UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,200
Published in 7 days
233
Critical in 30 days
70
Actively exploited
62

Latest vulnerabilities

11,200 vulnerabilities
  1. High 7.5

    CVE-2022-0244 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorrect handling of file.

    Published 18 Jan 2022 · NVD
  2. Medium 6.5

    CVE-2022-0172 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.2 · NVD
  3. High 8.0

    CVE-2022-0154 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their GitHub project imported on another GitLab user account.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.2 · NVD
  4. Medium 6.5

    CVE-2022-0152 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to unauthorized access to some particular fields through the GraphQL API.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.2 · NVD
  5. Medium 4.9

    CVE-2022-0151 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not correctly handling requests to delete existing packages which could result in a Denial of Service under specific conditions.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.2 · NVD
  6. Medium 4.3

    CVE-2022-0125 · GitLab

    An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not verifying that a maintainer of a project had the right access to import members from a target project.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.2 · NVD
  7. Medium 4.3

    CVE-2022-0124 · GitLab

    An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is incorrectly validating user input and allows to craft malicious URLs that are sent to slack.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.1 · NVD
  8. Medium 4.3

    CVE-2022-0093 · GitLab

    An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab allows a user with an expired password to access sensitive information through RSS feeds.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.1 · NVD
  9. Medium 6.5

    CVE-2022-0090 · GitLab

    An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way that it doesn't ignore replacement references with git sub-commands, allowing a malicious user to spoof the contents of their commits in the UI.

    Published 18 Jan 2022 · Fixed in 14.4.5, 14.5.3, 14.6.1 · NVD
  10. Medium 5.4

    CVE-2021-39946 · GitLab

    Improper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed an attacker to exploit XSS by abusing the generation of the HTML code related to emojis

    Published 18 Jan 2022 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  11. Medium 6.5

    CVE-2021-39942 · GitLab

    A denial of service vulnerability in GitLab CE/EE affecting all versions starting from 12.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows low-privileged users to bypass file size limits in the NPM package repository to potentially cause denial of service.

    Published 18 Jan 2022 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  12. Medium 4.3

    CVE-2021-39927 · GitLab

    Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and between 14.6.0 and 14.6.1 would fail to protect against attacks sending requests to localhost on port 80 or 443 if GitLab was configured to run on a port other than 80 or 443

    Published 18 Jan 2022 · NVD
  13. Medium 4.3

    CVE-2021-39892 · GitLab

    In all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from projects that they don't have a maintainer role on and disclose email addresses of those users.

    Published 18 Jan 2022 · Fixed in 14.1.7, 14.2.5 · NVD
  14. Medium 5.3

    CVE-2022-21677 · Discourse

    Discourse is an open source discussion platform. Discourse groups can be configured with varying visibility levels for the group as well as the group members. By default, a newly created group has its visibility set to public and the group's members visibility set to public as well. However, a group's visibility and the group's members visibility can be configured such that it is restricted to…

    Published 14 Jan 2022 · NVD
  15. High 8.8

    CVE-2022-21684 · Discourse

    Discourse is an open source discussion platform. Versions prior to 2.7.13 in `stable`, 2.8.0.beta11 in `beta`, and 2.8.0.beta11 in `tests-passed` allow some users to log in to a community before they should be able to do so. A user invited via email to a forum with `must_approve_users` enabled is going to be automatically logged in, bypassing the check that does not allow unapproved users to…

    Published 13 Jan 2022 · Fixed in 2.7.13 · NVD
  16. Medium 4.3

    CVE-2022-21678 · Discourse

    Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version…

    Published 13 Jan 2022 · Fixed in 2.7.13 · NVD
  17. Medium 4.8

    CVE-2021-46150 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling, as demonstrated by an XSS payload in MediaWiki:October.

    Published 10 Jan 2022 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD
  18. High 7.5

    CVE-2021-46149 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplished by searching for a very long key in a Language Name Search.

    Published 10 Jan 2022 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD
  19. Medium 6.5

    CVE-2021-46148 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (e.g., IP addresses and User-Agent headers for election traffic) on a testwiki SecurePoll instance.

    Published 10 Jan 2022 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD
  20. High 8.8

    CVE-2021-46147 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF.

    Published 10 Jan 2022 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD
  21. Medium 5.4

    CVE-2021-46146 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The WikibaseMediaInfo component is vulnerable to XSS via the caption fields for a given media file.

    Published 10 Jan 2022 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD
  22. Medium 4.7

    CVE-2021-25103 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Cross-site Scripting

    Published 10 Jan 2022 · Fixed in 2.9.7 · WPVulnerability
  23. High 7.5

    CVE-2022-21661 · WordPress

    WordPress: SQL Injection through WP_Query

    Published 6 Jan 2022 · Fixed in 5.6.7, 5.7.5, 5.8.3 · NVD, WordPress
  24. Medium 5.4

    CVE-2022-21662 · WordPress

    WordPress: Stored XSS through authenticated users

    Published 6 Jan 2022 · Fixed in 5.8.3 · NVD, WordPress
  25. High 7.2

    CVE-2022-21663 · WordPress

    WordPress: Authenticated Object Injection in Multisites

    Published 6 Jan 2022 · Fixed in 5.8.3 · NVD, WordPress
  26. High 8.8

    CVE-2022-21664 · WordPress

    WordPress: SQL injection due to improper sanitization in WP_Meta_Query

    Published 6 Jan 2022 · Fixed in 5.8.3 · NVD, WordPress
  27. Medium 4.3

    CVE-2022-21642 · Discourse

    Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this issue and users are advised to upgrade.

    Published 5 Jan 2022 · Fixed in 2.7.13 · NVD
  28. Medium 6.8

    CVE-2021-43850 · Discourse

    Discourse is an open source platform for community discussion. In affected versions admins users can trigger a Denial of Service attack via the `/message-bus/_diagnostics` path. The impact of this vulnerability is greater on multisite Discourse instances (where multiple forums are served from a single application server) where any admin user on any of the forums are able to visit the…

    Published 4 Jan 2022 · Fixed in 2.7.12 · NVD
  29. High 7.5

    CVE-2021-41819 · Ruby

    CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

    Published 1 Jan 2022 · Fixed in 2.7.5, 3.0.3 · NVD
  30. High 7.5

    CVE-2021-41817 · Ruby

    Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

    Published 1 Jan 2022 · Fixed in 2.6.9, 2.7.5, 3.0.3 · NVD
  31. Medium 6.1

    CVE-2021-25089 · UpdraftPlus

    UpdraftPlus: WP Backup & Migration Plugin: Cross-site Scripting

    Published 28 Dec 2021 · Fixed in 1.16.69 · NVD, WPVulnerability
  32. Medium 6.1

    CVE-2021-45474 · MediaWiki

    In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter.

    Published 24 Dec 2021 · NVD
  33. Medium 6.1

    CVE-2021-45473 · MediaWiki

    In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar).

    Published 24 Dec 2021 · NVD
  34. Medium 6.1

    CVE-2021-45472 · MediaWiki

    In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used.

    Published 24 Dec 2021 · NVD
  35. Medium 5.3

    CVE-2021-45471 · MediaWiki

    In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items.

    Published 24 Dec 2021 · NVD
  36. Critical 9.8

    CVE-2021-44790 · Apache HTTP Server

    A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

    Published 20 Dec 2021 · Fixed in 2.4.52 · NVD
  37. High 8.2

    CVE-2021-44224 · Apache HTTP Server

    A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

    Published 20 Dec 2021 · Fixed in 2.4.52 · NVD
  38. High 7.5

    CVE-2021-44858 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a private wiki that has at least one page set in $wgWhitelistRead.

    Published 20 Dec 2021 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD
  39. Medium 5.3

    CVE-2021-45038 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. By using an action=rollback query, attackers can view private wiki contents.

    Published 17 Dec 2021 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD
  40. Medium 6.5

    CVE-2021-44857 · MediaWiki

    An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesn't have edit rights for). This applies to any public wiki, or a private wiki that has at least one page set in $wgWhitelistRead.

    Published 17 Dec 2021 · Fixed in 1.35.5, 1.36.3, 1.37.1 · NVD
  41. High 8.8

    CVE-2021-43877 · .NET

    ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

    Published 15 Dec 2021 · NVD
  42. Medium 6.5

    CVE-2021-20330 · MongoDB

    An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.27; MongoDB Server v4.2 versions prior to 4.2.16; MongoDB Server v4.4 versions prior to 4.4.9.

    Published 15 Dec 2021 · Fixed in 4.0.25, 4.2.14, 4.4.6 · NVD
  43. High 7.5

    CVE-2021-4044 · Node.js, OpenSSL

    Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent…

    Published 14 Dec 2021 · Fixed in 1.0.2, 17.3.0 · NVD
  44. Medium 6.5

    CVE-2021-25037 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): SQL Injection

    Published 14 Dec 2021 · Fixed in 4.1.5.3 · WPVulnerability
  45. High 8.8

    CVE-2021-25036 · All in One SEO

    All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Improper Handling of Case Sensitivity

    Published 14 Dec 2021 · Fixed in 4.1.5.3 · WPVulnerability
  46. Low 2.7

    CVE-2021-39945 · GitLab

    Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an author of a Merge Request to approve the Merge Request even after having their project access revoked

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  47. High 7.1

    CVE-2021-39944 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A permissions validation flaw allowed group members with a developer role to elevate their privilege to a maintainer on projects they import

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  48. Medium 5.3

    CVE-2021-39941 · GitLab

    An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed non-project members to see the default branch name for projects that restrict access to the repository to project members

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  49. Medium 6.5

    CVE-2021-39940 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab Maven Package registry is vulnerable to a regular expression denial of service when a specifically crafted string is sent.

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD
  50. Medium 6.5

    CVE-2021-39939 · GitLab

    An uncontrolled resource consumption vulnerability in GitLab Runner affecting all versions starting from 13.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker triggering a job with a specially crafted docker image to exhaust resources on runner manager

    Published 13 Dec 2021 · Fixed in 14.3.6, 14.4.4, 14.5.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.