UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,199
Published in 7 days
233
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,199 vulnerabilities
  1. Unrated

    WPV-2aa264f95467 · WooCommerce

    Vulnerability in WooCommerce

    Published 10 Mar 2022 · Fixed in 6.3.1 · WPVulnerability
  2. Unrated

    WPV-07ccc3b2848a · WooCommerce

    Vulnerability in WooCommerce

    Published 10 Mar 2022 · Fixed in 6.3.1 · WPVulnerability
  3. Medium 6.1

    CVE-2022-0864 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Cross-site Scripting

    Published 10 Mar 2022 · Fixed in 1.22.9 · NVD, WPVulnerability
  4. Medium 6.5

    CVE-2022-24741 · Nextcloud

    Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended that the Nextcloud Server is upgraded to 21.0.8 , 22.2.4 or 23.0.1. Users unable to upgrade should disable preview generation with the…

    Published 9 Mar 2022 · Fixed in 21.0.8, 22.2.4 · NVD
  5. Medium 6.3

    CVE-2022-24512 · .NET

    .NET and Visual Studio Remote Code Execution Vulnerability

    Published 9 Mar 2022 · NVD
  6. High 7.5

    CVE-2022-24464 · .NET

    .NET and Visual Studio Denial of Service Vulnerability

    Published 9 Mar 2022 · NVD
  7. Medium 4.3

    CVE-2021-41241 · Nextcloud

    Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the groupfolder but not specific subfolders. Due to a lacking permission check in affected versions, a user…

    Published 8 Mar 2022 · Fixed in 20.0.14, 21.0.6 · NVD
  8. Medium 5.3

    CVE-2021-41239 · Nextcloud

    Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no…

    Published 8 Mar 2022 · Fixed in 20.0.14, 21.0.6 · NVD
  9. High 8.8

    CVE-2022-0770 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Cross-Site Request Forgery (CSRF)

    Published 7 Mar 2022 · Fixed in 2.9.9 · WPVulnerability
  10. High 7.5

    CVE-2021-3737 · Python

    A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

    Published 4 Mar 2022 · Fixed in 3.7.11, 3.8.11, 3.9.6 · NVD
  11. High 8.1

    CVE-2021-23214 · PostgreSQL

    When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption.

    Published 4 Mar 2022 · Fixed in 11.14, 12.9, 13.5 · NVD
  12. Medium 6.3

    CVE-2022-4974 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Missing Authorization

    Published 4 Mar 2022 · Fixed in 1.14.3 · WPVulnerability
  13. Medium 4.3

    CVE-2022-23708 · Elasticsearch

    A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.

    Published 3 Mar 2022 · Fixed in 7.17.1 · NVD
  14. Medium 6.5

    CVE-2021-3677 · PostgreSQL

    A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the…

    Published 2 Mar 2022 · Fixed in 11.13, 12.8, 13.4 · NVD
  15. Medium 5.9

    CVE-2021-23222 · PostgreSQL

    A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

    Published 2 Mar 2022 · Fixed in 11.14, 12.9, 13.5 · NVD
  16. High 7.5

    CVE-2022-0711 · HAProxy

    A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

    Published 2 Mar 2022 · Fixed in 2.2.21, 2.3.18, 2.4.13 · NVD
  17. Unrated

    WPV-346aa6f53cbb · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Vulnerability in Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing

    Published 28 Feb 2022 · Fixed in 1.14.3 · WPVulnerability
  18. Unrated

    WPV-111e8cf7f970 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Vulnerability in Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing

    Published 28 Feb 2022 · Fixed in 1.14.3 · WPVulnerability
  19. Critical 9.8

    CVE-2021-21708 · PHP

    In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT…

    Published 27 Feb 2022 · Fixed in 7.4.28, 8.0.16, 8.1.3 · NVD
  20. High 8.2

    CVE-2022-21824 · Node.js, MySQL

    Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys…

    Published 24 Feb 2022 · Fixed in 14.18.3, 16.13.2, 17.3.1 · NVD
  21. Medium 5.3

    CVE-2021-44533 · Node.js, MySQL

    Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject…

    Published 24 Feb 2022 · Fixed in 14.18.3, 16.13.2, 17.3.1 · NVD
  22. Medium 5.3

    CVE-2021-44532 · Node.js, MySQL

    Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js…

    Published 24 Feb 2022 · Fixed in 14.18.3, 16.13.2, 17.3.1 · NVD
  23. High 7.4

    CVE-2021-44531 · Node.js, MySQL

    Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI…

    Published 24 Feb 2022 · Fixed in 14.18.3, 16.13.2, 17.3.1 · NVD
  24. Unrated

    WPV-b00d0b4a6105 · WooCommerce

    Vulnerability in WooCommerce

    Published 23 Feb 2022 · Fixed in 6.2.1 · WPVulnerability
  25. Unrated

    WPV-0159e64c8823 · WooCommerce

    Vulnerability in WooCommerce

    Published 23 Feb 2022 · Fixed in 6.2.1 · WPVulnerability
  26. Unrated

    WPV-9cb7c43c7529 · WooCommerce

    Vulnerability in WooCommerce

    Published 22 Feb 2022 · Fixed in 6.2.1 · WPVulnerability
  27. Medium 4.3

    CVE-2022-0775 · WooCommerce

    WooCommerce: Incorrect Authorization

    Published 22 Feb 2022 · Fixed in 6.2.1 · NVD, WPVulnerability
  28. High 7.8

    CVE-2022-25365 · Docker Engine

    Docker Desktop before 4.5.1 on Windows allows attackers to move arbitrary files. NOTE: this issue exists because of an incomplete fix for CVE-2022-23774.

    Published 19 Feb 2022 · Fixed in 4.5.1 · NVD
  29. High 7.5

    CVE-2017-0371 · MediaWiki

    MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.

    Published 18 Feb 2022 · Fixed in 1.23.16, 1.27.2, 1.28.1 · NVD
  30. High 7.8

    CVE-2022-24052 · MariaDB

    MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of…

    Published 18 Feb 2022 · Fixed in 10.5.14, 10.6.6, 10.7.2 · NVD
  31. High 7.8

    CVE-2022-24051 · MariaDB

    MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of a user-supplied string before using…

    Published 18 Feb 2022 · Fixed in 10.5.14, 10.6.6, 10.7.2 · NVD
  32. High 7.8

    CVE-2022-24050 · MariaDB

    MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of validating the existence of an object prior to performing…

    Published 18 Feb 2022 · Fixed in 10.5.14, 10.6.6, 10.7.2 · NVD
  33. High 7.8

    CVE-2022-24048 · MariaDB

    MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of…

    Published 18 Feb 2022 · Fixed in 10.5.14, 10.6.6, 10.7.2 · NVD
  34. Medium 6.5

    CVE-2022-0633 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Incorrect Authorization

    Published 17 Feb 2022 · Fixed in 1.22.3, 2.22.3 · NVD, WPVulnerability
  35. Critical 9.8Actively exploited

    CVE-2022-24086 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

    Published 16 Feb 2022 · Fixed in 2.3.0 · NVD
  36. Medium 6.5

    CVE-2022-23641 · Discourse

    Discourse is an open source discussion platform. In versions prior to 2.8.1 in the `stable` branch, 2.9.0.beta2 in the `beta` branch, and 2.9.0.beta2 in the `tests-passed` branch, users can trigger a Denial of Service attack by posting a streaming URL. Parsing Oneboxes in the background job trigger an infinite loop, which cause memory leaks. This issue is patched in version 2.8.1 of the `stable`…

    Published 15 Feb 2022 · Fixed in 2.8.1 · NVD
  37. High 7.8

    CVE-2021-43940 · Confluence

    Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.

    Published 15 Feb 2022 · Fixed in 7.4.10, 7.12.3 · NVD
  38. High 7.5

    CVE-2022-0391 · Python

    A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions…

    Published 9 Feb 2022 · Fixed in 3.7.11, 3.8.11, 3.9.5 · NVD
  39. Medium 4.3

    CVE-2021-39943 · GitLab

    An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allowed a user to update the status of the check via an API call

    Published 9 Feb 2022 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  40. High 7.5

    CVE-2022-21986 · .NET

    .NET Denial of Service Vulnerability

    Published 9 Feb 2022 · Fixed in 5.0.14, 6.0.2 · NVD
  41. High 7.1

    CVE-2021-32036 · MongoDB

    An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions…

    Published 4 Feb 2022 · Fixed in 4.2.18, 4.4.10, 5.0.4 · NVD
  42. High 7.5

    CVE-2021-46669 · MariaDB

    MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used.

    Published 1 Feb 2022 · Fixed in 10.5.16, 10.6.8, 10.7.4 · NVD
  43. Medium 5.5

    CVE-2021-46668 · MariaDB

    MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures.

    Published 1 Feb 2022 · Fixed in 10.5.15, 10.6.7, 10.7.3 · NVD
  44. Medium 5.5

    CVE-2021-46667 · MariaDB

    MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.

    Published 1 Feb 2022 · Fixed in 10.4.22, 10.5.13, 10.6.5 · NVD
  45. Medium 5.5

    CVE-2021-46666 · MariaDB

    MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause.

    Published 1 Feb 2022 · Fixed in 10.4.20, 10.5.11, 10.6.2 · NVD
  46. Medium 5.5

    CVE-2021-46665 · MariaDB

    MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations.

    Published 1 Feb 2022 · Fixed in 10.5.15, 10.6.7, 10.7.3 · NVD
  47. Medium 5.5

    CVE-2021-46664 · MariaDB

    MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr.

    Published 1 Feb 2022 · Fixed in 10.5.15, 10.6.7, 10.7.3 · NVD
  48. Medium 5.5

    CVE-2021-46663 · MariaDB

    MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements.

    Published 1 Feb 2022 · Fixed in 10.5.15, 10.6.7, 10.7.3 · NVD
  49. Medium 5.5

    CVE-2021-46662 · MariaDB

    MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery.

    Published 1 Feb 2022 · Fixed in 10.4.22, 10.5.13, 10.6.5 · NVD
  50. Medium 5.5

    CVE-2021-46661 · MariaDB

    MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE).

    Published 1 Feb 2022 · Fixed in 10.5.15, 10.6.7, 10.7.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.