UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,658
Published in 7 days
785
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,658 vulnerabilities
  1. High 7.5

    CVE-2024-37313 · Nextcloud

    Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Server is upgraded to 21.0.9.17, 22.2.10.22, 23.0.12.17, 24.0.12.13, 25.0.13.8, 26.0.13, 27.1.8 or 28.0.4.

    Published 14 Jun 2024 · Fixed in 26.0.13, 27.1.8, 28.0.4 · NVD
  2. Medium 6.1

    CVE-2024-23442 · Kibana

    An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.

    Published 14 Jun 2024 · Fixed in 7.17.22, 8.14.0 · NVD
  3. Medium 5.5

    CVE-2024-25142 · Apache Airflow

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow.  Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache Airflow: before 2.9.2. Users are recommended to upgrade to version 2.9.2, which fixes the issue.

    Published 14 Jun 2024 · Fixed in 2.9.2 · NVD
  4. Medium 4.3

    CVE-2024-5469 · GitLab

    DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests.

    Published 14 Jun 2024 · Fixed in 16.10.6, 16.11.3 · NVD
  5. Medium 4.9

    CVE-2024-37280 · Elasticsearch

    A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. Note that passthrough fields is an experimental feature.

    Published 13 Jun 2024 · Fixed in 8.14.0 · NVD
  6. Medium 4.3

    CVE-2024-37279 · Kibana

    A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries.

    Published 13 Jun 2024 · Fixed in 8.14.0 · NVD
  7. Medium 5.5

    CVE-2024-34113 · Adobe ColdFusion

    ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a security feature bypass. This vulnerability arises due to the use of insufficiently strong cryptographic algorithms or flawed implementation that compromises the confidentiality of password data. An attacker could exploit this weakness to decrypt or guess…

    Published 13 Jun 2024 · NVD
  8. High 7.5

    CVE-2024-34112 · Adobe ColdFusion

    ColdFusion versions 2023u7, 2021u13 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could exploit this vulnerability to gain unauthorized access to sensitive files or data. Exploitation of this issue does not require user interaction.

    Published 13 Jun 2024 · NVD
  9. High 8.8

    CVE-2024-34111 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..

    Published 13 Jun 2024 · NVD
  10. High 7.2

    CVE-2024-34110 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction.

    Published 13 Jun 2024 · NVD
  11. High 7.2

    CVE-2024-34109 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required.

    Published 13 Jun 2024 · NVD
  12. High 7.2

    CVE-2024-34108 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required and scope is changed.

    Published 13 Jun 2024 · NVD
  13. Critical 9.8

    CVE-2024-34107 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and view minor unauthorised information. Exploitation of this issue does not require user interaction.

    Published 13 Jun 2024 · NVD
  14. Medium 5.3

    CVE-2024-34106 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction.

    Published 13 Jun 2024 · NVD
  15. Medium 4.8

    CVE-2024-34105 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · NVD
  16. High 8.2

    CVE-2024-34104 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both confidentiality and integrity impact. Exploitation of this issue does not require user interaction.

    Published 13 Jun 2024 · NVD
  17. High 8.1

    CVE-2024-34103 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application. Exploitation of this issue does not require user interaction, but attack complexity is high.

    Published 13 Jun 2024 · NVD
  18. Critical 9.8Actively exploited

    CVE-2024-34102 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

    Published 13 Jun 2024 · NVD
  19. Medium 5.4

    CVE-2024-36239 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  20. Medium 5.4

    CVE-2024-36238 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a malicious link or to interact with a…

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  21. Medium 5.4

    CVE-2024-36236 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  22. Medium 5.4

    CVE-2024-36235 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit a form…

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  23. Medium 5.4

    CVE-2024-36234 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit a form…

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  24. Medium 5.4

    CVE-2024-36233 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a victim to click on a malicious link.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  25. Medium 5.4

    CVE-2024-36232 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  26. Medium 5.4

    CVE-2024-36231 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit…

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  27. Medium 5.4

    CVE-2024-36230 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit a form…

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  28. Medium 5.4

    CVE-2024-36229 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit…

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  29. Medium 5.4

    CVE-2024-36228 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a form…

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  30. Medium 5.4

    CVE-2024-36227 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit a…

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  31. Low 3.5

    CVE-2024-36226 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and affect the integrity of the page. Exploitation of this issue requires user interaction.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  32. Medium 5.4

    CVE-2024-36225 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  33. Medium 5.4

    CVE-2024-36224 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit…

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  34. Medium 5.4

    CVE-2024-36222 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a…

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  35. Medium 5.4

    CVE-2024-36221 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  36. Medium 5.4

    CVE-2024-36220 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a form…

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  37. Medium 5.4

    CVE-2024-36219 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  38. Medium 5.4

    CVE-2024-36218 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  39. Medium 5.4

    CVE-2024-36217 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  40. Medium 6.1

    CVE-2024-36216 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  41. Medium 5.4

    CVE-2024-36215 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  42. Medium 5.4

    CVE-2024-36214 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  43. Medium 5.4

    CVE-2024-36213 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  44. Medium 5.4

    CVE-2024-36212 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  45. Medium 5.4

    CVE-2024-36211 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  46. Medium 5.4

    CVE-2024-36210 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  47. Medium 5.4

    CVE-2024-36209 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  48. Medium 5.4

    CVE-2024-36208 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  49. Medium 5.4

    CVE-2024-36207 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD
  50. Medium 5.4

    CVE-2024-36206 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 13 Jun 2024 · Fixed in 6.5.21, 2024.5 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.