UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,946
Published in 7 days
891
Critical in 30 days
416
Actively exploited
420

Latest vulnerabilities

37,946 vulnerabilities
  1. Medium 4.8

    CVE-2025-54292 · LXD

    Client-Side Path Traversal in LXD-UI

    Published 2 Oct 2025 · Fixed in 0.18, 5.21.4, 6.5 · NVD, Project advisories (GitHub)
  2. High 7.1

    CVE-2025-54293 · LXD

    Path Traversal Vulnerability in Instance Log File Retrieval Function

    Published 2 Oct 2025 · Fixed in 5.21.0, 5.21.4, 6.5 · NVD, Project advisories (GitHub)
  3. High 7.5

    CVE-2025-59538 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON…

    Published 1 Oct 2025 · Fixed in 2.14.20, 3.0.19, 3.1.8 · NVD
  4. High 7.5

    CVE-2025-59537 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. With the default configuration, no webhook.gogs.secret set, Argo CD’s /api/webhook endpoint will…

    Published 1 Oct 2025 · Fixed in 2.14.20, 3.0.19, 3.1.8 · NVD
  5. High 7.5

    CVE-2025-59531 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. Without a configured webhook.bitbucketserver.secret, Argo CD's /api/webhook endpoint crashes when…

    Published 1 Oct 2025 · Fixed in 2.14.20, 3.0.19, 3.1.8 · NVD
  6. Medium 5.5

    CVE-2025-59337 · Discourse

    Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. This issue is fixed in version 3.5.1.

    Published 1 Oct 2025 · Fixed in 3.5.1, 3.6.0 · NVD
  7. High 8.8

    CVE-2025-56588 · Dolibarr ERP CRM

    Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter.

    Published 1 Oct 2025 · NVD
  8. Medium 4.3

    CVE-2025-58055 · Discourse

    Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic “Title”, “Category”, and “Tags” allowed authenticated users to extract information about topics that they weren’t authorized to access. By modifying the “topic_id” value in API requests to the AI suggestion endpoints, users could target specific restricted…

    Published 1 Oct 2025 · Fixed in 3.5.1, 3.6.0 · NVD
  9. Medium 5.4

    CVE-2025-58054 · Discourse

    Discourse is an open-source community discussion platform. Versions 3.5.0 and below are vulnerable to XSS attacks through parsing and rendering of chat channel titles and chat thread titles via the quote message functionality when using the rich text editor. This issue is fixed in version 3.5.1.

    Published 1 Oct 2025 · Fixed in 3.5.0, 3.6.0 · NVD
  10. High 8.8

    CVE-2025-20371 · Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user.

    Published 1 Oct 2025 · Fixed in 9.2.8, 9.3.6, 9.4.4 · NVD
  11. Medium 4.9

    CVE-2025-20370 · Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a user who holds a role that contains the high-privilege capability `change_authentication`, could send multiple LDAP bind requests to a specific internal endpoint, resulting in high server CPU usage, which could potentially lead to a denial…

    Published 1 Oct 2025 · Fixed in 9.2.8, 9.3.6, 9.4.4 · NVD
  12. Medium 6.5

    CVE-2025-20369 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of…

    Published 1 Oct 2025 · Fixed in 9.2.8, 9.3.6, 9.4.4 · NVD
  13. Medium 5.4

    CVE-2025-20368 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through the error messages and job inspection details of a saved search. This could result in execution of unauthorized JavaScript code in the…

    Published 1 Oct 2025 · Fixed in 9.2.8, 9.3.6, 9.4.4 · NVD
  14. Medium 5.4

    CVE-2025-20367 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could craft a malicious payload through the `dataset.command` parameter of the `/app/search/table` endpoint, which could result in execution of unauthorized JavaScript code in…

    Published 1 Oct 2025 · Fixed in 9.2.8, 9.3.6, 9.4.4 · NVD
  15. Medium 6.5

    CVE-2025-20366 · Splunk Enterprise

    In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.111, 9.3.2408.119, and 9.2.2406.122, a low-privileged user that does not hold the admin or power Splunk roles could access sensitive search results if Splunk Enterprise runs an administrative search job in the background. If the low privileged user guesses the search job’s unique Search…

    Published 1 Oct 2025 · Fixed in 9.2.8, 9.3.6, 9.4.4 · NVD
  16. Medium 6.3

    CVE-2025-11233 · Rust

    Rust standard library didn't detect all path separators on Cygwin

    Published 1 Oct 2025 · Fixed in 1.89.0 · Project advisories (GitHub)
  17. Medium 5.3

    CVE-2025-55191 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions between 2.1.0 and 2.14.19, 3.2.0-rc1, 3.1.0-rc1 through 3.1.7, and 3.0.0-rc1 through 3.0.18 contain a race condition in the repository credentials handler that can cause the Argo CD server to panic and crash when concurrent operations are performed on the same repository URL. The vulnerability is located in…

    Published 30 Sept 2025 · Fixed in 2.14.20, 3.0.19, 3.1.8 · NVD
  18. Medium 4.8

    CVE-2025-43826 · Liferay Portal / DXP

    Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allow remote attackers to inject arbitrary web script or HTML via any rich text field in a web content article.

    Published 30 Sept 2025 · Fixed in 7.4.3.113, 2023.Q4.9, 2024.Q1.3 · NVD
  19. Medium 5.3

    CVE-2025-43827 · Liferay Portal / DXP

    Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users to from one virtual instance to view the audit events…

    Published 30 Sept 2025 · Fixed in 7.4.3.118, 2024.Q1.6 · NVD
  20. High 7.5

    CVE-2025-61600 · Stalwart

    Unbounded Memory Allocation in Stalwart IMAP server

    Published 30 Sept 2025 · Fixed in 0.13.4 · Project advisories (GitHub)
  21. Medium 4.8

    CVE-2025-43817 · Liferay Portal / DXP

    Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrary web script or HTML via the `redirect` parameter to (1) Announcements, or (2) Alerts.

    Published 29 Sept 2025 · Fixed in 7.4.3.112, 2023.q3.9, 2023.Q4.7 · NVD
  22. Medium 6.9

    CVE-2025-43813 · Liferay Portal / DXP

    Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to access arbitrary CSS and JSS files and load the files…

    Published 29 Sept 2025 · Fixed in 7.4.3.108, 2023.q3.9, 2023.Q4.5 · NVD
  23. Medium 4.8

    CVE-2025-43812 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a web content structure's Name text field

    Published 29 Sept 2025 · Fixed in 7.4.3.112, 2023.q3.9, 2023.Q4.5 · NVD
  24. Medium 4.8

    CVE-2025-43820 · Liferay Portal / DXP

    Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a…

    Published 29 Sept 2025 · Fixed in 7.4.3.111, 2023.Q3.7, 2023.Q4.5 · NVD
  25. Medium 4.8

    CVE-2025-43818 · Liferay Portal / DXP

    Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 36 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Calendar's “Name” text field

    Published 29 Sept 2025 · Fixed in 7.4.3.111, 2023.Q3.7, 2023.Q4.5 · NVD
  26. Medium 5.1

    CVE-2025-43815 · Liferay Portal / DXP

    Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and 2023.Q3.5 allows remote attackers to inject arbitrary web script or HTML via the com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURLTitle parameter.

    Published 29 Sept 2025 · Fixed in 7.4.3.111, 2023.q4.3 · NVD
  27. Medium 4.8

    CVE-2025-43811 · Liferay Portal / DXP

    Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.7, and 7.4 update 50 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via a crafted payload injected into an asset author’s (1) First Name, (2)…

    Published 29 Sept 2025 · Fixed in 7.4.3.112, 2023.Q3.8, 2023.Q4.5 · NVD
  28. Medium 4.9

    CVE-2025-36099 · IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A privileged user could exploit this vulnerability to cause the server to consume memory resources.

    Published 29 Sept 2025 · NVD
  29. High 7.5

    CVE-2025-7104 · LibreChat

    A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or database fields without proper filtering. As a result, any extra fields in the request body are included in agentData and passed to the database layer, allowing…

    Published 29 Sept 2025 · Fixed in 0.7.9 · NVD
  30. Medium 5.1

    CVE-2025-59933 · libvips

    Buffer over-read in poppler-based pdfload

    Published 29 Sept 2025 · Fixed in 8.17.2 · NVD, Project advisories (GitHub)
  31. High 7.5

    CVE-2025-8014 · GitLab

    Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows unauthenticated users to potentially bypass query complexity limits leading to resource exhaustion and service disruption.

    Published 27 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  32. Medium 4.0

    CVE-2025-59362 · Squid

    Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asn_build_objid in lib/snmplib/asn1.c.

    Published 26 Sept 2025 · NVD
  33. Medium 6.5

    CVE-2025-5069 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name to the victim's project.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  34. High 7.5

    CVE-2025-11042 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while using specific GraphQL queries.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  35. Medium 5.3

    CVE-2025-10868 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 where certain string conversion methods exhibit performance degradation with large inputs.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  36. High 7.7

    CVE-2025-9958 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry configurations.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  37. Critical 9.6

    CVE-2025-9642 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an attacker to inject malicious content that may lead to account takeover.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  38. High 8.8

    CVE-2025-7691 · GitLab

    A privilege escalation issue has been discovered in GitLab EE affecting all versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 that could have allowed a developer with specific group management permissions to escalate their privileges and obtain unauthorized access to additional system capabilities.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  39. High 7.2

    CVE-2025-10871 · GitLab

    An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can exploit a vulnerability where they can assign custom roles to users with permissions exceeding their own, effectively granting themselves elevated privileges.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  40. Medium 6.5

    CVE-2025-10867 · GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to create a denial-of-service condition by exploiting an unprotected GraphQL API through repeated requests.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  41. High 7.5

    CVE-2025-10858 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that allows unauthenticated users to cause a Denial of Service (DoS) condition while uploading specifically crafted large JSON files.

    Published 26 Sept 2025 · Fixed in 18.2.7, 18.3.3 · NVD
  42. Medium 6.5

    CVE-2025-54831 · Apache Airflow

    Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values. In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through…

    Published 26 Sept 2025 · NVD
  43. Medium 6.9

    CVE-2025-43816 · Liferay Portal / DXP

    A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2024.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows an attacker to cause server unavailability (denial of service) via repeatedly calling the API…

    Published 25 Sept 2025 · Fixed in 7.4, 7.4.3.120, 2024.Q1.6 · NVD
  44. High 7.6

    CVE-2024-58260 · Rancher

    Update on users can deny the service to the admin

    Published 25 Sept 2025 · Fixed in 2.10.10, 2.11.6, 2.12.2 · Project advisories (GitHub)
  45. High 8.0

    CVE-2024-58267 · Rancher

    Rancher CLI SAML authentication is vulnerable to phishing attacks

    Published 25 Sept 2025 · Fixed in 2.10.10, 2.11.6, 2.12.2 · Project advisories (GitHub)
  46. Medium 4.7

    CVE-2025-54468 · Rancher

    Sensitive information is sent to external services through Rancher’s `/meta/proxy` endpoint

    Published 25 Sept 2025 · Fixed in 2.10.10, 2.11.6, 2.12.2 · Project advisories (GitHub)
  47. High 8.6

    CVE-2025-34227 · Nagios XI

    Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.

    Published 25 Sept 2025 · NVD
  48. Critical 9.0

    CVE-2025-20363 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user…

    Published 25 Sept 2025 · Fixed in 9.20.3.16, 9.22.2, 9.23.1.3 · NVD
  49. High 8.6Actively exploited

    CVE-2025-20362 · Cisco ASA and Firepower Threat Defense

    Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed…

    Published 25 Sept 2025 · Fixed in 9.20.4.10, 9.22.2.14, 9.23.1.19 · NVD
  50. Critical 9.9Actively exploited

    CVE-2025-20333 · Cisco ASA and Firepower Threat Defense

    A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials…

    Published 25 Sept 2025 · Fixed in 9.19.1.37, 9.20.3.7, 9.22.1.3 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.