UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,717
Published in 7 days
770
Critical in 30 days
202
Actively exploited
405

Latest vulnerabilities

32,717 vulnerabilities
  1. High 8.7

    CVE-2024-1451 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload added to the user profile page could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of victims."

    Published 22 Feb 2024 · NVD
  2. Medium 4.3

    CVE-2024-0861 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the `Guest` role can change `Custom dashboard projects` settings contrary to permissions.

    Published 22 Feb 2024 · Fixed in 16.7.6, 16.8.3 · NVD
  3. High 7.7

    CVE-2024-0410 · GitLab

    An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.

    Published 22 Feb 2024 · Fixed in 16.7.6, 16.8.3 · NVD
  4. Medium 6.7

    CVE-2023-6477 · GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. When a user is assigned a custom role with admin_group_member permission, they may be able to make a group, other members or themselves Owners of that group, which may lead to privilege escalation.

    Published 22 Feb 2024 · Fixed in 16.7.6 · NVD
  5. Medium 5.4

    CVE-2023-3509 · GitLab

    An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for group members with sub-maintainer role to change the title of privately accessible deploy keys associated with projects in the group.

    Published 21 Feb 2024 · NVD
  6. Medium 5.4

    CVE-2023-47795 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a document's “Title” text field.

    Published 21 Feb 2024 · Fixed in 7.4.3.102 · NVD
  7. Medium 5.4

    CVE-2024-25151 · Liferay Portal / DXP

    The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's…

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.3.4 · NVD
  8. Medium 6.1

    CVE-2024-26269 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL.

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.3.38 · NVD
  9. Medium 5.4

    CVE-2024-26266 · Liferay Portal / DXP

    Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name text field of…

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.3.14 · NVD
  10. Medium 5.4

    CVE-2024-25603 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.3.5 · NVD
  11. Medium 6.1

    CVE-2023-42498 · Liferay Portal / DXP

    Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.

    Published 21 Feb 2024 · Fixed in 7.4.3.98 · NVD
  12. Medium 6.1

    CVE-2023-42496 · Liferay Portal / DXP

    Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2 parameter.

    Published 21 Feb 2024 · Fixed in 7.4.3.98 · NVD
  13. Medium 6.1

    CVE-2023-40191 · Liferay Portal / DXP

    Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the “Blocked Email Domains” text field

    Published 21 Feb 2024 · Fixed in 7.4.3.98 · NVD
  14. Medium 5.4

    CVE-2024-25602 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into an organization’s “Name” text field

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.3.4 · NVD
  15. Medium 5.4

    CVE-2024-25601 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the name text field of a…

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.3.4 · NVD
  16. Medium 5.4

    CVE-2024-25152 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the filename of an attachment.

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.3.4 · NVD
  17. Medium 6.1

    CVE-2024-25147 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links.

    Published 21 Feb 2024 · Fixed in 7.2, 7.4.2 · NVD
  18. Medium 6.3

    CVE-2021-29038 · Liferay Portal / DXP

    Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not obfuscate password reminder answers on the page, which allows attackers to use man-in-the-middle or shoulder surfing attacks to steal user's password reminder answers.

    Published 20 Feb 2024 · Fixed in 7.2, 7.3.6 · NVD
  19. High 8.5

    CVE-2024-21678 · Confluence

    This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to confidentiality, low impact to integrity, no impact to availability, and requires no user interaction. Data Center…

    Published 20 Feb 2024 · Fixed in 7.19.19, 8.5.5, 8.7.2 · NVD
  20. Medium 5.3

    CVE-2024-26270 · Liferay Portal / DXP

    The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.

    Published 20 Feb 2024 · Fixed in 7.4.3.100 · NVD
  21. Medium 5.3

    CVE-2024-26268 · Liferay Portal / DXP

    User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time.

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.27 · NVD
  22. Medium 5.3

    CVE-2024-26267 · Liferay Portal / DXP

    In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities…

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.26 · NVD
  23. Medium 6.5

    CVE-2024-26265 · Liferay Portal / DXP

    The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, which allows remote authenticated users to upload arbitrarily large files to the system's temp folder by…

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.16 · NVD
  24. Medium 5.4

    CVE-2024-25610 · Liferay Portal / DXP

    In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry’s…

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.13 · NVD
  25. Medium 6.1

    CVE-2024-25609 · Liferay Portal / DXP

    HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL`…

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.13 · NVD
  26. Medium 6.1

    CVE-2024-25608 · Liferay Portal / DXP

    HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2)…

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.19 · NVD
  27. High 7.5

    CVE-2024-25607 · Liferay Portal / DXP

    The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes.

    Published 20 Feb 2024 · Fixed in 7.2 · NVD
  28. High 8.7

    CVE-2024-25606 · Liferay Portal / DXP

    XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.8 · NVD
  29. Medium 5.3

    CVE-2024-25605 · Liferay Portal / DXP

    The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API.

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.5 · NVD
  30. Medium 6.5

    CVE-2024-25604 · Liferay Portal / DXP

    Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.5 · NVD
  31. Medium 4.3

    CVE-2024-25150 · Liferay Portal / DXP

    Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.4 · NVD
  32. Medium 5.4

    CVE-2024-25149 · Liferay Portal / DXP

    Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the "Limit membership to members of the parent site" option is enabled, which allows remote authenticated users to add users who are not a member of the parent site to a…

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.2 · NVD
  33. Medium 6.1

    CVE-2023-44308 · Liferay Portal / DXP

    Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_adaptive_media_web_portlet_AMPortlet_redirect parameter.

    Published 20 Feb 2024 · NVD
  34. Medium 6.1

    CVE-2023-5190 · Liferay Portal / DXP

    Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter.

    Published 20 Feb 2024 · Fixed in 7.4.3.102 · NVD
  35. Medium 6.3

    CVE-2022-45320 · Liferay Portal / DXP

    Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki page by editing the wiki page.

    Published 20 Feb 2024 · Fixed in 7.2, 7.4.3.16 · NVD
  36. High 7.5

    CVE-2024-22019 · Node.js

    A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard…

    Published 20 Feb 2024 · Fixed in 18.19.1, 20.11.1, 21.6.2 · NVD
  37. Critical 9.8

    CVE-2024-21896 · Node.js

    The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which…

    Published 20 Feb 2024 · Fixed in 20.11.1, 21.6.2 · NVD
  38. High 7.8

    CVE-2024-21892 · Node.js

    On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to…

    Published 20 Feb 2024 · Fixed in 18.19.1, 20.11.1, 21.6.2 · NVD
  39. High 8.8

    CVE-2024-21891 · Node.js

    Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued,…

    Published 20 Feb 2024 · Fixed in 20.11.1, 21.6.2 · NVD
  40. Medium 6.5

    CVE-2024-21890 · Node.js

    The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that…

    Published 20 Feb 2024 · Fixed in 20.11.1, 21.6.2 · NVD
  41. Medium 5.3

    CVE-2024-26129 · PrestaShop

    PrestaShop is an open-source e-commerce platform. Starting in version 8.1.0 and prior to version 8.1.4, PrestaShop is vulnerable to path disclosure in a JavaScript variable. A patch is available in version 8.1.4.

    Published 19 Feb 2024 · Fixed in 8.1.4 · NVD
  42. Medium 5.3

    CVE-2024-25983 · Moodle

    Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page).

    Published 19 Feb 2024 · Fixed in 4.1.9, 4.2.6, 4.3.3 · NVD
  43. High 8.8

    CVE-2024-25982 · Moodle

    The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.

    Published 19 Feb 2024 · Fixed in 4.1.9, 4.2.6, 4.3.3 · NVD
  44. Medium 5.3

    CVE-2024-25981 · Moodle

    Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers.

    Published 19 Feb 2024 · Fixed in 4.1.9, 4.2.6, 4.3.3 · NVD
  45. Medium 5.3

    CVE-2024-25980 · Moodle

    Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.

    Published 19 Feb 2024 · Fixed in 4.1.9, 4.2.6, 4.3.3 · NVD
  46. Medium 5.3

    CVE-2024-25979 · Moodle

    The URL parameters accepted by forum search were not limited to the allowed parameters.

    Published 19 Feb 2024 · Fixed in 4.1.9, 4.2.6, 4.3.3 · NVD
  47. High 7.5

    CVE-2024-25978 · Moodle

    Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.

    Published 19 Feb 2024 · Fixed in 4.1.9, 4.2.6, 4.3.3 · NVD
  48. High 7.7

    CVE-2024-25623 · Mastodon

    Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote statuses, Mastodon doesn't check that the response from the remote server has a `Content-Type` header value of the Activity Streams media type, which allows a threat actor to upload a crafted Activity Streams document to a remote server and make a…

    Published 19 Feb 2024 · Fixed in 4.0.15, 4.1.15, 4.2.7 · NVD
  49. Medium 6.1

    CVE-2024-20986 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the…

    Published 17 Feb 2024 · NVD
  50. Medium 4.4

    CVE-2024-20984 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server : Security : Firewall). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to…

    Published 17 Feb 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.