Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

488 results · page 6 of 10

Aug 2, 2019cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).CVE-2017-18393 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325).CVE-2017-18392 · Websites & servers · Cpanel · reported by MITRELow 2
cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323).CVE-2017-18391 · Websites & servers · Cpanel · reported by MITRELow 2.5
cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net forums.cpanel.net
Aug 2, 2019cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322).CVE-2017-18390 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318).CVE-2017-18389 · Websites & servers · Cpanel · reported by MITREMedium 6.3
cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315).CVE-2017-18388 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314).CVE-2017-18387 · Websites & servers · Cpanel · reported by MITREHigh 7.2
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313).CVE-2017-18386 · Websites & servers · Cpanel · reported by MITREHigh 7.2
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311).CVE-2017-18385 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310).CVE-2017-18384 · Websites & servers · Cpanel · reported by MITRELow 3.8
cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).CVE-2017-18383 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 2, 2019cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306).CVE-2017-18382 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93).CVE-2016-10826 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75).CVE-2016-10821 · Websites & servers · Cpanel · reported by MITREMedium 6.5
In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31).CVE-2016-10820 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net forums.cpanel.net
Aug 1, 2019In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125).CVE-2016-10819 · Websites & servers · Cpanel · reported by MITREMedium 6.5
In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124).CVE-2016-10818 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123).CVE-2016-10817 · Websites & servers · Cpanel · reported by MITRECritical 9.8
cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).CVE-2016-10816 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).CVE-2016-10815 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119).CVE-2016-10814 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118).CVE-2016-10813 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 68.0.27 allows self XSS in the WHM listips interface (SEC-389).CVE-2018-20953 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 68.0.27 allows self XSS in the WHM listips interface (SEC-389).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388).CVE-2018-20952 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config (SEC-387).CVE-2018-20951 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config (SEC-387).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer (SEC-386).CVE-2018-20950 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer (SEC-386).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor (SEC-385).CVE-2018-20949 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor (SEC-385).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383).CVE-2018-20948 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 68.0.27 allows certain file-write operations via the telnetcrt script (SEC-356).CVE-2018-20947 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 68.0.27 allows certain file-write operations via the telnetcrt script (SEC-356).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archive_sync_zones script (SEC-355).CVE-2018-20946 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archive_sync_zones script (SEC-355).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019bin/csvprocess in cPanel before 68.0.27 allows insecure file operations (SEC-354).CVE-2018-20945 · Websites & servers · Cpanel · reported by MITREMedium 5.7
bin/csvprocess in cPanel before 68.0.27 allows insecure file operations (SEC-354).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test (SEC-353).CVE-2018-20944 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test (SEC-353).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task (SEC-352).CVE-2018-20943 · Websites & servers · Cpanel · reported by MITRELow 2.5
cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task (SEC-352).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab (SEC-351).CVE-2018-20942 · Websites & servers · Cpanel · reported by MITRELow 2.5
cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab (SEC-351).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 68.0.27 allows arbitrary file-read operations via restore adminbin (SEC-349).CVE-2018-20941 · Websites & servers · Cpanel · reported by MITREMedium 5.6
cPanel before 68.0.27 allows arbitrary file-read operations via restore adminbin (SEC-349).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342).CVE-2018-20940 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging backups (SEC-339).CVE-2018-20939 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging backups (SEC-339).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).CVE-2018-20938 · Websites & servers · Cpanel · reported by MITRELow 2.7
cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321).CVE-2018-20937 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308).CVE-2018-20936 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107).CVE-2016-10835 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105).CVE-2016-10834 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104).CVE-2016-10833 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102).CVE-2016-10832 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).CVE-2016-10831 · Websites & servers · Cpanel · reported by MITREHigh 7.2
cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100).CVE-2016-10830 · Websites & servers · Cpanel · reported by MITREHigh 8.1
cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99).CVE-2016-10829 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).CVE-2016-10828 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 1, 2019cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96).CVE-2016-10827 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net news.cpanel.com
Aug 1, 2019cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92).CVE-2016-10825 · Websites & servers · Cpanel · reported by MITREHigh 8.1
cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.