UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
38,084
Published in 7 days
645
Critical in 30 days
387
Actively exploited
420

Latest vulnerabilities

38,084 vulnerabilities
  1. Medium 6.1

    CVE-2025-0376 · GitLab

    An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an attacker to execute unauthorized actions via a change page.

    Published 12 Feb 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  2. Medium 6.5

    CVE-2024-12379 · GitLab

    A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to impact the availability of GitLab via unbounded symbol creation via the scopes parameter in a Personal Access Token.

    Published 12 Feb 2025 · Fixed in 17.6.5, 17.7.4, 17.8.2 · NVD
  3. Medium 4.3

    CVE-2024-13229 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Improper Access Control

    Published 12 Feb 2025 · Fixed in 1.0.236 · WPVulnerability
  4. Medium 6.4

    CVE-2024-13227 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 12 Feb 2025 · Fixed in 1.0.236 · WPVulnerability
  5. Medium 5.4

    CVE-2024-54772 · MikroTik RouterOS

    An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18. A discrepancy in response size between connection attempts made with a valid username and those with an invalid username allows attackers to enumerate for valid accounts.

    Published 11 Feb 2025 · Fixed in 6.49.18, 7.18 · NVD
  6. High 8.7

    CVE-2025-24438 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · NVD
  7. Medium 5.4

    CVE-2025-24437 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to view or modify select information. Exploitation of this issue does not require user interaction.

    Published 11 Feb 2025 · NVD
  8. Medium 4.3

    CVE-2025-24436 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to view select information. Exploitation of this issue does not require user interaction.

    Published 11 Feb 2025 · NVD
  9. Medium 4.3

    CVE-2025-24435 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to modify limited fields. Exploitation of this issue does not require user interaction.

    Published 11 Feb 2025 · NVD
  10. Critical 9.1

    CVE-2025-24434 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. A successful attacker can abuse this to…

    Published 11 Feb 2025 · NVD
  11. Low 3.7

    CVE-2025-24432 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this race condition to alter a condition after it has been checked but before it is used, potentially bypassing rate limiting mechanisms. Exploitation…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  12. Low 3.7

    CVE-2025-24430 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this race condition to alter a condition after it has been checked but before it is used, potentially bypassing rate limiting mechanisms. Exploitation…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  13. Low 3.5

    CVE-2025-24429 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass allowing read only access. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction.

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  14. Medium 5.4

    CVE-2025-24428 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  15. Medium 6.5

    CVE-2025-24427 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  16. Medium 5.3

    CVE-2025-24425 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Business Logic Error vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to circumvent intended security mechanisms by manipulating the logic of the application's operations causing limited data modification. Exploitation of this issue…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  17. Medium 4.3

    CVE-2025-24421 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to read select data. Exploitation of this issue does not require user interaction

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  18. High 8.7

    CVE-2025-24417 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  19. High 8.7

    CVE-2025-24416 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  20. High 8.7

    CVE-2025-24415 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  21. High 8.7

    CVE-2025-24414 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  22. High 8.7

    CVE-2025-24413 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  23. High 8.7

    CVE-2025-24412 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  24. High 8.1

    CVE-2025-24411 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access affecting Confidentiality and Integrity. Exploitation of this issue does not require…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  25. High 8.7

    CVE-2025-24410 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  26. High 8.2

    CVE-2025-24409 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both a High impact to confidentiality and Low impact to integrity. Exploitation of this…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  27. Medium 6.5

    CVE-2025-24408 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Information Exposure vulnerability that could result in privilege escalation. A low-privileged attacker could gain unauthorized access to sensitive information. Exploitation of this issue does not require user interaction.

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  28. High 7.5

    CVE-2025-24406 · Magento / Adobe Commerce

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a security feature bypass. An unauthenticated attacker could exploit this vulnerability to modify files that are stored outside the restricted directory. Exploitation of this…

    Published 11 Feb 2025 · Fixed in 2.4.4 · NVD
  29. Medium 4.3

    CVE-2019-15002 · Jira

    An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require a CSRF token. As a result, an attacker can log a user into the system under an unexpected account.

    Published 11 Feb 2025 · NVD
  30. High 8.1Actively exploited

    CVE-2025-24472 · Fortinet FortiProxy, Fortinet FortiOS

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via…

    Published 11 Feb 2025 · Fixed in 7.0.17, 7.0.20, 7.2.13 · NVD
  31. High 7.2

    CVE-2024-50569 · Fortinet FortiWeb

    A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.0.0 through 7.6.0 allows attacker to execute unauthorized code or commands via crafted input.

    Published 11 Feb 2025 · Fixed in 7.4.6 · NVD
  32. High 7.2

    CVE-2024-50567 · Fortinet FortiWeb

    An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.4.0 through 7.6.0 allows attacker to execute unauthorized code or commands via crafted input.

    Published 11 Feb 2025 · Fixed in 7.4.6 · NVD
  33. High 7.2

    CVE-2024-40591 · Fortinet FortiOS

    An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.15 allows an authenticated admin whose access profile has the Security Fabric permission to escalate their privileges to super-admin by connecting the targetted FortiGate to a malicious upstream FortiGate they control.

    Published 11 Feb 2025 · Fixed in 7.0.16, 7.2.10, 7.4.5 · NVD
  34. High 8.1

    CVE-2024-35279 · Fortinet FortiOS

    A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.4 through 7.2.8 and version 7.4.0 through 7.4.4 allows a remote unauthenticated attacker to execute arbitrary code or commands via crafted UDP packets through the CAPWAP control, provided the attacker were able to evade FortiOS stack protections and provided the fabric service is running on the exposed interface.

    Published 11 Feb 2025 · Fixed in 7.2.9, 7.4.5 · NVD
  35. Critical 9.0

    CVE-2024-27781 · Fortinet FortiSandbox

    An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP…

    Published 11 Feb 2025 · Fixed in 4.0.5, 4.2.7, 4.4.5 · NVD
  36. Medium 6.7

    CVE-2023-40721 · Fortinet FortiProxy, Fortinet FortiOS

    A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests.

    Published 11 Feb 2025 · Fixed in 7.0.15, 7.2.7, 7.2.8 · NVD
  37. High 8.8

    CVE-2025-22467 · Ivanti Connect Secure

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution.

    Published 11 Feb 2025 · NVD
  38. Medium 4.4

    CVE-2024-13843 · Ivanti Connect Secure

    Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to read sensitive data.

    Published 11 Feb 2025 · NVD
  39. Medium 4.4

    CVE-2024-13842 · Ivanti Connect Secure

    A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to read sensitive data.

    Published 11 Feb 2025 · NVD
  40. Medium 6.1

    CVE-2024-13830 · Ivanti Connect Secure

    Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required.

    Published 11 Feb 2025 · Fixed in 22.7 · NVD
  41. Medium 4.9

    CVE-2024-12058 · Ivanti Connect Secure

    External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to read arbitrary files.

    Published 11 Feb 2025 · Fixed in 22.7 · NVD
  42. High 7.2

    CVE-2024-10644 · Ivanti Connect Secure

    Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

    Published 11 Feb 2025 · Fixed in 22.7 · NVD
  43. Medium 6.1

    CVE-2025-26493 · TeamCity

    In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab

    Published 11 Feb 2025 · Fixed in 2024.12.2 · NVD
  44. Critical 9.1

    CVE-2025-26492 · TeamCity

    In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources

    Published 11 Feb 2025 · Fixed in 2024.12.2 · NVD
  45. Medium 5.4

    CVE-2025-24892 · OpenProject

    Stored HTML injection

    Published 10 Feb 2025 · Fixed in 15.2.1 · NVD, Project advisories (GitHub)
  46. Low 2.6

    CVE-2025-25183 · vLLM

    vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Maliciously constructed statements can lead to hash collisions, resulting in cache reuse, which can interfere with subsequent responses and cause unintended behavior. Prefix caching makes use of Python's built-in hash() function. As of Python 3.12, the behavior of hash(None) has changed to be a predictable…

    Published 7 Feb 2025 · Fixed in 0.7.2 · NVD
  47. Medium 6.1

    CVE-2024-10383 · GitLab

    An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343and used by all versions of GitLab CE/EE starting from 15.11 prior to 17.3 and which also temporarily affected versions 17.4, 17.5 and 17.6, where a XSS attack was possible when loading .ipynb files in the web IDE

    Published 7 Feb 2025 · Fixed in 17.3.0 · NVD
  48. Medium 6.5

    CVE-2025-1072 · GitLab

    A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior to 17.4.4, and 17.5 prior to 17.5.2. A denial of service could occur upon importing maliciously crafted content using the Fogbugz importer.

    Published 7 Feb 2025 · Fixed in 17.4.4, 17.5.2, 17.7.3 · NVD
  49. High 7.5

    CVE-2024-57610 · Sylius

    A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account compromise and denial of service for legitimate users. The Supplier's position is that the Sylius core software is not intended to address brute-force attacks; instead, customers deploying a Sylius-based system are supposed to…

    Published 6 Feb 2025 · NVD
  50. Medium 5.1

    CVE-2025-24320 · F5 BIG-IP

    A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. This vulnerability is due to an incomplete fix for CVE-2024-31156 https://my.f5.com/manage/s/article/K000138636 .  Note: Software versions which have reached End of Technical Support (EoTS)…

    Published 5 Feb 2025 · Fixed in 15.1.10.6, 16.1.5.2, 17.1.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.