UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
37,973
Published in 7 days
841
Critical in 30 days
393
Actively exploited
420

Latest vulnerabilities

37,973 vulnerabilities
  1. Medium 5.4

    CVE-2025-46870 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  2. Medium 5.4

    CVE-2025-46866 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  3. Medium 5.4

    CVE-2025-46865 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  4. Medium 5.4

    CVE-2025-46864 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  5. Medium 5.4

    CVE-2025-46863 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  6. Medium 5.4

    CVE-2025-46862 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  7. Medium 5.4

    CVE-2025-46861 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  8. Medium 5.4

    CVE-2025-46860 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  9. Medium 5.4

    CVE-2025-46859 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  10. Medium 5.4

    CVE-2025-46858 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  11. Medium 5.4

    CVE-2025-46857 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  12. Medium 5.4

    CVE-2025-46855 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  13. Medium 5.4

    CVE-2025-46854 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  14. Medium 5.4

    CVE-2025-46853 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  15. Medium 5.4

    CVE-2025-46851 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  16. Medium 5.4

    CVE-2025-46850 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  17. Medium 5.4

    CVE-2025-46848 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  18. Medium 5.4

    CVE-2025-46847 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  19. Medium 5.4

    CVE-2025-46846 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  20. Medium 5.4

    CVE-2025-46845 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  21. Medium 5.4

    CVE-2025-46844 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  22. Medium 5.4

    CVE-2025-46843 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  23. Medium 5.4

    CVE-2025-46842 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  24. Medium 5.4

    CVE-2025-46841 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  25. High 8.7

    CVE-2025-46840 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction. A successful attacker can abuse this to achieve session takeover,…

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  26. Medium 5.4

    CVE-2025-46838 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  27. High 8.7

    CVE-2025-46837 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve…

    Published 10 Jun 2025 · Fixed in 6.5.23.0, 2025.5.0 · NVD
  28. Medium 4.3

    CVE-2025-25250 · Fortinet FortiOS

    An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiSASE 25.1.c may allow an authenticated user to access full SSL-VPN settings via crafted URL.

    Published 10 Jun 2025 · Fixed in 7.4.8 · NVD
  29. Medium 6.5

    CVE-2025-24471 · Fortinet FortiOS

    An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate.

    Published 10 Jun 2025 · Fixed in 7.4.8, 7.6.2 · NVD
  30. High 7.2

    CVE-2025-22254 · Fortinet FortiProxy, Fortinet FortiWeb, Fortinet FortiOS

    An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiWeb 7.6.0 through 7.6.1, FortiWeb 7.4.0 through 7.4.6 allows an authenticated attacker with at…

    Published 10 Jun 2025 · Fixed in 7.4.7, 7.4.8, 7.6.2 · NVD
  31. Medium 5.3

    CVE-2025-22251 · Fortinet FortiOS

    An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unauthorized sessions via crafted FGSP session synchronization packets.

    Published 10 Jun 2025 · Fixed in 7.4.6 · NVD
  32. Medium 5.9

    CVE-2024-50568 · Fortinet FortiProxy, Fortinet FortiOS

    A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 & FortiProxy version 7.4.0 through 7.4.3, 7.2.0 through 7.2.9 and before 7.0.16 allows an unauthenticated attacker with the knowledge of device specific data to spoof the identity of a downstream device of the security fabric via crafted TCP requests.

    Published 10 Jun 2025 · Fixed in 7.2.9, 7.2.10, 7.4.4 · NVD
  33. Medium 4.8

    CVE-2024-50562 · Fortinet FortiOS

    An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.

    Published 10 Jun 2025 · Fixed in 7.2.11, 7.4.8 · NVD
  34. High 8.8

    CVE-2024-43706 · Kibana

    Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.

    Published 10 Jun 2025 · NVD
  35. Low 2.3

    CVE-2023-29184 · Fortinet FortiProxy, Fortinet FortiOS

    An incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before & FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 allows a VDOM privileged attacker to add SSH key files on the system silently via crafted CLI requests.

    Published 10 Jun 2025 · Fixed in 7.0.9, 7.2.3 · NVD
  36. High 8.4

    CVE-2025-47110 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Scope is changed…

    Published 10 Jun 2025 · NVD
  37. High 8.1

    CVE-2025-43586 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized elevated access. Exploitation of this issue does not require user interaction.

    Published 10 Jun 2025 · NVD
  38. High 8.2

    CVE-2025-43585 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access leading to a limited impact to confidentiality and a high impact to integrity. Exploitation of this issue…

    Published 10 Jun 2025 · NVD
  39. Medium 5.3

    CVE-2025-27206 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited write access. Exploitation of this issue does not require user interaction.

    Published 10 Jun 2025 · NVD
  40. High 7.5

    CVE-2025-27819 · Apache Kafka

    In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster…

    Published 10 Jun 2025 · NVD
  41. High 8.8

    CVE-2025-27818 · Apache Kafka

    A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka clusters since Apache Kafka 2.0.0 (Kafka Connect 2.3.0). When…

    Published 10 Jun 2025 · Fixed in 3.9.1 · NVD
  42. High 7.5

    CVE-2025-27817 · Apache Kafka

    A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or…

    Published 10 Jun 2025 · Fixed in 3.9.1 · NVD
  43. Low 2.1

    CVE-2025-5895 · Metabase

    A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named…

    Published 9 Jun 2025 · NVD
  44. Low 2.1

    CVE-2025-5892 · Rocket.Chat

    A vulnerability, which was classified as problematic, has been found in RocketChat up to 7.6.1. This issue affects the function parseMessage of the file /apps/meteor/app/irc/server/servers/RFC2813/parseMessage.js. The manipulation of the argument line leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be…

    Published 9 Jun 2025 · NVD
  45. High 8.1

    CVE-2025-48877 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, Codepen is present in the default `allowed_iframes` site setting, and it can potentially auto-run arbitrary JS in the iframe scope, which is unintended. This issue is patched in version 3.4.4 of the…

    Published 9 Jun 2025 · Fixed in 3.4.4, 3.5.0 · NVD
  46. Medium 6.1

    CVE-2025-48062 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, certain invites via email may result in HTML injection in the email body if the topic title includes HTML. This includes inviting someone (without an account) to a PM and inviting someone (without an…

    Published 9 Jun 2025 · Fixed in 3.4.4, 3.5.0 · NVD
  47. High 8.7

    CVE-2025-48053 · Discourse

    Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, sending a malicious URL in a PM to a bot user can cause a reduced the availability of a Discourse instance. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the…

    Published 9 Jun 2025 · Fixed in 3.4.4, 3.5.0 · NVD
  48. High 7.5

    CVE-2025-5399 · curl

    Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application.

    Published 7 Jun 2025 · Fixed in 8.14.1 · NVD
  49. Medium 4.9

    CVE-2025-0620 · Samba

    A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.

    Published 6 Jun 2025 · Fixed in 4.21.6, 4.22.2 · NVD
  50. Medium 5.6

    CVE-2025-5745 · GNU C Library

    The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the…

    Published 5 Jun 2025 · Fixed in 2.40-136, 2.41-57 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.