Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,914 results · page 23 of 39

Aug 7, 2019In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117).CVE-2016-10812 · Websites & servers · Cpanel · reported by MITREHigh 8.8
In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 7, 2019In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116).CVE-2016-10811 · Websites & servers · Cpanel · reported by MITREHigh 8.8
In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115).CVE-2016-10810 · Websites & servers · Cpanel · reported by MITREHigh 8.8
In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114).CVE-2016-10809 · Websites & servers · Cpanel · reported by MITREHigh 8.8
In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113).CVE-2016-10808 · Websites & servers · Cpanel · reported by MITREHigh 8.8
In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 7, 2019cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112).CVE-2016-10807 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110).CVE-2016-10806 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109).CVE-2016-10805 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58).CVE-2016-10804 · Websites & servers · Cpanel · reported by MITREHigh 8.1
The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).CVE-2016-10803 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 7, 2019cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).CVE-2016-10802 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019cPanel before 58.0.4 has improper session handling for shared users (SEC-139).CVE-2016-10801 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 58.0.4 has improper session handling for shared users (SEC-139).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 7, 2019cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138).CVE-2016-10800 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 7, 2019cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).CVE-2016-10799 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 7, 2019cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134).CVE-2016-10798 · Websites & servers · Cpanel · reported by MITREMedium 6.8
cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains (SEC-133).CVE-2016-10797 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains (SEC-133).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130).CVE-2016-10796 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156).CVE-2016-10795 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error (SEC-154).CVE-2016-10794 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error (SEC-154).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152).CVE-2016-10793 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141).CVE-2016-10792 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559).CVE-2016-10791 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192).CVE-2016-10790 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler (SEC-191).CVE-2016-10789 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler (SEC-191).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188).CVE-2016-10788 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries (SEC-187).CVE-2016-10787 · Websites & servers · Cpanel · reported by MITREHigh 8.1
The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries (SEC-187).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186).CVE-2016-10786 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185).CVE-2016-10785 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows self XSS in the alias upload interface (SEC-184).CVE-2016-10784 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows self XSS in the alias upload interface (SEC-184).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182).CVE-2016-10783 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs (SEC-181).CVE-2016-10782 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs (SEC-181).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows self XSS in the UI_confirm API (SEC-180).CVE-2016-10781 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows self XSS in the UI_confirm API (SEC-180).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows stored XSS in the ftp_sessions API (SEC-180).CVE-2016-10780 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows stored XSS in the ftp_sessions API (SEC-180).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows stored XSS in api1_listautoresponders (SEC-179).CVE-2016-10779 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows stored XSS in api1_listautoresponders (SEC-179).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 6, 2019cPanel before 60.0.25 allows self stored XSS in the listftpstable API (SEC-178).CVE-2016-10778 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows self stored XSS in the listftpstable API (SEC-178).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscover_host (SEC-177).CVE-2016-10777 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscover_host (SEC-177).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174).CVE-2016-10776 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213).CVE-2017-18482 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).CVE-2017-18481 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 5, 2019cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).CVE-2017-18480 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).CVE-2017-18479 · Websites & servers · Cpanel · reported by MITREMedium 6.5
In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).CVE-2017-18478 · Websites & servers · Cpanel · reported by MITREMedium 6.5
In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).CVE-2017-18477 · Websites & servers · Cpanel · reported by MITREMedium 6.5
In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).CVE-2017-18476 · Websites & servers · Cpanel · reported by MITREHigh 7.5
Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204).CVE-2017-18475 · Websites & servers · Cpanel · reported by MITREHigh 8.8
In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201).CVE-2017-18474 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).CVE-2017-18473 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 5, 2019cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).CVE-2017-18472 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 5, 2019cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).CVE-2017-18471 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 5, 2019cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).CVE-2017-18470 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.