Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
88 results · page 2 of 2
Sep 5, 2023The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2.CVE-2023-41317 · Other software · apollographql · reported by GitHubHigh 7.5
The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are enabled. It can be triggered when **all of the following conditions are met**: 1. Running Apollo Router v1.28.0, v1.28.1 or v1.29.0 ("impacted versions"); **and** 2. The Supergraph schema provided to the Router (either via Apollo Uplink or explicitly via other configuration) **has a `subscription` type** with root-fields defined; **and** 3. The YAML configuration provided to the Router **has subscriptions enabled** (they are _disabled_ by default), either by setting `enabled: true` _or_ by setting a valid `mode` within the `subscriptions` object (as seen in [subscriptions' documentation](https://www.apollographql.com/docs/router/executing-operations/subscription-support/#router-setup)); **and** 4. An [anonymous](https://spec.graphql.org/draft/#sec-Anonymous-Operation-Definitions) (i.e., un-named) `subscription` operation (e.g., `subscription { ... }`) is received by the Router If **all
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2023Apollo is a configuration management system.CVE-2023-25570 · Other software · apolloconfig · reported by GitHubHigh 7.5
Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose apollo-configservice to the internet, which is not recommended. This is because there is no authentication feature enabled for the built-in eureka service. Malicious hackers may access eureka directly to mock apollo-configservice and apollo-adminservice. Login authentication for eureka was added in version 2.1.0. As a workaround, avoid exposing apollo-configservice to the internet.
- Product
- apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2023Apollo is a configuration management system.CVE-2023-25569 · Other software · apolloconfig · reported by GitHubMedium 5.7
Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.
- Product
- apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2023A cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to execute arbitrary web scripts or HTML via aCVE-2022-44897 · Other software · Apollotheme · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the show_number parameter.
- Product
- AP Pagebuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2023A vulnerability, which was classified as critical, was found in abreen Apollo.CVE-2015-10043 · Other software · abreen · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in abreen Apollo. This affects an unknown part. The manipulation of the argument file leads to path traversal. The patch is named 6206406630780bbd074aff34f4683fb764faba71. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218307.
- Product
- Apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop aCVE-2022-22897 · Other software · Apollotheme · reported by MITRECritical 9.8
A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.
- Product
- AP Pagebuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comfriends-of-presta.github.io
Oct 5, 2021A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting fromCVE-2021-39880 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021Apollos Apps is an open source platform for launching church-related apps.CVE-2021-32691 · Other software · ApollosProject · reported by GitHubHigh 8.8
Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages (such as giving and events). There is a patch in version 2.20.0. As a workaround, one can patch one's server by overriding the `create` data source method on the `People` class.
- Product
- apollos-apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2021The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so uploadssCVE-2021-26576 · Other software · HPE · reported by security-alert@hpe.comHigh 7.8
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so uploadsshkey function.
- Product
- Baseboard Management Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 8, 2021The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so uploadsshkey functCVE-2021-26577 · Other software · HPE · reported by security-alert@hpe.comHigh 7.8
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so uploadsshkey function.
- Product
- Baseboard Management Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 8, 2021The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in libifc.so webdeletesoCVE-2021-26575 · Other software · HPE · reported by security-alert@hpe.comHigh 7.8
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in libifc.so webdeletesolvideofile function.
- Product
- Baseboard Management Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 8, 2021The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in libifc.so webdeleteviCVE-2021-26574 · Other software · HPE · reported by security-alert@hpe.comHigh 7.8
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in libifc.so webdeletevideofile function.
- Product
- Baseboard Management Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 8, 2021The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgeneratesslcfg CVE-2021-26573 · Other software · HPE · reported by security-alert@hpe.comHigh 7.8
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgeneratesslcfg function.
- Product
- Baseboard Management Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 8, 2021The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so websetdeCVE-2021-25172 · Other software · HPE · reported by security-alert@hpe.comHigh 7.8
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so websetdefaultlangcfg function.
- Product
- Baseboard Management Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 8, 2021The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgetactivexcfg fCVE-2021-26572 · Other software · HPE · reported by security-alert@hpe.comHigh 7.8
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgetactivexcfg function.
- Product
- Baseboard Management Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 8, 2021The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgetactivexcfg fCVE-2021-26571 · Other software · HPE · reported by security-alert@hpe.comHigh 7.8
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webgetactivexcfg function.
- Product
- Baseboard Management Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 8, 2021The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webifc_setadconfigCVE-2021-26570 · Other software · HPE · reported by security-alert@hpe.comHigh 7.8
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webifc_setadconfig function.
- Product
- Baseboard Management Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comzerodayinitiative.com
Feb 8, 2021The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so websetlicensecfg fCVE-2021-25171 · Other software · HPE · reported by security-alert@hpe.comHigh 7.8
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so websetlicensecfg function.
- Product
- Baseboard Management Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 8, 2021The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so websetremoteimageiCVE-2021-25170 · Other software · HPE · reported by security-alert@hpe.comHigh 7.8
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so websetremoteimageinfo function.
- Product
- Baseboard Management Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 8, 2021The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so websetservicecfg fCVE-2021-25169 · Other software · HPE · reported by security-alert@hpe.comHigh 7.8
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so websetservicecfg function.
- Product
- Baseboard Management Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 8, 2021The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webupdatecomponentCVE-2021-25168 · Other software · HPE · reported by security-alert@hpe.comHigh 7.8
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webupdatecomponent function.
- Product
- Baseboard Management Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 8, 2021The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webstartflash funcCVE-2021-25142 · Other software · HPE · reported by security-alert@hpe.comHigh 7.8
The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.so webstartflash function.
- Product
- Baseboard Management Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Nov 5, 2020A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE).CVE-2020-7207 · Other software · HP · reported by security-alert@hpe.comMedium 6.8
A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE). This attack requires a physical attack to the server motherboard. To mitigate this issue, ensure your server is always physically secured. HPE will not address this issue in the impacted Gen 10 servers listed. HPE recommends using appropriate physical security methods as a compensating control to disallow an attacker from having physical access to the server main circuit board.
- Product
- Apollo 2000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Sep 10, 2020apollo-adminservice before version 1.7.1 does not implement access controls.CVE-2020-15170 · Other software · ctripcorp · reported by GitHubHigh 7
apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.
- Product
- apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2019In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhiCVE-2019-13237 · Other software · Alkacon · reported by MITREMedium 4.3
In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.
- Product
- Opencms Apollo Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comaetsu.github.io
Aug 27, 2019In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.CVE-2019-13235 · Other software · Alkacon · reported by MITREMedium 6.1
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
- Product
- Opencms Apollo Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comaetsu.github.io
Aug 27, 2019In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.CVE-2019-13234 · Other software · Alkacon · reported by MITREMedium 6.1
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.
- Product
- Opencms Apollo Template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comaetsu.github.io
Apr 1, 2019An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT.CVE-2019-10686 · Other software · Ctrip · reported by MITRECritical 10
An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled.
- Product
- Apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12323 · Other software · Apollotechnologiesinc · reported by MITREMedium 6.8
An issue was discovered on Momentum Axel 720P 5.1.8 devices. A password of EHLGVG is hard-coded for the root and admin accounts, which makes it easier for physically proximate attackers to login at the console.
- Product
- Momentum Axel 720p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12261 · Other software · Apollotechnologiesinc · reported by MITREMedium 4.4
An issue was discovered on Momentum Axel 720P 5.1.8 devices. All processes run as root.
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12260 · Other software · Apollotechnologiesinc · reported by MITREMedium 6.7
An issue was discovered on Momentum Axel 720P 5.1.8 devices. The root password can be obtained in cleartext by issuing the command 'showKey' from the root CLI. This password may be the same on all devices
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12259 · Other software · Apollotechnologiesinc · reported by MITREMedium 6.8
An issue was discovered on Momentum Axel 720P 5.1.8 devices. Root access can be obtained via UART pins without any restrictions, which leads to full system compromise.
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12258 · Other software · Apollotechnologiesinc · reported by MITREMedium 6.8
An issue was discovered on Momentum Axel 720P 5.1.8 devices. Custom Firmware Upgrade is possible via an SD Card. With physical access, an attacker can upgrade the firmware in under 60 seconds by inserting an SD card containing the firmware with name 'ezviz.dav' and rebooting.
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered on Momentum Axel 720P 5.1.8 devices.CVE-2018-12257 · Other software · Apollotechnologiesinc · reported by MITREMedium 4.4
An issue was discovered on Momentum Axel 720P 5.1.8 devices. There is Authenticated Custom Firmware Upgrade via DNS Hijacking. An authenticated root user with CLI access is able to remotely upgrade firmware to a custom image due to lack of SSL validation by changing the nameservers in /etc/resolv.conf to the attacker's server, and serving the expected HTTPS response containing new firmware for the device to download.
- Product
- Momentum Axel 720p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2017XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XCVE-2014-3579 · Websites & servers · Apache · reported by Red HatCritical 9.8
XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
- Product
- Activemq Apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordactivemq.apache.orgseclists.org
Apr 24, 2013Multiple stack-based buffer overflows in NCSAddOn.dll in the ERDAS APOLLO ECWP plugin before 13.00.0001 for Internet Explorer, Firefox, and Chrome allow remote CVE-2013-0728 · Other software · Hexagon · reported by PSIRT-CNA@flexerasoftware.comHigh 10
Multiple stack-based buffer overflows in NCSAddOn.dll in the ERDAS APOLLO ECWP plugin before 13.00.0001 for Internet Explorer, Firefox, and Chrome allow remote attackers to execute arbitrary code via a long property value.
- Product
- Erdas Apollo Ecwp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Apr 21, 2009Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a lonCVE-2009-1351 · Other software · Heikki Ylinen · reported by MITREHigh 9.3
Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long URI in a playlist (.m3u) file.
- Product
- Apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2007Adobe Integrated Runtime (AIR, aka Apollo) allows context-dependent attackers to modify arbitrary files within an executing .air file (compiled AIR application)CVE-2007-3640 · Other software · Adobe · reported by MITREMedium 4.3
Adobe Integrated Runtime (AIR, aka Apollo) allows context-dependent attackers to modify arbitrary files within an executing .air file (compiled AIR application) and perform cross-site scripting (XSS) attacks, as demonstrated by an application that modifies an HTML file inside itself via JavaScript that uses an APPEND open operation and the writeUTFBytes function. NOTE: this may be an intended consequence of the AIR permission model; if so, then perhaps this issue should not be included in CVE.
- Product
- Adobe AIR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.