Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list
34added in the last 30 days
343new WordPress flaws this week
390,080entries in the database

2,340 results · page 5 of 47

  • Jul 21, 2026Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/C++).CVE-2026-60179 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.4

    Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/C++). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

    Product
    MySQL Connectors
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jul 21, 2026Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).CVE-2026-60178 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.6

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jul 21, 2026Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).CVE-2026-60177 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.4

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jul 21, 2026Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).CVE-2026-60174 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jul 21, 2026Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).CVE-2026-60171 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.47. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Cluster
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jul 21, 2026Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).CVE-2026-60163 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.4

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.comopenwall.com

  • Jul 21, 2026Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).CVE-2026-60145 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jul 21, 2026Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).CVE-2026-47064 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jul 21, 2026Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).CVE-2026-47052 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jul 21, 2026Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).CVE-2026-47023 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jul 21, 2026Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).CVE-2026-47012 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.4

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jul 21, 2026Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).CVE-2026-47008 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jul 21, 2026Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).CVE-2026-46936 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.4

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jul 8, 2026n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation.CVE-2026-59257 · Other software · n8n · reported by VulnCheckMedium 5.3

    n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated {{ ... }} expression values directly into the raw SQL string without parameterization. When a workflow uses this operation with expression-sourced values and is connected to an externally-reachable trigger (such as a Webhook node), attacker-controlled input reaching those expressions results in SQL injection, allowing execution of arbitrary SQL with the configured MySQL credentials' privileges. The MySQL v2 node, which uses parameterized queries, is not affected.

    Product
    n8n
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comvulncheck.com

  • Jul 4, 2026A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35.CVE-2026-14622 · Other software · jairiidriss · reported by VulDBMedium 5.5

    A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code of the file /admin/ajax_files of the component AJAX Endpoint. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

    Product
    restaurant-website-php-mysql
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Jun 25, 2026GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/sCVE-2026-37149 · Other software · reported by MITREHigh 7.7

    GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.

    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Jun 24, 2026n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrarCVE-2026-56351 · Other software · n8n · reported by VulnCheckMedium 5.3

    n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier values in node configuration parameters. Attackers with workflow creation permissions can supply specially crafted table or column names to execute unauthorized database commands and compromise data integrity.

    Product
    n8n
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comvulncheck.com

  • Jun 22, 2026Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands usCVE-2026-44913 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.2

    Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies. Apache NiFi installations that do not use the CaptureChangeMySQL Processor are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which incorporates more robust identifier escaping.

    Product
    Apache NiFi
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordlists.apache.orgopenwall.com

  • Jun 19, 2026ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL.CVE-2026-48774 · Other software · sysown · reported by GitHubHigh 7.5

    ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 3.0.0 through 3.0.8, ProxySQL's GenAI/MCP `run_sql_readonly` tool violates its documented read-only contract for MySQL targets. The tool validates only the full input string with a substring blacklist and first-keyword allowlist, but then executes the entire SQL string on a backend connection created with `CLIENT_MULTI_STATEMENTS`. As a result, a caller can submit a read-only first statement followed by a side-effecting second statement, such as `SELECT 1; RENAME TABLE ...`. The validator accepts the payload because it starts with `SELECT` and because side-effecting MySQL statements such as `RENAME TABLE`, `SET`, `RESET`, `LOCK TABLES`, and `KILL` are not rejected by the blacklist. In a live MCP runtime test, the `/mcp/query` endpoint accepted a `run_sql_readonly` request. The MCP response reported success for the first `SELECT`, and direct backend verification showed that the table had actually been renamed. This violates the endpoint's read-only security contract and lets an MCP caller perform backend writes or administrative SQL, limited by the configured MCP target account's database privileges. Ver

    Product
    proxysql
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Jun 19, 2026ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL.CVE-2026-48773 · Other software · sysown · reported by GitHubCritical 9.8

    ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 through 3.0.8 have a pre-authentication heap memory corruption vulnerability in the MySQL and PostgreSQL protocol first-read paths. A remote unauthenticated client can declare an oversized first packet length, and ProxySQL passes that attacker-controlled length directly to `recv()` while writing into a fixed 32 KB input queue. Version 3.0.9 patches the issue.

    Product
    proxysql
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Jun 19, 2026ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL.CVE-2026-48772 · Other software · sysown · reported by GitHubCritical 10

    ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL frontend accepts the `PROXY UNKNOWN <addr> <addr> <port> <port>\r\n` PP1 frame as a well-formed PROXY protocol header. The HAProxy PROXY protocol v1 specification says that when the protocol token is `UNKNOWN`, the receiver MUST ignore any address fields that follow it, because the proxy has declared it cannot determine the client identity. ProxySQL parses those address fields anyway via `sscanf` and writes the spoofed source address into the session's `addr.addr` field. From there it flows directly into the query-rule matcher, where the `client_addr` predicate decides routing and ACL. When `mysql-proxy_protocol_networks = '*'` (the default), any TCP peer can send a PP1 frame and choose any source IP claim. With that, any `mysql_query_rules` row pinned to a `client_addr` value is forgeable: the attacker writes the address they want to match into the PP1 line, and ProxySQL routes their query as if it came from that address. In practice this is a routing and ACL bypass. Real deployments use `client_addr` for read-write splitting (internal apps go to the primary, pub

    Product
    proxysql
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Jun 17, 2026Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code).CVE-2026-46871 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The supported version that is affected is 2026.2.0+9.6.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Shell. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Shell accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

    Product
    MySQL Shell
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code).CVE-2026-46870 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.5

    Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The supported version that is affected is 2026.2.0+9.6.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Shell. While the vulnerability is in MySQL Shell, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Shell. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

    Product
    MySQL Shell
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Dump and Load).CVE-2026-46869 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5

    Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Dump and Load). Supported versions that are affected are 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Shell. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Shell accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).

    Product
    MySQL Shell
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling).CVE-2026-46863 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5

    Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are MySQL Server: 8.4.0-8.4.9, 9.0.0-9.7.0; MySQL Cluster: 8.0.11-8.0.46, 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).CVE-2026-46862 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5

    Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Supported versions that are affected are 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Router
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the MySQL NDB Cluster product of Oracle MySQL (component: Cluster: NDB Operator).CVE-2026-46861 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.6

    Vulnerability in the MySQL NDB Cluster product of Oracle MySQL (component: Cluster: NDB Operator). Supported versions that are affected are 8.0.11-8.0.46, 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL NDB Cluster. While the vulnerability is in MySQL NDB Cluster, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL NDB Cluster accessible data as well as unauthorized access to critical data or complete access to all MySQL NDB Cluster accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

    Product
    MySQL NDB Cluster
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).CVE-2026-46860 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.8

    Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Supported versions that are affected are 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Router. Successful attacks of this vulnerability can result in takeover of MySQL Router. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

    Product
    MySQL Router
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code).CVE-2026-46850 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9

    Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The supported version that is affected is 2026.2.0+9.6.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL Shell. While the vulnerability is in MySQL Shell, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Shell. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

    Product
    MySQL Shell
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 12, 2026MariaDB server is a community developed fork of MySQL server.CVE-2026-48165 · Other software · MariaDB · reported by GitHubHigh 8

    MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

    Product
    server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comjira.mariadb.org

  • Jun 12, 2026MariaDB server is a community developed fork of MySQL server.CVE-2026-48163 · Other software · MariaDB · reported by GitHubHigh 8

    MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

    Product
    server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comjira.mariadb.org

  • Jun 12, 2026MariaDB server is a community developed fork of MySQL server.CVE-2026-44173 · Other software · MariaDB · reported by GitHubMedium 5

    MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

    Product
    server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comjira.mariadb.org

  • Jun 12, 2026MariaDB server is a community developed fork of MySQL server.CVE-2026-44172 · Other software · MariaDB · reported by GitHubMedium 6.9

    MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.

    Product
    server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comjira.mariadb.org

  • Jun 12, 2026MariaDB server is a community developed fork of MySQL server.CVE-2026-44171 · Other software · MariaDB · reported by GitHubMedium 6.3

    MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

    Product
    server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comjira.mariadb.org

  • Jun 12, 2026MariaDB server is a community developed fork of MySQL server.CVE-2026-44170 · Other software · MariaDB · reported by GitHubMedium 6.3

    MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell commands on the server. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

    Product
    server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comjira.mariadb.org

  • Jun 12, 2026MariaDB server is a community developed fork of MySQL server.CVE-2026-44169 · Other software · MariaDB · reported by GitHubMedium 4.3

    MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.

    Product
    server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comjira.mariadb.org

  • Jun 12, 2026MariaDB server is a community developed fork of MySQL server.CVE-2026-44168 · Other software · MariaDB · reported by GitHubHigh 8

    MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

    Product
    server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comjira.mariadb.org

  • Jun 11, 2026MariaDB server is a community developed fork of MySQL server.CVE-2026-49261 · Other software · MariaDB · reported by GitHubCritical 10

    MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

    Product
    server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comjira.mariadb.org

  • Jun 8, 2026A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2.CVE-2026-11529 · Other software · designcomputer · reported by VulDBLow 2.1

    A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function read_resource of the file src/mysql_mcp_server/server.py of the component mysql URI Handler. This manipulation of the argument uri_str causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.3.0 is sufficient to resolve this issue. Patch name: 080bef9a96d625ce0dfbde573a08b93497871981. Upgrading the affected component is advised.

    Product
    mysql-mcp-server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • May 21, 2026Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php.CVE-2026-48242 · Other software · Open ISES · reported by VulnCheckCritical 9.2

    Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php. The credentials are embedded in source code committed to the public repository, allowing any reader of the source to obtain valid configuration values that may match deployed installations.

    Product
    Tickets
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • May 21, 2026Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source CVE-2026-48241 · Other software · Open ISES · reported by VulnCheckCritical 9.2

    Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to the public source tree (or an unauthenticated attacker with read access to the file on a deployed installation) can read the username, password, and database name and use them to connect to the database if it is reachable from their network.

    Product
    Tickets
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • May 21, 2026An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access toCVE-2026-44047 · Other software · Netatalk · reported by 33c584b5-0579-4c06-b2a0-8d8329fcab9cHigh 8.8

    An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access to data, modify data, or cause a denial of service.

    Product
    Netatalk
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordnetatalk.io

  • May 13, 2026Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a CVE-2024-47091 · Other software · Checkmk GmbH · reported by security@checkmk.comMedium 5.2

    Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a Windows service whose name matches 'MySQL' or 'MariaDB' (or with write access to a binary referenced by such a service) to execute arbitrary code in the context of the Checkmk agent service, which typically runs as SYSTEM.

    Product
    Checkmk
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordcheckmk.com

  • May 12, 2026Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux.CVE-2026-44347 · Other software · warp-tech · reported by GitHubMedium 5.8

    Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user into logging into the attacker's account, possibly convincing them to perform sensitive actions on the attacker's account (such as writing sensitive data to the attacker's SSH target, or logging into an HTTP target that the attacker set up). This vulnerability is fixed in 0.23.3.

    Product
    warpgate
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comgithub.com

  • Apr 30, 2026MySQL protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of serviceCVE-2026-6524 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5

    MySQL protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

    Product
    Wireshark
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgitlab.comwireshark.org

  • Apr 21, 2026Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).CVE-2026-35240 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Apr 21, 2026Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).CVE-2026-35239 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Apr 21, 2026Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).CVE-2026-35238 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Apr 21, 2026Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).CVE-2026-35237 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Apr 21, 2026Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).CVE-2026-35236 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    Product
    MySQL Server
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.