Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,210 results · page 22 of 45
Jul 2, 2018TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow clickjacking.CVE-2018-12576 · Network & remote access · Tp-link · reported by MITREMedium 4.3
TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow clickjacking.
- Product
- Tl-wr841n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsoftware-talk.orgsoftware-talk.org
Jun 25, 2018Cross-site request forgery (CSRF) vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for requesCVE-2018-12603 · Other software · Lfdycms · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for requests that add administrator users via the s parameter, a related issue to CVE-2018-12114.
- Product
- Lfcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cnpacketstormsecurity.com
Jun 23, 2018The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, CVE-2018-11560 · Other software · Insteon · reported by MITRECritical 9.8
The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, as demonstrated by a long remoteIp parameter to cgi-bin/CGIProxy.fcgi on port 34100.
- Product
- 2864-222 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2018ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnCVE-2018-1000201 · Other software · Ruby-ffi Project · reported by MITREHigh 7.8
ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.
- Product
- Ruby-ffi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2018Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers to hijack the authentiCVE-2018-6563 · Other software · Totemo · reported by MITREHigh 8.8
Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers to hijack the authentication of users for requests that (1) change user settings, (2) send emails, or (3) change contact information by leveraging lack of an anti-CSRF token.
- Product
- Encryption Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Jun 18, 2018A session fixation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to hijack user sessions with a specially crafted request.CVE-2018-9026 · Other software · CA Technologies · reported by vuln@ca.comHigh 7.5
A session fixation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to hijack user sessions with a specially crafted request.
- Product
- CA Privileged Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsupport.ca.com
Jun 14, 2018In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.CVE-2018-12423 · Other software · Matrix · reported by MITREHigh 7.5
In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.
- Product
- Synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
Jun 11, 2018A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain.CVE-2017-7807 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.1
A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain. This has been addressed by requiring fallback files be inside the manifest directory. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jun 6, 2018cross-env.js was a malicious module published with the intent to hijack environment variables.CVE-2017-16081 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- cross-env.js node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018nodesass was a malicious module published with the intent to hijack environment variables.CVE-2017-16080 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- nodesass node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018smb was a malicious module published with the intent to hijack environment variables.CVE-2017-16079 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- smb node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018shadowsock was a malicious module published with the intent to hijack environment variables.CVE-2017-16078 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- shadowsock node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018mongose was a malicious module published with the intent to hijack environment variables.CVE-2017-16077 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- mongose node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018proxy.js was a malicious module published with the intent to hijack environment variables.CVE-2017-16076 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- proxy.js node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018http-proxy.js was a malicious module published with the intent to hijack environment variables.CVE-2017-16075 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- http-proxy.js node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018crossenv was a malicious module published with the intent to hijack environment variables.CVE-2017-16074 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- crossenv node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018noderequest was a malicious module published with the intent to hijack environment variables.CVE-2017-16073 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- noderequest node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018nodemailer.js was a malicious module published with the intent to hijack environment variables.CVE-2017-16072 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- nodemailer.js node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018nodemailer-js was a malicious module published with the intent to hijack environment variables.CVE-2017-16071 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- nodemailer-js node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018nodecaffe was a malicious module published with the intent to hijack environment variables.CVE-2017-16070 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- nodecaffe node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018nodeffmpeg was a malicious module published with the intent to hijack environment variables.CVE-2017-16069 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- nodeffmpeg node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018ffmepg was a malicious module published with the intent to hijack environment variables.CVE-2017-16068 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- ffmepg node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018node-opencv was a malicious module published with the intent to hijack environment variables.CVE-2017-16067 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- node-opencv node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018opencv.js was a malicious module published with the intent to hijack environment variables.CVE-2017-16066 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- opencv.js node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018openssl.js was a malicious module published with the intent to hijack environment variables.CVE-2017-16065 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- openssl.js node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018node-openssl was a malicious module published with the intent to hijack environment variables.CVE-2017-16064 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- node-openssl node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018node-opensl was a malicious module published with the intent to hijack environment variables.CVE-2017-16063 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- node-opensl node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018babelcli was a malicious module published with the intent to hijack environment variables.CVE-2017-16060 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- babelcli node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018mssql-node was a malicious module published with the intent to hijack environment variables.CVE-2017-16059 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- mssql-node node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018gruntcli was a malicious module published with the intent to hijack environment variables.CVE-2017-16058 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- gruntcli node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018nodemssql was a malicious module published with the intent to hijack environment variables.CVE-2017-16057 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- nodemssql node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018mssql.js was a malicious module published with the intent to hijack environment variables.CVE-2017-16056 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- mssql.js node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 4, 2018`sqlserver` was a malicious module published with the intent to hijack environment variables.CVE-2017-16055 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- sqlserver node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 4, 2018`nodefabric` was a malicious module published with the intent to hijack environment variables.CVE-2017-16054 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- nodefabric node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 4, 2018`fabric-js` was a malicious module published with the intent to hijack environment variables.CVE-2017-16053 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- fabric-js node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 4, 2018`node-fabric` was a malicious module published with the intent to hijack environment variables.CVE-2017-16052 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- node-fabric node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 4, 2018`sqliter` was a malicious module published with the intent to hijack environment variables.CVE-2017-16051 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- sqliter node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 4, 2018`sqlite.js` was a malicious module published with the intent to hijack environment variables.CVE-2017-16050 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- sqlite.js node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 4, 2018`nodesqlite` was a malicious module published with the intent to hijack environment variables.CVE-2017-16049 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- nodesqlite node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 4, 2018`node-sqlite` was a malicious module published with the intent to hijack environment variables.CVE-2017-16048 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- node-sqlite node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 4, 2018`mariadb` was a malicious module published with the intent to hijack environment variables.CVE-2017-16046 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- mariadb node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 4, 2018`jquery.js` was a malicious module published with the intent to hijack environment variables.CVE-2017-16045 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- jquery.js node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 4, 2018`d3.js` was a malicious module published with the intent to hijack environment variables.CVE-2017-16044 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
`d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- d3.js node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 1, 2018AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system.CVE-2018-11551 · Other software · NCH · reported by MITREHigh 7.8
AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability exists because a DLL file is loaded by 'pbxsetup.exe' improperly.
- Product
- Axon PBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
May 29, 2018node-tkinter was a malicious module published with the intent to hijack environment variables.CVE-2017-16062 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- node-tkinter node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
May 29, 2018tkinter was a malicious module published with the intent to hijack environment variables.CVE-2017-16061 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- tkinter node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
May 29, 2018mysqljs was a malicious module published with the intent to hijack environment variables.CVE-2017-16047 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
- Product
- mysqljs node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
May 9, 2018Advantech WebAccess 8.1 and earlier contains a DLL hijacking vulnerability which may allow an attacker to run a malicious DLL file within the search path resultCVE-2017-5175 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govHigh 7.8
Advantech WebAccess 8.1 and earlier contains a DLL hijacking vulnerability which may allow an attacker to run a malicious DLL file within the search path resulting in execution of arbitrary code.
- Product
- Advantech WebAccess Versions 8.1 and prior.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
May 1, 2018Cross-site request forgery (CSRF) vulnerability in ManageIQ Enterprise Virtualization Manager (EVM) allows remote attackers to hijack the authentication of userCVE-2013-0185 · Other software · Redhat · reported by Red HatHigh 8.8
Cross-site request forgery (CSRF) vulnerability in ManageIQ Enterprise Virtualization Manager (EVM) allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.
- Product
- Manageiq Enterprise Virtualization Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Apr 24, 2018An exploitable dll hijacking vulnerability exists in the poaService.exe service component of the Dell Precision Optimizer software version 3.5.5.0.CVE-2017-2802 · Other software · dell · reported by talos-cna@cisco.comHigh 7.8
An exploitable dll hijacking vulnerability exists in the poaService.exe service component of the Dell Precision Optimizer software version 3.5.5.0. A specifically named malicious dll file located in one of directories pointed to by the PATH environment variable will lead to privilege escalation. An attacker with local access to vulnerable system can exploit this vulnerability.
- Product
- Dell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtalosintelligence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.