Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

488 results · page 5 of 10

Aug 2, 2019cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).CVE-2017-18443 · Websites & servers · Cpanel · reported by MITREMedium 5.8
cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246).CVE-2017-18442 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).CVE-2017-18441 · Websites & servers · Cpanel · reported by MITREMedium 5
cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244).CVE-2017-18440 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).CVE-2017-18439 · Websites & servers · Cpanel · reported by MITREMedium 6.3
cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).CVE-2017-18438 · Websites & servers · Cpanel · reported by MITREMedium 6.3
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).CVE-2017-18437 · Websites & servers · Cpanel · reported by MITREMedium 4.4
cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).CVE-2017-18436 · Websites & servers · Cpanel · reported by MITRELow 3.5
cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).CVE-2017-18435 · Websites & servers · Cpanel · reported by MITREHigh 7.3
cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237).CVE-2017-18434 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).CVE-2017-18433 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234).CVE-2017-18432 · Websites & servers · Cpanel · reported by MITREHigh 7.8
In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).CVE-2017-18431 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294).CVE-2017-18430 · Websites & servers · Cpanel · reported by MITREMedium 4.7
In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).CVE-2017-18429 · Websites & servers · Cpanel · reported by MITRELow 3.3
In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).CVE-2017-18428 · Websites & servers · Cpanel · reported by MITRELow 2.5
In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).CVE-2017-18427 · Websites & servers · Cpanel · reported by MITRELow 3.3
In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288).CVE-2017-18426 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280).CVE-2017-18425 · Websites & servers · Cpanel · reported by MITRELow 2.5
In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274).CVE-2017-18424 · Websites & servers · Cpanel · reported by MITRELow 3.3
In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).CVE-2017-18423 · Websites & servers · Cpanel · reported by MITRELow 3.3
In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272).CVE-2017-18422 · Websites & servers · Cpanel · reported by MITRELow 3.3
In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271).CVE-2017-18421 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269).CVE-2017-18420 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266).CVE-2017-18419 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265).CVE-2017-18418 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263).CVE-2017-18417 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 2, 2019cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).CVE-2017-18416 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302).CVE-2017-18415 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300).CVE-2017-18414 · Websites & servers · Cpanel · reported by MITREHigh 7.4
cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).CVE-2017-18413 · Websites & servers · Cpanel · reported by MITREHigh 7.8
In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296).CVE-2017-18412 · Websites & servers · Cpanel · reported by MITRELow 2.5
cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285).CVE-2017-18411 · Websites & servers · Cpanel · reported by MITREMedium 6.8
The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).CVE-2017-18410 · Websites & servers · Cpanel · reported by MITREMedium 6.5
In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).CVE-2017-18409 · Websites & servers · Cpanel · reported by MITREMedium 6.5
In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282).CVE-2017-18408 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).CVE-2017-18407 · Websites & servers · Cpanel · reported by MITREMedium 4.8
cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276).CVE-2017-18406 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345).CVE-2017-18405 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341).CVE-2017-18404 · Websites & servers · Cpanel · reported by MITRELow 3.1
cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).CVE-2017-18403 · Websites & servers · Cpanel · reported by MITREMedium 6.3
cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336).CVE-2017-18402 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334).CVE-2017-18401 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333).CVE-2017-18400 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC-332).CVE-2017-18399 · Websites & servers · Cpanel · reported by MITRELow 3.7
cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC-332).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331).CVE-2017-18398 · Websites & servers · Cpanel · reported by MITRELow 3.8
DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).CVE-2017-18397 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases (SEC-329).CVE-2017-18396 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases (SEC-329).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 does not block a username of ssl (SEC-328).CVE-2017-18395 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.15 does not block a username of ssl (SEC-328).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327).CVE-2017-18394 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.