UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,972
Published in 7 days
842
Critical in 30 days
413
Actively exploited
420

Latest vulnerabilities

37,972 vulnerabilities
  1. Medium 4.1

    CVE-2025-4573 · Mattermost

    Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute.

    Published 11 Jun 2025 · Fixed in 10.5.5, 10.6.4, 10.7.2 · NVD
  2. Medium 4.3

    CVE-2025-4128 · Mattermost

    Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/{team_id}.

    Published 11 Jun 2025 · Fixed in 9.11.14, 10.5.5 · NVD
  3. Medium 5.4

    CVE-2025-47117 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  4. Medium 5.4

    CVE-2025-47116 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  5. Medium 5.4

    CVE-2025-47115 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  6. Medium 5.4

    CVE-2025-47114 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  7. Medium 5.4

    CVE-2025-47113 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  8. Low 3.5

    CVE-2025-47096 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass, allowing a low impact to the integrity of the component. Exploitation of this issue requires user interaction in that a victim must interact with the malicious content. Low privileges are required.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  9. Medium 6.1

    CVE-2025-47094 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  10. Medium 5.4

    CVE-2025-47093 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  11. Medium 5.4

    CVE-2025-47092 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  12. Medium 5.4

    CVE-2025-47091 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  13. Medium 5.4

    CVE-2025-47090 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  14. Medium 5.4

    CVE-2025-47089 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  15. Medium 5.4

    CVE-2025-47088 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  16. Medium 5.4

    CVE-2025-47087 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  17. Medium 5.4

    CVE-2025-47086 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  18. Medium 5.4

    CVE-2025-47085 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  19. Medium 5.4

    CVE-2025-47084 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  20. Medium 5.4

    CVE-2025-47083 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  21. Medium 5.4

    CVE-2025-47082 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  22. Medium 5.4

    CVE-2025-47081 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  23. Medium 5.4

    CVE-2025-47080 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  24. Medium 5.4

    CVE-2025-47079 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  25. Medium 5.4

    CVE-2025-47078 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  26. Medium 5.4

    CVE-2025-47077 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  27. Medium 5.4

    CVE-2025-47076 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  28. Medium 5.4

    CVE-2025-47075 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  29. Medium 5.4

    CVE-2025-47074 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  30. Medium 5.4

    CVE-2025-47073 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  31. Medium 5.4

    CVE-2025-47072 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  32. Medium 5.4

    CVE-2025-47071 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  33. Medium 5.4

    CVE-2025-47070 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  34. Medium 5.4

    CVE-2025-47069 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  35. Medium 5.4

    CVE-2025-47068 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  36. Medium 5.4

    CVE-2025-47067 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  37. Medium 5.4

    CVE-2025-47066 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  38. Medium 5.4

    CVE-2025-47065 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  39. Medium 5.4

    CVE-2025-47063 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  40. Medium 5.4

    CVE-2025-47062 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  41. Medium 5.4

    CVE-2025-47060 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  42. Medium 5.4

    CVE-2025-47057 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  43. Medium 5.4

    CVE-2025-47056 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  44. Medium 5.4

    CVE-2025-47055 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  45. Medium 5.4

    CVE-2025-47052 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  46. Medium 5.4

    CVE-2025-47051 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  47. Medium 5.4

    CVE-2025-47050 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  48. Medium 6.1

    CVE-2025-47049 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a specially crafted web page.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  49. Medium 5.4

    CVE-2025-47048 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  50. Medium 5.4

    CVE-2025-47047 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.