UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
234
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Medium 4.9

    CVE-2022-21413 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 19 Apr 2022 · NVD
  2. Medium 4.9

    CVE-2022-21412 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 19 Apr 2022 · NVD
  3. Medium 5.3

    CVE-2022-27652 · Docker Engine

    A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when…

    Published 18 Apr 2022 · Fixed in 20.10.14 · NVD
  4. Medium 6.5

    CVE-2011-1762 · WordPress

    A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission.

    Published 18 Apr 2022 · Fixed in 3.0.6, 3.1.2 · NVD
  5. Medium 4.3

    CVE-2022-24850 · Discourse

    Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has access to the category. As a result, a normal user is able to see whether a group has read/write permissions in the category even though the information should only be available to the users that can manage a category. This issue is patched in the latest stable,…

    Published 14 Apr 2022 · Fixed in 2.8.2 · NVD
  6. Medium 5.3

    CVE-2022-24824 · Discourse

    Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown the crawler view of the site instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. There are no known…

    Published 14 Apr 2022 · Fixed in 2.8.3 · NVD
  7. High 7.5

    CVE-2022-27457 · MariaDB

    MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  8. High 7.5

    CVE-2022-27456 · MariaDB

    MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  9. High 7.5

    CVE-2022-27455 · MariaDB

    MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  10. High 7.5

    CVE-2022-27452 · MariaDB

    MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  11. High 7.5

    CVE-2022-27451 · MariaDB

    MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  12. High 7.5

    CVE-2022-27449 · MariaDB

    MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  13. High 7.5

    CVE-2022-27448 · MariaDB

    There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  14. High 7.5

    CVE-2022-27447 · MariaDB

    MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  15. High 7.5

    CVE-2022-27446 · MariaDB

    MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  16. High 7.5

    CVE-2022-27445 · MariaDB

    MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  17. High 7.5

    CVE-2022-27444 · MariaDB

    MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc.

    Published 14 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  18. High 7.6

    CVE-2015-20107 · Python

    In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

    Published 13 Apr 2022 · Fixed in 3.10.8 · NVD
  19. High 8.8

    CVE-2022-1329 · Elementor

    Elementor Website Builder – more than just a page builder: Unrestricted Upload of File with Dangerous Type

    Published 13 Apr 2022 · NVD, WPVulnerability
  20. High 7.5

    CVE-2022-27387 · MariaDB

    MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  21. High 7.5

    CVE-2022-27386 · MariaDB

    MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  22. High 7.5

    CVE-2022-27385 · MariaDB

    An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.4.22, 10.5.13, 10.6.5 · NVD
  23. High 7.5

    CVE-2022-27384 · MariaDB

    An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.6.8, 10.7.4, 10.8.3 · NVD
  24. High 7.5

    CVE-2022-27383 · MariaDB

    MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.6.8, 10.7.4, 10.8.3 · NVD
  25. High 7.5

    CVE-2022-27382 · MariaDB

    MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  26. High 7.5

    CVE-2022-27381 · MariaDB

    An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  27. High 7.5

    CVE-2022-27380 · MariaDB

    An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  28. High 7.5

    CVE-2022-27379 · MariaDB

    An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  29. High 7.5

    CVE-2022-27378 · MariaDB

    An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.6.8, 10.7.4, 10.8.3 · NVD
  30. High 7.5

    CVE-2022-27377 · MariaDB

    MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  31. High 7.5

    CVE-2022-27376 · MariaDB

    MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements.

    Published 12 Apr 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  32. High 7.5

    CVE-2021-32040 · MongoDB

    It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB Server v4.4 versions prior to and including 4.4.28,…

    Published 12 Apr 2022 · Fixed in 4.2.16, 4.4.11, 5.0.4 · NVD
  33. Medium 5.3

    CVE-2022-24804 · Discourse

    Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups. When a group with restricted visibility has been used to set the permissions of a category, the name of the group is leaked to any user that is able to see the category. To workaround the problem, a site administrator can remove groups…

    Published 11 Apr 2022 · Fixed in 2.8.3 · NVD
  34. Medium 4.3

    CVE-2022-1193 · GitLab

    Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain circumstances

    Published 11 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  35. Low 2.4

    CVE-2022-1157 · GitLab

    Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potential sensitive values in invalid URLs to be logged

    Published 11 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  36. Unrated

    WPV-f53e350e5e88 · WooCommerce

    Vulnerability in WooCommerce

    Published 10 Apr 2022 · Fixed in 5.7.0 · WPVulnerability
  37. High 8.8

    CVE-2021-39114 · Confluence

    Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.

    Published 5 Apr 2022 · Fixed in 7.4.11, 7.11.6, 7.12.5 · NVD
  38. Medium 5.4

    CVE-2022-1190 · GitLab

    Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  39. Medium 4.3

    CVE-2022-1189 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 that allowed for an unauthorised user to read the the approval rules of a private project.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  40. Medium 5.3

    CVE-2022-1188 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 where a blind SSRF attack through the repository mirroring feature was possible.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  41. Medium 6.5

    CVE-2022-1185 · GitLab

    A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to crash the GitLab web application with a maliciously crafted RDoc file

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  42. Medium 6.1

    CVE-2022-1175 · GitLab

    Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  43. High 7.5

    CVE-2022-1174 · GitLab

    A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to trigger high CPU usage via a special crafted input added in Issues, Merge requests, Milestones, Snippets, Wiki pages, etc.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  44. Critical 9.8

    CVE-2022-1162 · GitLab

    A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  45. Medium 6.5

    CVE-2022-1148 · GitLab

    Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to steal a user's access token on an attacker-controlled private GitLab Pages website and reuse that token on the victim's other private websites

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  46. Medium 5.3

    CVE-2022-1121 · GitLab

    A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to cause unlimited resource consumption.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  47. Medium 6.5

    CVE-2022-1120 · GitLab

    Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  48. Low 2.7

    CVE-2022-1111 · GitLab

    A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 under certain conditions caused imported projects to show an incorrect user in the 'Access Granted' column in the project membership pages

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  49. Medium 4.3

    CVE-2022-1105 · GitLab

    An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  50. Medium 4.3

    CVE-2022-1100 · GitLab

    A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9.2. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.