Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

676 results · page 11 of 14

Mar 18, 2022One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distCVE-2022-1003 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.3
One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capabilities in a way that allows them to override certain restricted configurations like EnableUploads.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Mar 18, 2022Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with specialCVE-2022-1002 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2
Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with special permissions to invite guest users to inject unescaped HTML content in the email invitations.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com mattermost.com
Mar 10, 2022A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting CVE-2022-0904 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted Apple Pages document.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Mar 10, 2022A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitCVE-2022-0903 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.3
A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted POST body.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Feb 21, 2022Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access CVE-2022-0708 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jan 18, 2022Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorizCVE-2021-37867 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure.
Product
Mattermost Boards
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jan 18, 2022Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reusCVE-2021-37866 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.7
Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.
Product
Mattermost Boards
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com whitesourcesoftware.com
Jan 18, 2022Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated uCVE-2021-37865 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com mattermost.com
Jan 18, 2022Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archCVE-2021-37864 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.6
Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Dec 17, 2021Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of CVE-2021-37863 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.5
Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com mattermost.com
Dec 17, 2021Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attCVE-2021-37862 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.7
Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com mattermost.com
Dec 9, 2021Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.CVE-2021-37861 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 5.8
Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Sep 22, 2021Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product dCVE-2021-37860 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.7
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Aug 5, 2021Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.CVE-2021-37859 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comHigh 7.1
Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 26, 2020An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS.CVE-2020-13891 · Other software · Mattermost · reported by MITREHigh 7.5
An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party servers could sometimes obtain authorization tokens, aka MMSA-2020-0022.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2.CVE-2017-18921 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.6.2.CVE-2017-18920 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3.CVE-2017-18919 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5.CVE-2017-18918 · Other software · Mattermost · reported by MITREMedium 4.9
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18917 · Other software · Mattermost · reported by MITREHigh 7.5
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18916 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18915 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18914 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7.CVE-2017-18913 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2.CVE-2017-18908 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2.CVE-2017-18907 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used.CVE-2017-18906 · Other software · Mattermost · reported by MITREHigh 8.1
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.CVE-2017-18905 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 2.1.0.CVE-2016-11084 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 2.2.0.CVE-2016-11083 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 2.2.0.CVE-2016-11082 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 2.2.0.CVE-2016-11081 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11080 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11079 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11078 · Other software · Mattermost · reported by MITREMedium 6.5
An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11077 · Other software · Mattermost · reported by MITRELow 2.7
An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11076 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11075 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11074 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.0.CVE-2016-11073 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.0.2.CVE-2016-11072 · Other software · Mattermost · reported by MITREMedium 6.5
An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.1.0.CVE-2016-11071 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.1.0.CVE-2016-11070 · Other software · Mattermost · reported by MITREMedium 5.4
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.2.0.CVE-2016-11069 · Other software · Mattermost · reported by MITREHigh 7.5
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.2.0.CVE-2016-11068 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.2.0.CVE-2016-11067 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.2.0.CVE-2016-11066 · Other software · Mattermost · reported by MITREHigh 7.5
An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.3.0.CVE-2016-11065 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Desktop App before 3.4.0.CVE-2016-11064 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
Product
Mattermost Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 3.5.1.CVE-2016-11063 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.
Product
Mattermost Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.