Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,898 results · page 19 of 58
Oct 14, 2025Uncaught exception in Microsoft Office allows an unauthorized attacker to deny service locally.CVE-2025-59229 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Uncaught exception in Microsoft Office allows an unauthorized attacker to deny service locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-59228 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-59227 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.CVE-2025-59226 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-59225 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-59224 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-59223 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-59222 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-59221 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Denial of service (DoS) vulnerability in the office service.CVE-2025-58292 · Other software · Huawei · reported by psirt@huawei.comLow 3.3
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Denial of service (DoS) vulnerability in the office service.CVE-2025-58291 · Other software · Huawei · reported by psirt@huawei.comLow 3.3
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Denial of service (DoS) vulnerability in the office service.CVE-2025-58290 · Other software · Huawei · reported by psirt@huawei.comLow 3.3
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Denial of service (DoS) vulnerability in the office service.CVE-2025-58288 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Use After Free (UAF) vulnerability in the office service.CVE-2025-58287 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
Use After Free (UAF) vulnerability in the office service. Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Denial of service (DoS) vulnerability in the office service.CVE-2025-58286 · Other software · Huawei · reported by psirt@huawei.comLow 3.3
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2025A flaw has been found in JSC R7 R7-Office Document Server up to 20250820.CVE-2025-10777 · Other software · JSC R7 · reported by VulDBLow 2.1
A flaw has been found in JSC R7 R7-Office Document Server up to 20250820. Impacted is an unknown function of the file /downloadas/. Executing manipulation of the argument cmd can lead to path traversal. The attack can be launched remotely. Upgrading to version 2025.3.1.923 is recommended to address this issue. The affected component should be upgraded. R7-Office is a fork of OpenOffice and at the moment it remains unclear if OpenOffice is affected as well. The OpenOffice team was not able to reproduce the issue in their codebase. The vendor replied: "We confirm that this vulnerability has been verified and patched in release 2025.3.1.923. During our security testing, it was not possible to exploit the issue - the server consistently returns proper error responses to the provided scenarios."
- Product
- R7-Office Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2025A vulnerability was found in Ooma Office Business Phone App up to 7.2.2 on Android.CVE-2025-10718 · Other software · Ooma · reported by VulDBLow 1.9
A vulnerability was found in Ooma Office Business Phone App up to 7.2.2 on Android. This affects an unknown part of the component com.ooma.office2. The manipulation results in improper export of android application components. The attack needs to be approached locally. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Office Business Phone App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025Cross Site Request Forgery (CSRF) vulnerability in Smartvista BackOffice SmartVista Suite 2.2.22 via crafted GET request.CVE-2025-50255 · Other software · reported by MITREHigh 7.8
Cross Site Request Forgery (CSRF) vulnerability in Smartvista BackOffice SmartVista Suite 2.2.22 via crafted GET request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025A vulnerability was determined in Ascensio System SIA OnlyOffice up to 12.7.0.CVE-2025-10255 · Other software · Ascensio System SIA · reported by VulDBLow 2
A vulnerability was determined in Ascensio System SIA OnlyOffice up to 12.7.0. Impacted is an unknown function of the file /Products/Projects/Messages.aspx of the component Comment Handler. Executing manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and replied: "We are already working on this case, and the issues will be resolved in one of the upcoming patches."
- Product
- OnlyOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025A vulnerability was found in Ascensio System SIA OnlyOffice up to 12.7.0.CVE-2025-10254 · Other software · Ascensio System SIA · reported by VulDBLow 2
A vulnerability was found in Ascensio System SIA OnlyOffice up to 12.7.0. This issue affects some unknown processing of the file /Products/Projects/Messages.aspx of the component SVG Image Handler. Performing manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was informed early about this issue and replied: "We are already working on this case, and the issues will be resolved in one of the upcoming patches."
- Product
- OnlyOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network.CVE-2025-55243 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.5
Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft OfficePLUS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-54910 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.CVE-2025-54908 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code locally.CVE-2025-54907 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-54906 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2025-54905 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-54904 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-54903 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-54902 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2025-54901 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-54900 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Free of memory not on the heap in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-54899 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Free of memory not on the heap in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-54898 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-54897 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-54896 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally.CVE-2025-53799 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.5
Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally.
- Product
- Microsoft Office for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin forCVE-2025-9219 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_post_smtp_pro_option_callback' function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable pro extensions.
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 25, 2025PhpOffice/PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.CVE-2025-54370 · Websites & servers · PHPOffice · reported by GitHubHigh 8.7
PhpOffice/PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0, SSRF can occur when a processed HTML document is read and displayed in the browser. The vulnerability lies in the setPath method of the PhpOffice\PhpSpreadsheet\Worksheet\Drawing class, where a crafted string from the user is passed to the HTML reader. This issue has been patched in versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and 5.0.0.
- Product
- PhpSpreadsheet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability.CVE-2025-53505 · Other software · Intermesh BV · reported by vultures@jpcert.or.jpMedium 5.3
Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability. If this vulnerability is exploited, information on the server hosting the product may be exposed.
- Product
- Group-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpgroup-office.com
Aug 21, 2025Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability.CVE-2025-53504 · Other software · Intermesh BV · reported by vultures@jpcert.or.jpMedium 4.8
Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.
- Product
- Group-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpgroup-office.com
Aug 12, 2025Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-53784 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.CVE-2025-53766 · Email & office · Microsoft · reported by secure@microsoft.comCritical 9.8
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Office for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.CVE-2025-53761 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2025-53760 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.1
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-53759 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-53741 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-53740 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-53739 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-53738 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-53737 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.