Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

488 results · page 4 of 10

Aug 6, 2019cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscover_host (SEC-177).CVE-2016-10777 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscover_host (SEC-177).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 6, 2019cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174).CVE-2016-10776 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213).CVE-2017-18482 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).CVE-2017-18481 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 5, 2019cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).CVE-2017-18480 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).CVE-2017-18479 · Websites & servers · Cpanel · reported by MITREMedium 6.5
In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).CVE-2017-18478 · Websites & servers · Cpanel · reported by MITREMedium 6.5
In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).CVE-2017-18477 · Websites & servers · Cpanel · reported by MITREMedium 6.5
In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).CVE-2017-18476 · Websites & servers · Cpanel · reported by MITREHigh 7.5
Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204).CVE-2017-18475 · Websites & servers · Cpanel · reported by MITREHigh 8.8
In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201).CVE-2017-18474 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).CVE-2017-18473 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 5, 2019cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).CVE-2017-18472 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 5, 2019cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).CVE-2017-18471 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 5, 2019cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).CVE-2017-18470 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).CVE-2017-18469 · Websites & servers · Cpanel · reported by MITREMedium 6.3
cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173).CVE-2016-10775 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172).CVE-2016-10774 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 5, 2019cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171).CVE-2016-10773 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).CVE-2016-10772 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165).CVE-2016-10771 · Websites & servers · Cpanel · reported by MITREHigh 8.1
cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164).CVE-2016-10770 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162).CVE-2016-10769 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161).CVE-2016-10768 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159).CVE-2016-10767 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 5, 2019cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).CVE-2017-18468 · Websites & servers · Cpanel · reported by MITREMedium 6.3
cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229).CVE-2017-18467 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).CVE-2017-18466 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).CVE-2017-18465 · Websites & servers · Cpanel · reported by MITREMedium 4.4
cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226).CVE-2017-18464 · Websites & servers · Cpanel · reported by MITREMedium 4.9
cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 5, 2019cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224).CVE-2017-18462 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225).CVE-2017-18463 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).CVE-2017-18461 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221).CVE-2017-18460 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220).CVE-2017-18459 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219).CVE-2017-18458 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).CVE-2017-18457 · Websites & servers · Cpanel · reported by MITREMedium 4.4
cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).CVE-2017-18456 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).CVE-2017-18455 · Websites & servers · Cpanel · reported by MITRELow 2.7
In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).CVE-2017-18454 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).CVE-2017-18453 · Websites & servers · Cpanel · reported by MITREMedium 4.9
cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259).CVE-2017-18452 · Websites & servers · Cpanel · reported by MITREMedium 6.7
cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257).CVE-2017-18451 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).CVE-2017-18450 · Websites & servers · Cpanel · reported by MITREMedium 4.5
cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254).CVE-2017-18449 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252).CVE-2017-18448 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).CVE-2017-18447 · Websites & servers · Cpanel · reported by MITREMedium 6.3
cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).CVE-2017-18446 · Websites & servers · Cpanel · reported by MITREMedium 6.3
cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).CVE-2017-18445 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).CVE-2017-18444 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.