Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

488 results · page 2 of 10

Sep 17, 2024Sensitive data disclosure and manipulation due to unnecessary privileges assignment.CVE-2024-8767 · Other software · Acronis · reported by security@acronis.comCritical 9.9
Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 619, Acronis Backup extension for Plesk (Linux) before build 555, Acronis Backup plugin for DirectAdmin (Linux) before build 147.
Product
Acronis Backup plugin for cPanel & WHM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Feb 13, 2024The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a deniCVE-2022-48623 · Websites & servers · cpanel · reported by MITRECritical 9.1
The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.
Product
cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 21, 2023FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request.CVE-2022-47532 · Other software · Filerun · reported by MITRECritical 9.8
FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request.
Product
Filerun
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record herolab.usd.de herolab.usd.de
Apr 27, 2023An issue was discovered in cPanel before 11.109.9999.116.CVE-2023-29489 · Websites & servers · cpanel · reported by MITREMedium 5.3
An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.
Product
cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.assetnote.io forums.cpanel.net
Aug 11, 2021In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).CVE-2021-38590 · Websites & servers · Cpanel · reported by MITREMedium 5.5
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Aug 11, 2021In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).CVE-2021-38589 · Websites & servers · Cpanel · reported by MITREHigh 8.1
In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Aug 11, 2021In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).CVE-2021-38588 · Websites & servers · Cpanel · reported by MITREHigh 8.1
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Aug 11, 2021In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).CVE-2021-38587 · Websites & servers · Cpanel · reported by MITREHigh 7.5
In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Aug 11, 2021In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).CVE-2021-38586 · Websites & servers · Cpanel · reported by MITREMedium 4.4
In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Aug 11, 2021The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).CVE-2021-38585 · Websites & servers · Cpanel · reported by MITREHigh 7.2
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Aug 11, 2021The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).CVE-2021-38584 · Websites & servers · Cpanel · reported by MITREHigh 7.2
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Apr 26, 2021cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).CVE-2021-31803 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Jan 26, 2021cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).CVE-2021-26267 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Jan 26, 2021cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).CVE-2021-26266 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Dec 24, 2020EGavilan Media Under Construction page with cPanel 1.0 contains a SQL injection vulnerability.CVE-2020-29472 · Other software · Egavilanmedia · reported by MITRECritical 9.8
EGavilan Media Under Construction page with cPanel 1.0 contains a SQL injection vulnerability. An attacker can gain Admin Panel access using malicious SQL injection queries to perform remote arbitrary code execution.
Product
Under Construction Page With Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record systemweakness.com exploit-db.com
Nov 26, 2020cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).CVE-2020-29137 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net news.cpanel.com
Nov 26, 2020In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).CVE-2020-29136 · Websites & servers · Cpanel · reported by MITREMedium 6.5
In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net news.cpanel.com
Nov 26, 2020cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).CVE-2020-29135 · Websites & servers · Cpanel · reported by MITREMedium 4.1
cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net news.cpanel.com
Sep 25, 2020cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).CVE-2020-26115 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).CVE-2020-26114 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).CVE-2020-26113 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020The email quota cache in cPanel before 90.0.10 allows overwriting of files.CVE-2020-26112 · Websites & servers · Cpanel · reported by MITREHigh 7.5
The email quota cache in cPanel before 90.0.10 allows overwriting of files.
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).CVE-2020-26111 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).CVE-2020-26110 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557).CVE-2020-26109 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).CVE-2020-26108 · Websites & servers · Cpanel · reported by MITRECritical 9.8
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).CVE-2020-26107 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).CVE-2020-26106 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).CVE-2020-26105 · Websites & servers · Cpanel · reported by MITRECritical 9.8
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).CVE-2020-26104 · Websites & servers · Cpanel · reported by MITREHigh 7.5
In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).CVE-2020-26103 · Websites & servers · Cpanel · reported by MITREHigh 7.5
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).CVE-2020-26102 · Websites & servers · Cpanel · reported by MITREHigh 7.5
In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).CVE-2020-26101 · Websites & servers · Cpanel · reported by MITRECritical 9.8
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).CVE-2020-26100 · Websites & servers · Cpanel · reported by MITRECritical 9.8
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).CVE-2020-26099 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
Sep 25, 2020cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).CVE-2020-26098 · Websites & servers · Cpanel · reported by MITRECritical 9.8
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.cpanel.net docs.cpanel.net
May 11, 2020cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).CVE-2020-12785 · Websites & servers · Cpanel · reported by MITREHigh 8.1
cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
May 11, 2020cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505).CVE-2020-12784 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Mar 17, 2020cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).CVE-2020-10122 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).CVE-2020-10121 · Websites & servers · Cpanel · reported by MITRECritical 9.8
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).CVE-2020-10120 · Websites & servers · Cpanel · reported by MITREHigh 7.2
cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).CVE-2020-10119 · Websites & servers · Cpanel · reported by MITRECritical 9.8
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).CVE-2020-10118 · Websites & servers · Cpanel · reported by MITRECritical 9.1
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).CVE-2020-10117 · Websites & servers · Cpanel · reported by MITRECritical 9.1
cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541).CVE-2020-10116 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin.CVE-2020-10115 · Websites & servers · Cpanel · reported by MITREHigh 7.2
cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. (SEC-537).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535).CVE-2020-10114 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515).CVE-2020-10113 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).CVE-2019-20498 · Websites & servers · Cpanel · reported by MITRECritical 9.8
cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).CVE-2019-20497 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.