UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
233
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Medium 4.3

    CVE-2022-1099 · GitLab

    Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to impact the performance of GitLab

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  2. Medium 4.3

    CVE-2022-0740 · GitLab

    Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting from version 7.8.0 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 makes it possible to close Asana tasks from unrestricted branches.

    Published 4 Apr 2022 · Fixed in 14.7.7, 14.8.5, 14.9.2 · NVD
  3. High 7.5

    CVE-2022-0741 · GitLab

    Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables via specially crafted email addresses.

    Published 1 Apr 2022 · Fixed in 14.6.5, 14.7.4, 14.8.2 · NVD
  4. Medium 5.7

    CVE-2022-0489 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a DOS by using the math feature with a specific formula in issue comments.

    Published 1 Apr 2022 · Fixed in 14.6.5, 14.8.2 · NVD
  5. High 7.6

    CVE-2022-0425 · GitLab

    A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery (SSRF) attacks.

    Published 1 Apr 2022 · NVD
  6. Medium 4.3

    CVE-2022-0390 · GitLab

    Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retrieve issue details when it was linked to an item from the vulnerability dashboard.

    Published 1 Apr 2022 · NVD
  7. Medium 4.3

    CVE-2022-0373 · GitLab

    Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk email address

    Published 1 Apr 2022 · Fixed in 14.7.1 · NVD
  8. High 7.5

    CVE-2021-39908 · GitLab

    In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 certain Unicode characters can be abused to commit malicious code into projects without being noticed in merge request or source code viewer UI.

    Published 1 Apr 2022 · Fixed in 14.2.6, 14.3.4 · NVD
  9. Medium 6.1

    CVE-2022-23801 · Joomla!

    An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media.

    Published 30 Mar 2022 · NVD
  10. Medium 6.1

    CVE-2022-23800 · Joomla!

    An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components.

    Published 30 Mar 2022 · NVD
  11. Critical 9.8

    CVE-2022-23799 · Joomla!

    An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data.

    Published 30 Mar 2022 · NVD
  12. Medium 6.1

    CVE-2022-23798 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.

    Published 30 Mar 2022 · NVD
  13. Critical 9.8

    CVE-2022-23797 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection.

    Published 30 Mar 2022 · NVD
  14. Medium 6.1

    CVE-2022-23796 · Joomla!

    An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using com_fields.

    Published 30 Mar 2022 · NVD
  15. Critical 9.8

    CVE-2022-23795 · Joomla!

    An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.

    Published 30 Mar 2022 · NVD
  16. Medium 5.3

    CVE-2022-23794 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application.

    Published 30 Mar 2022 · NVD
  17. High 7.5

    CVE-2022-23793 · Joomla!

    An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path.

    Published 30 Mar 2022 · NVD
  18. Critical 9.8

    CVE-2022-28209 · MediaWiki

    An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof extension is incorrect.

    Published 30 Mar 2022 · NVD
  19. Critical 9.8

    CVE-2022-28206 · MediaWiki

    An issue was discovered in MediaWiki through 1.37.1. ImportPlanValidator.php in the FileImporter extension mishandles the check for edit rights.

    Published 30 Mar 2022 · NVD
  20. Critical 9.8

    CVE-2022-28205 · MediaWiki

    An issue was discovered in MediaWiki through 1.37.1. The CentralAuth extension mishandles a ttl issue for groups expiring in the future.

    Published 30 Mar 2022 · NVD
  21. Medium 6.1

    CVE-2022-28202 · MediaWiki

    An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.

    Published 30 Mar 2022 · Fixed in 1.35.6, 1.36.4, 1.37.2 · NVD
  22. Medium 6.5

    CVE-2022-23183 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Missing Authorization

    Published 30 Mar 2022 · Fixed in 5.12.1 · NVD, WPVulnerability
  23. High 8.8

    CVE-2022-0751 · GitLab

    Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with misleading content which could trick unsuspecting users into executing arbitrary commands

    Published 28 Mar 2022 · Fixed in 14.6.5, 14.7.4, 14.8.2 · NVD
  24. High 7.5

    CVE-2022-0738 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. GitLab was leaking user passwords when adding mirrors with SSH credentials under specific conditions.

    Published 28 Mar 2022 · Fixed in 14.6.5, 14.7.4, 14.8.2 · NVD
  25. Critical 9.8

    CVE-2022-0735 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An unauthorised user was able to steal runner registration tokens through an information disclosure vulnerability using quick actions commands.

    Published 28 Mar 2022 · Fixed in 14.6.5, 14.7.4, 14.8.2 · NVD
  26. Medium 6.5

    CVE-2022-0549 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under certain conditions, GitLab REST API may allow unprivileged users to add other users to groups even if that is not possible to do through the Web UI.

    Published 28 Mar 2022 · Fixed in 14.6.5, 14.7.4, 14.8.2 · NVD
  27. Medium 4.3

    CVE-2022-0488 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. It was possible to trigger a timeout on a page with markdown by using a specific amount of block-quotes.

    Published 28 Mar 2022 · NVD
  28. High 8.8

    CVE-2022-0427 · GitLab

    Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover

    Published 28 Mar 2022 · Fixed in 14.5.4, 14.6.4, 14.7.1 · NVD
  29. Medium 4.3

    CVE-2022-0371 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 before 14.6.4, all versions starting from 14.7 before 14.7.1. GitLab search may allow authenticated users to search other users by their respective private emails even if a user set their email to private.

    Published 28 Mar 2022 · Fixed in 14.5.4, 14.6.4, 14.7.1 · NVD
  30. Medium 4.3

    CVE-2022-0344 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a Merge Request and later moved to a public project

    Published 28 Mar 2022 · Fixed in 14.5.4, 14.6.4 · NVD
  31. Medium 6.1

    CVE-2022-0283 · GitLab

    An issue has been discovered affecting GitLab versions prior to 13.5. An open redirect vulnerability was fixed in GitLab integration with Jira that a could cause the web application to redirect the request to the attacker specified URL.

    Published 28 Mar 2022 · Fixed in 14.5.4, 14.6.4 · NVD
  32. Critical 9.1

    CVE-2022-0249 · GitLab

    A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked.

    Published 28 Mar 2022 · NVD
  33. High 8.1

    CVE-2022-0136 · GitLab

    A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature.

    Published 28 Mar 2022 · NVD
  34. Medium 6.8

    CVE-2022-0123 · GitLab

    An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.

    Published 28 Mar 2022 · Fixed in 14.4.5, 14.5.3, 14.6.1 · NVD
  35. Medium 5.3

    CVE-2021-4191 · GitLab

    An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API.

    Published 28 Mar 2022 · Fixed in 14.6.5, 14.7.4, 14.8.2 · NVD
  36. Medium 4.3

    CVE-2021-39876 · GitLab

    In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups.

    Published 28 Mar 2022 · Fixed in 14.1.7, 14.2.5, 14.3.1 · NVD
  37. High 7.5

    CVE-2018-25032 · MariaDB, Python

    zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

    Published 25 Mar 2022 · Fixed in 10.7.5, 10.8.4, 10.9.2 · NVD
  38. Medium 4.3

    CVE-2022-24782 · Discourse

    Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch, and 2.9.0.beta3 and prior in the `tests-passed` branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to category settings, they may have category membership for a secure category. The name of this secure…

    Published 24 Mar 2022 · NVD
  39. Medium 5.9

    CVE-2022-24769 · Docker Engine

    Default inheritable capabilities for linux container should be empty

    Published 24 Mar 2022 · Fixed in 20.10.14 · NVD, Project advisories (GitHub)
  40. High 7.4

    CVE-2021-3618 · nginx

    ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS…

    Published 23 Mar 2022 · Fixed in 1.21.0 · NVD
  41. Medium 5.4

    CVE-2022-0765 · Loco Translate (WordPress plugin)

    Loco Translate: Cross-site Scripting

    Published 22 Mar 2022 · Fixed in 2.6.1 · WPVulnerability
  42. High 7.5

    CVE-2022-0778 · MariaDB, Node.js, OpenSSL

    The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a…

    Published 15 Mar 2022 · Fixed in 14.19.1, 16.14.2, 17.7.2 · NVD
  43. Critical 9.8

    CVE-2022-23943 · Apache HTTP Server

    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.

    Published 14 Mar 2022 · Fixed in 2.4.53 · NVD
  44. Critical 9.1

    CVE-2022-22721 · Apache HTTP Server

    If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.

    Published 14 Mar 2022 · NVD
  45. Critical 9.8

    CVE-2022-22720 · Apache HTTP Server

    Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

    Published 14 Mar 2022 · NVD
  46. High 7.5

    CVE-2022-22719 · Apache HTTP Server

    A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.

    Published 14 Mar 2022 · NVD
  47. Low 3.7

    CVE-2021-36368 · OpenSSH

    An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to…

    Published 13 Mar 2022 · Fixed in 8.9 · NVD
  48. Medium 5.3

    CVE-2021-41233 · Nextcloud

    Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File Drop". For successful exploitation an attacker requires knowledge of the sharing link. It is recommended that users upgrade their Nextcloud…

    Published 10 Mar 2022 · Fixed in 20.0.14, 21.0.6, 22.2.1 · NVD
  49. High 7.0

    CVE-2022-26488 · Python

    In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non-administrative user can trigger a repair that incorrectly adds user-writable…

    Published 10 Mar 2022 · NVD
  50. Medium 6.5

    CVE-2021-3733 · Python

    There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application…

    Published 10 Mar 2022 · Fixed in 3.7.11, 3.8.10, 3.9.5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.