Fixed in 7.83.1 · NVD
  18. High 7.5

    CVE-2022-27781 · curl

    libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

    Published 2 Jun 2022 · Fixed in 7.83.1 · NVD
  19. High 7.5

    CVE-2022-27780 · curl

    The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and…

    Published 2 Jun 2022 · Fixed in 7.83.1 · NVD
  20. Medium 5.3

    CVE-2022-27779 · curl

    libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check…

    Published 2 Jun 2022 · Fixed in 7.83.1 · NVD
  21. High 8.1

    CVE-2022-27778 · curl, MySQL

    A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.

    Published 2 Jun 2022 · NVD
  22. Medium 6.5

    CVE-2022-27776 · curl

    A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.

    Published 2 Jun 2022 · Fixed in 7.83.0 · NVD
  23. High 7.5

    CVE-2022-27775 · curl

    An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.

    Published 2 Jun 2022 · NVD
  24. Medium 5.7

    CVE-2022-27774 · curl

    An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

    Published 2 Jun 2022 · NVD
  25. Medium 4.3

    CVE-2022-29243 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are…

    Published 31 May 2022 · Fixed in 22.2.7, 23.0.4 · NVD
  26. High 8.1

    CVE-2022-22576 · curl

    An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

    Published 26 May 2022 · Fixed in 7.83.0 · NVD
  27. Medium 5.5

    CVE-2022-31624 · MariaDB

    MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c method log_statement_ex, the held lock lock_bigbuffer is not released correctly, which allows local users to trigger a denial of service due to the deadlock.

    Published 25 May 2022 · Fixed in 10.4.22, 10.5.13, 10.6.5 · NVD
  28. Medium 5.5

    CVE-2022-31623 · MariaDB

    MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (i.e., going to the err label) while executing the method create_worker_threads, the held lock thd->ctrl_mutex is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug…

    Published 25 May 2022 · Fixed in 10.5.14, 10.6.6, 10.7.2 · NVD
  29. Medium 5.5

    CVE-2022-31622 · MariaDB

    MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (pthread_create returns a nonzero value) while executing the method create_worker_threads, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not…

    Published 25 May 2022 · Fixed in 10.5.14, 10.6.6, 10.7.2 · NVD
  30. Medium 5.5

    CVE-2022-31621 · MariaDB

    MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability…

    Published 25 May 2022 · Fixed in 10.4.22, 10.5.13, 10.6.5 · NVD
  31. Medium 4.3

    CVE-2022-29163 · Nextcloud

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Versions 22.2.6 and 23.0.3 contain a patch for this issue. There are currently no known workarounds.

    Published 20 May 2022 · Fixed in 22.2.6, 23.0.3 · NVD
  32. High 8.8

    CVE-2022-1423 · GitLab

    Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows a malicious actor with Developer privileges to perform cache poisoning leading to arbitrary code execution in protected branches

    Published 19 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  33. Medium 5.4

    CVE-2022-1416 · GitLab

    Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling

    Published 19 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  34. High 7.5

    CVE-2022-1413 · GitLab

    Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 causes potentially sensitive integration properties to be disclosed in the web interface

    Published 19 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  35. High 8.6

    CVE-2022-25762 · Apache Tomcat

    If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result…

    Published 13 May 2022 · Fixed in 8.5.76, 9.0.21 · NVD
  36. High 7.5

    CVE-2022-29885 · Apache Tomcat

    The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running…

    Published 12 May 2022 · NVD
  37. Medium 4.3

    CVE-2022-1545 · GitLab

    It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note.

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  38. High 7.5

    CVE-2022-1510 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious text in the CI Editor and CI Pipeline details page allowing the attacker to cause uncontrolled resource consumption.

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  39. Medium 4.9

    CVE-2022-1460 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not performing correct authorizations on scheduled pipelines allowing a malicious user to run a pipeline in the context of another user.

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  40. Medium 6.1

    CVE-2022-1433 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 14.4 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. Missing invalidation of Markdown caching causes potential payloads from a previously exploitable XSS vulnerability (CVE-2022-1175) to persist and execute.

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  41. Medium 4.3

    CVE-2022-1428 · GitLab

    An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was incorrectly verifying throttling limits for authenticated package requests which resulted in limits not being enforced.

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  42. Low 3.7

    CVE-2022-1426 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly authenticating a user that had some certain amount of information which allowed an user to authenticate without a personal access token.

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  43. Medium 6.5

    CVE-2022-1406 · GitLab

    Improper input validation in GitLab CE/EE affecting all versions from 8.12 prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0 allows a Developer to read protected Group or Project CI/CD variables by importing a malicious project

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  44. Medium 5.3

    CVE-2022-1352 · GitLab

    Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1, an endpoint may reveal the issue title to a user who crafted an API call with the ID of the issue from a public project that restricts access to issue only to project members.

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  45. Medium 4.3

    CVE-2022-1124 · GitLab

    An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0, allowing Guest project members to access trace log of jobs when it is enabled

    Published 11 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  46. High 7.5

    CVE-2022-29145 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 10 May 2022 · NVD
  47. High 7.5

    CVE-2022-29117 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 10 May 2022 · NVD
  48. High 7.5

    CVE-2022-23267 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 10 May 2022 · NVD
  49. Medium 5.3

    CVE-2022-1431 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious requests to the PyPi API endpoint allowing the attacker to cause uncontrolled resource consumption.

    Published 10 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD
  50. Medium 4.3

    CVE-2022-1417 · GitLab

    Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9.4, and all versions starting from 14.10 before 14.10.1 allows non-project members to access contents of Project Members-only Wikis via malicious CI jobs

    Published 10 May 2022 · Fixed in 14.8.6, 14.9.4 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.