UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
11,047
Published in 7 days
181
Critical in 30 days
41
Actively exploited
62

Latest vulnerabilities

11,047 vulnerabilities
  1. Low 1.2

    CVE-2025-61646 · MediaWiki

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    Published 3 Feb 2026 · Fixed in 1.39.14, 1.43.4 · NVD
  2. Unrated

    CVE-2025-61645 · MediaWiki

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/pager/CodexTablePager.Php. This issue affects MediaWiki: from * before 1.44.1.

    Published 3 Feb 2026 · Fixed in 1.44.1 · NVD
  3. Unrated

    CVE-2025-11261 · MediaWiki

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js. This issue affects MediaWiki: from * before 1.39.15, 1.43.5, 1.44.2.

    Published 3 Feb 2026 · Fixed in 1.39.15, 1.43.5, 1.44.2 · NVD
  4. Low 2.7

    CVE-2025-61643 · MediaWiki

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/recentchanges/RecentChangeRCFeedNotifier.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    Published 3 Feb 2026 · Fixed in 1.39.14, 1.43.4 · NVD
  5. Unrated

    CVE-2025-61642 · MediaWiki

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/CodexHTMLForm.Php, includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    Published 3 Feb 2026 · Fixed in 1.39.14, 1.43.4 · NVD
  6. Low 1.7

    CVE-2025-61641 · MediaWiki

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiQueryAllPages.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    Published 3 Feb 2026 · Fixed in 1.39.14, 1.43.4 · NVD
  7. Unrated

    CVE-2025-61640 · MediaWiki

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/RclToOrFromWidget.Js. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    Published 3 Feb 2026 · Fixed in 1.39.14, 1.43.4, 1.44.1 · NVD
  8. Low 1.7

    CVE-2025-61639 · MediaWiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/ManualLogEntry.Php, includes/recentchanges/RecentChangeFactory.Php, includes/recentchanges/RecentChangeStore.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    Published 3 Feb 2026 · Fixed in 1.39.14, 1.43.4, 1.44.1 · NVD
  9. Unrated

    CVE-2025-61638 · MediaWiki

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Parsoid: from * before 0.16.6, 0.20.4, 0.21.1.

    Published 3 Feb 2026 · Fixed in 1.39.14, 1.43.4, 1.44.1 · NVD
  10. Unrated

    CVE-2025-61637 · MediaWiki

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Action/mediawiki.Action.Edit.Preview.Js, resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    Published 3 Feb 2026 · Fixed in 1.39.14, 1.43.4, 1.44.1 · NVD
  11. Unrated

    CVE-2025-61636 · MediaWiki

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    Published 3 Feb 2026 · Fixed in 1.39.14, 1.43.4, 1.44.1 · NVD
  12. Unrated

    CVE-2025-61634 · MediaWiki

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handler/PageHTMLHandler.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    Published 3 Feb 2026 · Fixed in 1.39.14, 1.43.4, 1.44.1 · NVD
  13. Low 3.1

    CVE-2026-1751 · GitLab

    A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could have allowed unauthorized edits to merge request approval rules under certain conditions.

    Published 2 Feb 2026 · Fixed in 18.5.0 · NVD
  14. Medium 6.5

    CVE-2026-24742 · Discourse

    Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and secrets, API key details, site setting changes, private message content, restricted category names and…

    Published 28 Jan 2026 · Fixed in 3.5.4, 2025.11.2 · NVD
  15. Medium 6.9

    CVE-2026-23743 · Discourse

    Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, permalinks pointing to access-restricted resources (private topics, categories, posts, or hidden tags) were redirecting users to URLs containing the resource slug, even when the user didn't have access to view the resource. This leaked potentially sensitive information (e.g., private…

    Published 28 Jan 2026 · Fixed in 3.5.4, 2025.11.2 · NVD
  16. Medium 6.5

    CVE-2026-21865 · Discourse

    Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can convert some personal messages to public topics when they shouldn't have access. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, site admin can temporarily revoke the moderation role from untrusted moderators or remove the…

    Published 28 Jan 2026 · Fixed in 3.5.4, 2025.11.2 · NVD
  17. Medium 5.1

    CVE-2025-69289 · Discourse

    Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows a non-admin moderator to bypass email-change restrictions, allowing a takeover of non-staff accounts. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, ensure moderators are trusted or enable the…

    Published 28 Jan 2026 · Fixed in 3.5.4, 2025.11.2 · NVD
  18. High 7.1

    CVE-2025-69218 · Discourse

    Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can access the `top_uploads` admin report which should be restricted to admins only. This report displays direct URLs to all uploaded files on the site, including sensitive content such as user data exports, admin backups, and other private attachments that moderators…

    Published 28 Jan 2026 · Fixed in 3.5.4, 2025.11.2 · NVD
  19. Medium 6.5

    CVE-2025-68934 · Discourse

    Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, authenticated users can submit crafted payloads to /drafts.json that cause O(n^2) processing in Base62.decode, tying up workers for 35-60 seconds per request. This affects all users as the shared worker pool becomes exhausted. This issue is patched in versions 3.5.4, 2025.11.2,…

    Published 28 Jan 2026 · Fixed in 3.5.4, 2025.11.2 · NVD
  20. Medium 5.4

    CVE-2025-68933 · Discourse

    Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators with the `moderators_change_post_ownership` setting enabled can change ownership of posts in private messages and restricted categories they cannot access, then export their data to view the content. This is a broken access control vulnerability affecting sites…

    Published 28 Jan 2026 · Fixed in 3.5.4, 2025.11.2 · NVD
  21. Medium 5.9

    CVE-2025-68666 · Discourse

    Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, users archives are viewable by users with moderation privileges even though moderators should not have access to the archives. Private topic/post content made by the users are leaked through the archives leading to a breach of confidentiality. This issue is patched in versions 3.5.4,…

    Published 28 Jan 2026 · Fixed in 3.5.4, 2025.11.2 · NVD
  22. Critical 9.9

    CVE-2025-68662 · Discourse

    Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination could allow bypassing SSRF protections under certain conditions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.

    Published 28 Jan 2026 · Fixed in 3.5.4, 2025.11.2 · NVD
  23. Medium 5.3

    CVE-2025-68660 · Discourse

    Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, an endpoint lets any authenticated user bypass the ai_discover_persona access controls and gain ongoing DM access to personas that may be wired to staff-only categories, RAG document sets, or automated tooling, enabling unauthorized data disclosure. Because the controller also accepts…

    Published 28 Jan 2026 · Fixed in 3.5.4, 2025.11.2 · NVD
  24. Medium 5.3

    CVE-2025-68659 · Discourse

    Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have an application level denial of service vulnerabilityin the username change functionality at try.discourse.org. The vulnerability allows attackers to cause noticeable server delays and resource exhaustion by sending large JSON payloads to the username preference endpoint PUT…

    Published 28 Jan 2026 · Fixed in 3.5.4, 2025.11.2 · NVD
  25. Medium 5.3

    CVE-2025-68479 · Discourse

    Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, some subscription endpoints lack proper checking for ownership before making changes. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.

    Published 28 Jan 2026 · Fixed in 3.5.4, 2025.11.2 · NVD
  26. Medium 5.4

    CVE-2025-67723 · Discourse

    Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-site scriptinv vulnerability on the Discourse Math plugin when using its KaTeX variant. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, the Discourse Math plugin can be disabled, or the Mathjax…

    Published 28 Jan 2026 · Fixed in 3.5.4, 2025.11.2 · NVD
  27. Medium 6.1

    CVE-2025-66488 · Discourse

    Discourse is an open source discussion platform. A vulnerability present in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 affects anyone who uses S3 for uploads. While scripts may be executed, they will only be run in the context of the S3/CDN domain, with no site credentials. Versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 fix the issue. As a workaround, disallow html or xml…

    Published 28 Jan 2026 · Fixed in 3.5.4, 2025.11.2 · NVD
  28. High 7.5

    GHSA-h25m-26qc-wcjf · Next.js

    Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

    Published 28 Jan 2026 · Fixed in 15.6.0-canary.61, 16.0.11, 16.1.5 · OSV.dev and GitHub
  29. Medium 5.9

    CVE-2025-59472 · Next.js

    Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

    Published 28 Jan 2026 · Fixed in 15.6.0-canary.61, 16.1.5 · OSV.dev and GitHub
  30. Medium 5.9

    CVE-2025-59471 · Next.js

    Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration

    Published 27 Jan 2026 · Fixed in 15.5.10, 16.1.5 · OSV.dev and GitHub
  31. Medium 5.3

    CVE-2026-22796 · OpenSSL

    Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the…

    Published 27 Jan 2026 · Fixed in 3.4.4, 3.5.5, 3.6.1 · NVD
  32. Medium 5.5

    CVE-2026-22795 · OpenSSL

    Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed…

    Published 27 Jan 2026 · Fixed in 3.4.4, 3.5.5, 3.6.1 · NVD
  33. High 7.5

    CVE-2025-69421 · OpenSSL

    Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files. The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When…

    Published 27 Jan 2026 · Fixed in 3.4.4, 3.5.5, 3.6.1 · NVD
  34. High 7.5

    CVE-2025-69420 · OpenSSL

    Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An application calling TS_RESP_verify_response() with a malformed TimeStamp Response can be caused to…

    Published 27 Jan 2026 · Fixed in 3.4.4, 3.5.5, 3.6.1 · NVD
  35. High 7.4

    CVE-2025-69419 · OpenSSL

    Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service. The OPENSSL_uni2utf8()…

    Published 27 Jan 2026 · Fixed in 3.4.4, 3.5.5, 3.6.1 · NVD
  36. Medium 4.0

    CVE-2025-69418 · OpenSSL

    Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and unauthenticated.<br><br>Impact summary: The trailing 1-15 bytes of a message may be exposed in<br>cleartext on encryption and are not covered by the authentication tag,<br>allowing…

    Published 27 Jan 2026 · Fixed in 3.4.4, 3.5.5, 3.6.1 · NVD
  37. Medium 4.7

    CVE-2025-68160 · OpenSSL

    Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in a crash, leading to Denial of Service for an application. The line-buffering BIO filter (BIO_f_linebuffer) is not used…

    Published 27 Jan 2026 · Fixed in 3.4.4, 3.5.5, 3.6.1 · NVD
  38. Medium 5.9

    CVE-2025-66199 · OpenSSL

    Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of…

    Published 27 Jan 2026 · Fixed in 3.4.4, 3.5.5, 3.6.1 · NVD
  39. Medium 5.5

    CVE-2025-15469 · OpenSSL

    Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms (such as Ed25519, Ed448, or ML-DSA) may believe the entire file is authenticated while trailing data beyond 16MB remains…

    Published 27 Jan 2026 · Fixed in 3.5.5, 3.6.1 · NVD
  40. Medium 5.9

    CVE-2025-15468 · OpenSSL

    Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Service. Some applications call SSL_CIPHER_find() from the client_hello_cb callback on the cipher ID…

    Published 27 Jan 2026 · Fixed in 3.4.4, 3.5.5, 3.6.1 · NVD
  41. High 8.8

    CVE-2025-15467 · OpenSSL

    Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector)…

    Published 27 Jan 2026 · Fixed in 3.4.4, 3.5.5, 3.6.1 · NVD
  42. Medium 6.1

    CVE-2025-11187 · OpenSSL

    Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification. Impact summary: The stack buffer overflow or NULL pointer dereference may cause a crash leading to Denial of Service for an application that parses untrusted PKCS#12 files. The buffer overflow may also…

    Published 27 Jan 2026 · Fixed in 3.4.4, 3.5.5, 3.6.1 · NVD
  43. High 7.5

    CVE-2026-1102 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an unauthenticated user to create a denial of service condition by sending repeated malformed SSH authentication requests.

    Published 22 Jan 2026 · Fixed in 18.6.4, 18.7.2, 18.8.2 · NVD
  44. High 7.4

    CVE-2026-0723 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an individual with existing knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses.

    Published 22 Jan 2026 · Fixed in 18.6.4, 18.7.2, 18.8.2 · NVD
  45. High 7.5

    CVE-2025-13928 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an unauthenticated user to cause a denial of service condition by exploiting incorrect authorization validation in API endpoints.

    Published 22 Jan 2026 · Fixed in 18.6.4, 18.7.2, 18.8.2 · NVD
  46. High 7.5

    CVE-2025-13927 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.9 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an unauthenticated user to create a denial of service condition by sending crafted requests with malformed authentication data.

    Published 22 Jan 2026 · Fixed in 18.6.4, 18.7.2, 18.8.2 · NVD
  47. Medium 6.5

    CVE-2025-13335 · GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that under certain circumstances could have allowed an authenticated user to create a denial of service condition by configuring malformed Wiki documents that bypass cycle detection.

    Published 22 Jan 2026 · Fixed in 18.6.4, 18.7.2, 18.8.2 · NVD
  48. Medium 6.3

    CVE-2025-12781 · Python

    When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend…

    Published 21 Jan 2026 · Fixed in 3.13.10, 3.14.1 · NVD
  49. Medium 6.5

    CVE-2026-21968 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a…

    Published 20 Jan 2026 · NVD
  50. Low 2.7

    CVE-2026-21965 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service…

    Published 20 Jan 2026 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every hour, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.