UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,888
Published in 7 days
1,006
Critical in 30 days
358
Actively exploited
423

Latest vulnerabilities

39,888 vulnerabilities
  1. Medium 5.4

    CVE-2016-10767 · cPanel & WHM

    cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159).

    Published 5 Aug 2019 · Fixed in 56.0.39, 58.0.37, 60.0.25 · NVD
  2. Medium 6.3

    CVE-2017-18468 · cPanel & WHM

    cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).

    Published 5 Aug 2019 · Fixed in 58.0.45, 60.0.39, 62.0.17 · NVD
  3. Medium 4.3

    CVE-2017-18467 · cPanel & WHM

    cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229).

    Published 5 Aug 2019 · Fixed in 58.0.45, 60.0.39, 62.0.17 · NVD
  4. Low 2.7

    CVE-2017-18466 · cPanel & WHM

    cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).

    Published 5 Aug 2019 · Fixed in 58.0.45, 60.0.39, 62.0.17 · NVD
  5. Medium 4.4

    CVE-2017-18465 · cPanel & WHM

    cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).

    Published 5 Aug 2019 · Fixed in 58.0.45, 60.0.39, 62.0.17 · NVD
  6. Medium 4.9

    CVE-2017-18464 · cPanel & WHM

    cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226).

    Published 5 Aug 2019 · Fixed in 58.0.45, 60.0.39, 62.0.17 · NVD
  7. High 7.5

    CVE-2017-18462 · cPanel & WHM

    cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224).

    Published 5 Aug 2019 · Fixed in 58.0.45, 60.0.39, 62.0.17 · NVD
  8. High 8.8

    CVE-2019-14654 · Joomla!

    In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.

    Published 5 Aug 2019 · NVD
  9. High 7.5

    CVE-2019-7951 · Magento / Adobe Commerce

    An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint does not properly enforce parameters related to access control. This could be abused to leak customer information via crafted SOAP requests.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  10. High 7.5

    CVE-2019-7950 · Magento / Adobe Commerce

    An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unauthenticated user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially confidental information.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  11. Medium 6.5

    CVE-2019-7947 · Magento / Adobe Commerce

    A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  12. Medium 5.4

    CVE-2019-7945 · Magento / Adobe Commerce

    A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to modify currency symbols can inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  13. Medium 5.4

    CVE-2019-7944 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the Return Product comments field can inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  14. High 7.2

    CVE-2019-7942 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create or edit a product can execute arbitrary code via malicious XML layout updates.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  15. Medium 4.8

    CVE-2019-7940 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify store currency options to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  16. Medium 6.1

    CVE-2019-7939 · Magento / Adobe Commerce

    A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in malicious javascript execution in the victim's browser.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  17. Medium 4.8

    CVE-2019-7938 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify catalog price rules to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  18. Medium 4.8

    CVE-2019-7937 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to store product attributes to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  19. Medium 4.8

    CVE-2019-7936 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify content block titles to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  20. Medium 4.8

    CVE-2019-7935 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify content page titles to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  21. Medium 4.8

    CVE-2019-7934 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit newsletter templates to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  22. High 7.2

    CVE-2019-7932 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create sitemaps can execute arbitrary PHP code by creating a malicious sitemap file.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  23. High 7.2

    CVE-2019-7930 · Magento / Adobe Commerce

    A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to the import feature can make modifications to a configuration file, resulting in potentially unauthorized removal of file upload restrictions. This can result in arbitrary code execution when a malicious file is then…

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  24. Medium 4.9

    CVE-2019-7929 · Magento / Adobe Commerce

    An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges may be able to view metadata of a trusted device used by another administrator via a crafted http request.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  25. High 7.5

    CVE-2019-7928 · Magento / Adobe Commerce

    A denial-of-service (DoS) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. By abusing insufficient brute-forcing defenses in the token exchange protocol, an unauthenticated attacker could disrupt transactions between the Magento merchant and PayPal.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  26. Medium 4.8

    CVE-2019-7927 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit product content pages to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  27. Medium 4.8

    CVE-2019-7926 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify node attributes to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  28. Medium 4.9

    CVE-2019-7925 · Magento / Adobe Commerce

    An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  29. High 7.2

    CVE-2019-7923 · Magento / Adobe Commerce

    A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by authenticated user with admin privileges to manipulate shipment settings to execute arbitrary code.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  30. Medium 5.4

    CVE-2019-7921 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the product catalog form of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to the product catalog to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  31. High 7.5

    CVE-2019-7915 · Magento / Adobe Commerce

    A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Under certain conditions, an unauthenticated attacker could force the Magento store's full page cache to serve a 404 page to customers.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  32. High 7.2

    CVE-2019-7913 · Magento / Adobe Commerce

    A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to manipulate shipment methods to execute arbitrary code.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  33. High 7.2

    CVE-2019-7912 · Magento / Adobe Commerce

    A file upload filter bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to edit configuration keys to remove file extension filters, potentially resulting in the malicious upload and execution of malicious files on the server.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  34. High 7.2

    CVE-2019-7911 · Magento / Adobe Commerce

    A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to the admin panel to manipulate system configuration and execute arbitrary code.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  35. Medium 4.8

    CVE-2019-7909 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to email templates.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  36. Medium 4.8

    CVE-2019-7908 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify product information.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  37. Medium 6.5

    CVE-2019-7904 · Magento / Adobe Commerce

    Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make unauthorized environment configuration changes.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  38. High 7.2

    CVE-2019-7903 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to email templates can execute arbitrary code by previewing a malicious template.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  39. Medium 5.3

    CVE-2019-7899 · Magento / Adobe Commerce

    Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  40. Medium 5.3

    CVE-2019-7898 · Magento / Adobe Commerce

    Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to inadequate validation of user input.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  41. Medium 4.8

    CVE-2019-7897 · Magento / Adobe Commerce

    A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to customer configurations to inject malicious javascript.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  42. High 7.2

    CVE-2019-7896 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to layouts can execute arbitrary code through a combination of product import, crafted csv file and XML layout update.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  43. High 7.2

    CVE-2019-7895 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to layouts can execute arbitrary code through a crafted XML layout update.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  44. High 7.2

    CVE-2019-7892 · Magento / Adobe Commerce

    A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to access shipment settings can execute arbitrary code via server-side request forgery.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  45. High 7.3

    CVE-2019-7890 · Magento / Adobe Commerce

    An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  46. Medium 6.5

    CVE-2019-7889 · Magento / Adobe Commerce

    An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with marketing manipulation privileges can invoke methods that alter data of the underlying model followed by corresponding database modifications.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  47. Medium 6.5

    CVE-2019-7888 · Magento / Adobe Commerce

    An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to create email templates could leak sensitive data via a malicious email template.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  48. Medium 4.8

    CVE-2019-7887 · Magento / Adobe Commerce

    A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 when the feature that adds a secret key to the Admin URL is disabled.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  49. High 7.5

    CVE-2019-7886 · Magento / Adobe Commerce

    A cryptograhic flaw exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A weak cryptograhic mechanism is used to generate the intialization vector in multiple security relevant contexts.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD
  50. High 8.8

    CVE-2019-7885 · Magento / Adobe Commerce

    Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure the catalog search.

    Published 2 Aug 2019 · Fixed in 2.1.18, 2.2.9, 2.3.2 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.