Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
175 results · page 2 of 4
Oct 30, 2023Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0.CVE-2023-5844 · Other software · pimcore · reported by security@huntr.devHigh 7.2
Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0.
- Product
- pimcore/admin-ui-classic-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0.CVE-2023-5192 · Other software · pimcore · reported by security@huntr.devMedium 6.5
Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0.
- Product
- pimcore/demo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2023Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore.CVE-2023-42817 · Other software · pimcore · reported by GitHubMedium 5.4
Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit `abd77392` which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.
- Product
- admin-ui-classic-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.CVE-2023-4453 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce.CVE-2023-38708 · Other software · pimcore · reported by GitHubMedium 6.3
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path traversal vulnerability exists in the `AssetController::importServerFilesAction`, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.This can lead to potential denial of service---key file overwrite. The impact of this vulnerability allows attackers to: overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information. This could also cause a denial of service (DoS) if critical system files are overwritten or deleted.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2.CVE-2023-4145 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2.
- Product
- pimcore/customer-data-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4.CVE-2023-3822 · Other software · pimcore · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.CVE-2023-3821 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2023 SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.CVE-2023-3820 · Other software · pimcore · reported by security@huntr.devHigh 7.2
SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2023Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4.CVE-2023-3819 · Other software · pimcore · reported by security@huntr.devMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2023 SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.24.CVE-2023-3673 · Other software · pimcore · reported by security@huntr.devHigh 7.2
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.24.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework.CVE-2023-37280 · Other software · pimcore · reported by GitHubMedium 5
Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts/HTML content. This vulnerability has been patched in version 1.0.3.
- Product
- admin-ui-classic-bundle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1.CVE-2023-3574 · Other software · pimcore · reported by security@huntr.devMedium 6.5
Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1.
- Product
- pimcore/customer-data-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.CVE-2023-2984 · Other software · pimcore · reported by security@huntr.devHigh 8.8
Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2023Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.CVE-2023-2983 · Other software · pimcore · reported by security@huntr.devHigh 8.8
Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2023Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.CVE-2023-2881 · Other software · pimcore · reported by security@huntr.devMedium 4.9
Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
- Product
- pimcore/customer-data-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2023SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.CVE-2023-2756 · Other software · pimcore · reported by security@huntr.devHigh 7.2
SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
- Product
- pimcore/customer-data-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.CVE-2023-2730 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management.CVE-2023-32075 · Other software · pimcore · reported by GitHubMedium 4.3
The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to version 3.3.9, business logic errors are possible in the `Conditions` tab since the counter can be a negative number. This vulnerability is capable of the unlogic in the counter value in the Conditions tab. Users should update to version 3.3.9 to receive a patch or, as a workaround, or apply the patch manually.
- Product
- customer-data-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2630 · Other software · pimcore · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.CVE-2023-2629 · Other software · pimcore · reported by security@huntr.devHigh 7.8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.
- Product
- pimcore/customer-data-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2615 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2614 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2616 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023Pimcore is an open source data and experience management platform.CVE-2023-30855 · Other software · pimcore · reported by GitHubMedium 6.5
Pimcore is an open source data and experience management platform. Versions of Pimcore prior to 10.5.18 are vulnerable to path traversal. The impact of this path traversal and arbitrary extension is limited to creation of arbitrary files and appending data to existing files. When combined with the SQL Injection, the exported data `RESTRICTED DIFFUSION 9 / 9` can be controlled and a webshell can be uploaded. Attackers can use that to execute arbitrary PHP code on the server with the permissions of the webserver. Users may upgrade to version 10.5.18 to receive a patch or, as a workaround, apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2361 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Pimcore is an open source data and experience management platform.CVE-2023-30852 · Other software · pimcore · reported by GitHubMedium 4.4
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the `scriptPath` and `scripts` parameters. The `scriptPath` parameter is not sanitized properly and is vulnerable to path traversal attack. Any JavaScript/CSS file from the application server can be read by specifying sufficient number of `../` patterns to go out from the application webroot followed by path of the folder where the file is located in the "scriptPath" parameter and the file name in the "scripts" parameter. The JavaScript file is successfully read only if the web application has read access to it. Users should update to version 10.5.21 to receive a patch or, as a workaround, apply the patch manual.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Pimcore is an open source data and experience management platform.CVE-2023-30850 · Other software · pimcore · reported by GitHubHigh 8.8
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admin translations API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Pimcore is an open source data and experience management platform.CVE-2023-30849 · Other software · pimcore · reported by GitHubHigh 8.8
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Pimcore is an open source data and experience management platform.CVE-2023-30848 · Other software · pimcore · reported by GitHubHigh 8.8
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2343 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2342 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2341 · Other software · pimcore · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2340 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2339 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2338 · Other software · pimcore · reported by security@huntr.devHigh 8.8
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2336 · Other software · pimcore · reported by security@huntr.devMedium 6.5
Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2328 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2327 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2323 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2322 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2023Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives.CVE-2023-28850 · Other software · pimcore · reported by GitHubMedium 6.1
Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Version 1.5.1 has a patch. As a workaround, one may apply the patch manually.
- Product
- perspective-editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.CVE-2023-1704 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.CVE-2023-1703 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.CVE-2023-1702 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.CVE-2023-1701 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023Pimcore is an open source data and experience management platform.CVE-2023-28438 · Other software · pimcore · reported by GitHubMedium 6.2
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2023SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.CVE-2023-1578 · Other software · pimcore · reported by security@huntr.devHigh 8.8
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2023Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.CVE-2023-1517 · Other software · pimcore · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2023Pimcore is an open source data and experience management platform.CVE-2023-28429 · Other software · pimcore · reported by GitHubMedium 6.1
Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 10.5.19 or, as a workaround, apply the patch manually.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.