UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,268
Published in 7 days
263
Critical in 30 days
71
Actively exploited
64

Latest vulnerabilities

11,268 vulnerabilities
  1. Medium 4.8

    CVE-2019-7934 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit newsletter templates to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  2. High 7.2

    CVE-2019-7932 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create sitemaps can execute arbitrary PHP code by creating a malicious sitemap file.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  3. High 7.2

    CVE-2019-7930 · Magento / Adobe Commerce

    A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to the import feature can make modifications to a configuration file, resulting in potentially unauthorized removal of file upload restrictions. This can result in arbitrary code execution when a malicious file is then…

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  4. Medium 4.9

    CVE-2019-7929 · Magento / Adobe Commerce

    An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges may be able to view metadata of a trusted device used by another administrator via a crafted http request.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  5. High 7.5

    CVE-2019-7928 · Magento / Adobe Commerce

    A denial-of-service (DoS) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. By abusing insufficient brute-forcing defenses in the token exchange protocol, an unauthenticated attacker could disrupt transactions between the Magento merchant and PayPal.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  6. Medium 4.8

    CVE-2019-7927 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit product content pages to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  7. Medium 4.8

    CVE-2019-7926 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify node attributes to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  8. Medium 4.9

    CVE-2019-7925 · Magento / Adobe Commerce

    An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  9. High 7.2

    CVE-2019-7923 · Magento / Adobe Commerce

    A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by authenticated user with admin privileges to manipulate shipment settings to execute arbitrary code.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  10. Medium 5.4

    CVE-2019-7921 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the product catalog form of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to the product catalog to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  11. High 7.5

    CVE-2019-7915 · Magento / Adobe Commerce

    A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Under certain conditions, an unauthenticated attacker could force the Magento store's full page cache to serve a 404 page to customers.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  12. High 7.2

    CVE-2019-7913 · Magento / Adobe Commerce

    A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to manipulate shipment methods to execute arbitrary code.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  13. High 7.2

    CVE-2019-7912 · Magento / Adobe Commerce

    A file upload filter bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to edit configuration keys to remove file extension filters, potentially resulting in the malicious upload and execution of malicious files on the server.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  14. High 7.2

    CVE-2019-7911 · Magento / Adobe Commerce

    A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to the admin panel to manipulate system configuration and execute arbitrary code.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  15. Medium 4.8

    CVE-2019-7909 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to email templates.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  16. Medium 4.8

    CVE-2019-7908 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify product information.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  17. Medium 6.5

    CVE-2019-7904 · Magento / Adobe Commerce

    Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make unauthorized environment configuration changes.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  18. High 7.2

    CVE-2019-7903 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to email templates can execute arbitrary code by previewing a malicious template.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  19. Medium 5.3

    CVE-2019-7899 · Magento / Adobe Commerce

    Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  20. Medium 5.3

    CVE-2019-7898 · Magento / Adobe Commerce

    Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to inadequate validation of user input.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  21. Medium 4.8

    CVE-2019-7897 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to customer configurations to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  22. High 7.2

    CVE-2019-7896 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to layouts can execute arbitrary code through a combination of product import, crafted csv file and XML layout update.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  23. High 7.2

    CVE-2019-7895 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to layouts can execute arbitrary code through a crafted XML layout update.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  24. High 7.2

    CVE-2019-7892 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to access shipment settings can execute arbitrary code via server-side request forgery.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  25. High 7.3

    CVE-2019-7890 · Magento / Adobe Commerce

    An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  26. Medium 6.5

    CVE-2019-7889 · Magento / Adobe Commerce

    An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with marketing manipulation privileges can invoke methods that alter data of the underlying model followed by corresponding database modifications.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  27. Medium 6.5

    CVE-2019-7888 · Magento / Adobe Commerce

    An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to create email templates could leak sensitive data via a malicious email template.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  28. Medium 4.8

    CVE-2019-7887 · Magento / Adobe Commerce

    A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 when the feature that adds a secret key to the Admin URL is disabled.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  29. High 7.5

    CVE-2019-7886 · Magento / Adobe Commerce

    A cryptograhic flaw exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A weak cryptograhic mechanism is used to generate the intialization vector in multiple security relevant contexts.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  30. High 8.8

    CVE-2019-7885 · Magento / Adobe Commerce

    Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure the catalog search.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  31. Medium 5.4

    CVE-2019-7882 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the editor can inject malicious SWF files.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  32. Medium 5.4

    CVE-2019-7881 · Magento / Adobe Commerce

    A cross-site scripting mitigation bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user to escalate privileges (admin vs. admin XSS attack).

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  33. Medium 4.8

    CVE-2019-7880 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to marketing email templates to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  34. Medium 6.1

    CVE-2019-7877 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manage orders can inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  35. High 8.8

    CVE-2019-7876 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  36. Medium 4.8

    CVE-2019-7875 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to newsletter templates.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  37. Medium 6.5

    CVE-2019-7874 · Magento / Adobe Commerce

    A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  38. Medium 4.3

    CVE-2019-7873 · Magento / Adobe Commerce

    A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of the store design schedule.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  39. Medium 6.5

    CVE-2019-7872 · Magento / Adobe Commerce

    An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing user details.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  40. High 8.8

    CVE-2019-7871 · Magento / Adobe Commerce

    A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to execute arbitrary PHP code. An authenticated user can bypass security protections that prevent arbitrary PHP script upload via form data injection.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  41. Medium 4.8

    CVE-2019-7869 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with permissions to manage customer groups.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  42. Medium 4.8

    CVE-2019-7868 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with permissions to manage tax rules.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  43. Medium 4.8

    CVE-2019-7867 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to manage orders and order status.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  44. Medium 4.8

    CVE-2019-7866 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  45. High 8.8

    CVE-2019-7865 · Magento / Adobe Commerce

    A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited at the time of editing or configuration.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  46. Medium 5.3

    CVE-2019-7864 · Magento / Adobe Commerce

    An insecure direct object reference (IDOR) vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  47. Medium 4.8

    CVE-2019-7863 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to products and categories.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  48. Medium 4.8

    CVE-2019-7862 · Magento / Adobe Commerce

    A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  49. High 7.5

    CVE-2019-7861 · Magento / Adobe Commerce

    Insufficient server-side validation of user input could allow an attacker to bypass file upload restrictions in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  50. High 7.5

    CVE-2019-7860 · Magento / Adobe Commerce

    A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every 15 minutes. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.