Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

488 results · page 3 of 10

Mar 17, 2020cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).CVE-2019-20496 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).CVE-2019-20495 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).CVE-2019-20494 · Websites & servers · Cpanel · reported by MITRELow 3.3
In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).CVE-2019-20493 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).CVE-2019-20492 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 17, 2020cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).CVE-2019-20490 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Mar 16, 2020cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508).CVE-2019-20491 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Feb 10, 2020The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.CVE-2012-6449 · Websites & servers · Cpanel · reported by MITREMedium 5.4
The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jan 27, 2020Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2012-6448 · Websites & servers · Cpanel · reported by MITREMedium 6.1
Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Webhost Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Oct 9, 2019cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).CVE-2019-17380 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Oct 9, 2019cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527).CVE-2019-17379 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Oct 9, 2019cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).CVE-2019-17378 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Oct 9, 2019cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).CVE-2019-17377 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Oct 9, 2019cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).CVE-2019-17376 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Oct 9, 2019cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).CVE-2019-17375 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117).CVE-2016-10812 · Websites & servers · Cpanel · reported by MITREHigh 8.8
In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 7, 2019In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116).CVE-2016-10811 · Websites & servers · Cpanel · reported by MITREHigh 8.8
In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115).CVE-2016-10810 · Websites & servers · Cpanel · reported by MITREHigh 8.8
In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114).CVE-2016-10809 · Websites & servers · Cpanel · reported by MITREHigh 8.8
In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113).CVE-2016-10808 · Websites & servers · Cpanel · reported by MITREHigh 8.8
In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 7, 2019cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112).CVE-2016-10807 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110).CVE-2016-10806 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109).CVE-2016-10805 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58).CVE-2016-10804 · Websites & servers · Cpanel · reported by MITREHigh 8.1
The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).CVE-2016-10803 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 7, 2019cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).CVE-2016-10802 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 7, 2019cPanel before 58.0.4 has improper session handling for shared users (SEC-139).CVE-2016-10801 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 58.0.4 has improper session handling for shared users (SEC-139).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 7, 2019cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138).CVE-2016-10800 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 7, 2019cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).CVE-2016-10799 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 7, 2019cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134).CVE-2016-10798 · Websites & servers · Cpanel · reported by MITREMedium 6.8
cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains (SEC-133).CVE-2016-10797 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains (SEC-133).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130).CVE-2016-10796 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156).CVE-2016-10795 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error (SEC-154).CVE-2016-10794 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error (SEC-154).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152).CVE-2016-10793 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141).CVE-2016-10792 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559).CVE-2016-10791 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192).CVE-2016-10790 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler (SEC-191).CVE-2016-10789 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler (SEC-191).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188).CVE-2016-10788 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries (SEC-187).CVE-2016-10787 · Websites & servers · Cpanel · reported by MITREHigh 8.1
The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries (SEC-187).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186).CVE-2016-10786 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185).CVE-2016-10785 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows self XSS in the alias upload interface (SEC-184).CVE-2016-10784 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows self XSS in the alias upload interface (SEC-184).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182).CVE-2016-10783 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs (SEC-181).CVE-2016-10782 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs (SEC-181).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows self XSS in the UI_confirm API (SEC-180).CVE-2016-10781 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows self XSS in the UI_confirm API (SEC-180).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows stored XSS in the ftp_sessions API (SEC-180).CVE-2016-10780 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows stored XSS in the ftp_sessions API (SEC-180).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows stored XSS in api1_listautoresponders (SEC-179).CVE-2016-10779 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows stored XSS in api1_listautoresponders (SEC-179).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 6, 2019cPanel before 60.0.25 allows self stored XSS in the listftpstable API (SEC-178).CVE-2016-10778 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows self stored XSS in the listftpstable API (SEC-178).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.