Updated 26 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

4,893 results · page 68 of 98

Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.CVE-2016-10930 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.
Product
wp-support-plus-responsive-ticket-system
Fixed in
7.1.0
What to do
Update wp-support-plus-responsive-ticket-system to 7.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.CVE-2015-9341 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.
Product
wp-file-upload
Fixed in
3.4.1
What to do
Update wp-file-upload to 3.4.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header.CVE-2014-10394 · WordPress plugins & themes · reported by MITREMedium 6.1
The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header.
Product
rich-counter
Fixed in
1.2.0
What to do
Update rich-counter to 1.2.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The cforms2 plugin before 10.2 for WordPress has XSS.CVE-2014-10392 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 10.2 for WordPress has XSS.
Product
cforms2
Fixed in
10.2
What to do
Update cforms2 to 10.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.CVE-2014-10391 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.1
What to do
Update wp-support-plus-responsive-ticket-system to 4.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.CVE-2014-10390 · WordPress plugins & themes · reported by MITRECritical 9.1
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.2
What to do
Update wp-support-plus-responsive-ticket-system to 4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.CVE-2014-10389 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.2
What to do
Update wp-support-plus-responsive-ticket-system to 4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure.CVE-2014-10388 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.2
What to do
Update wp-support-plus-responsive-ticket-system to 4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection.CVE-2014-10387 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.2
What to do
Update wp-support-plus-responsive-ticket-system to 4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.CVE-2019-15324 · WordPress plugins & themes · reported by MITREHigh 8.8
The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.
Product
ad-inserter
Fixed in
2.4.22
What to do
Update ad-inserter to 2.4.22 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The ad-inserter plugin before 2.4.20 for WordPress has path traversal.CVE-2019-15323 · WordPress plugins & themes · reported by MITREHigh 7.5
The ad-inserter plugin before 2.4.20 for WordPress has path traversal.
Product
ad-inserter
Fixed in
2.4.20
What to do
Update ad-inserter to 2.4.20 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.CVE-2019-15322 · WordPress plugins & themes · reported by MITRECritical 9.8
The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.
Product
shortcode-factory
Fixed in
2.8
What to do
Update shortcode-factory to 2.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.CVE-2019-15321 · WordPress plugins & themes · reported by MITRECritical 9.8
The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.
Product
option-tree
Fixed in
2.7.3
What to do
Update option-tree to 2.7.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.CVE-2019-15320 · WordPress plugins & themes · reported by MITRECritical 9.8
The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.
Product
option-tree
Fixed in
2.7.3
What to do
Update option-tree to 2.7.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.CVE-2019-15319 · WordPress plugins & themes · reported by MITRECritical 9.8
The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.
Product
option-tree
Fixed in
2.7.0
What to do
Update option-tree to 2.7.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec.CVE-2018-20985 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec.
Product
wp-payeezy-pay
Fixed in
2.98
What to do
Update wp-payeezy-pay to 2.98 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.CVE-2018-20984 · WordPress plugins & themes · reported by MITRECritical 9.8
The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.
Product
patreon-connect
Fixed in
1.2.2
What to do
Update patreon-connect to 1.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.CVE-2018-20983 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.
Product
wp-retina-2x
Fixed in
5.2.3
What to do
Update wp-retina-2x to 5.2.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.CVE-2017-18584 · WordPress plugins & themes · reported by MITREHigh 7.5
The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.
Product
post-pay-counter
Fixed in
2.731
What to do
Update post-pay-counter to 2.731 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.CVE-2017-18583 · WordPress plugins & themes · reported by MITRECritical 9.8
The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.
Product
post-pay-counter
Fixed in
2.731
What to do
Update post-pay-counter to 2.731 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.CVE-2017-18582 · WordPress plugins & themes · reported by MITREMedium 6.1
The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.
Product
time-sheets
Fixed in
1.5.2
What to do
Update time-sheets to 1.5.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.CVE-2017-18581 · WordPress plugins & themes · reported by MITREMedium 6.1
The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.
Product
time-sheets
Fixed in
1.5.0
What to do
Update time-sheets to 1.5.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.CVE-2017-18580 · WordPress plugins & themes · reported by MITRECritical 9.8
The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.
Product
shortcodes-ultimate
Fixed in
5.0.1
What to do
Update shortcodes-ultimate to 5.0.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.CVE-2017-18577 · WordPress plugins & themes · reported by MITREMedium 6.1
The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.
Product
mailchimp-for-wp
Fixed in
4.1.8
What to do
Update mailchimp-for-wp to 4.1.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.CVE-2017-18576 · WordPress plugins & themes · reported by MITREMedium 6.1
The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.
Product
event-notifier
Fixed in
1.2.1
What to do
Update event-notifier to 1.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.CVE-2016-10927 · WordPress plugins & themes · reported by MITRECritical 10
The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.
Product
nelio-ab-testing
Fixed in
4.5.11
What to do
Update nelio-ab-testing to 4.5.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.CVE-2016-10926 · WordPress plugins & themes · reported by MITRECritical 10
The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.
Product
nelio-ab-testing
Fixed in
4.5.9
What to do
Update nelio-ab-testing to 4.5.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.CVE-2016-10925 · WordPress plugins & themes · reported by MITREMedium 6.1
The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.
Product
peters-login-redirect
Fixed in
2.9.1
What to do
Update peters-login-redirect to 2.9.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ebook-download plugin before 1.2 for WordPress has directory traversal.CVE-2016-10924 · WordPress plugins & themes · reported by MITREHigh 7.5
The ebook-download plugin before 1.2 for WordPress has directory traversal.
Product
ebook-download
Fixed in
1.2
What to do
Update ebook-download to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.CVE-2016-10923 · WordPress plugins & themes · reported by MITRECritical 9.8
The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.
Product
woocommerce-store-toolkit
Fixed in
1.5.8
What to do
Update woocommerce-store-toolkit to 1.5.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.CVE-2016-10922 · WordPress plugins & themes · reported by MITRECritical 9.8
The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.
Product
woocommerce-store-toolkit
Fixed in
1.5.7
What to do
Update woocommerce-store-toolkit to 1.5.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.CVE-2015-9337 · WordPress plugins & themes · reported by MITREHigh 7.5
The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
Product
profile-builder
Fixed in
2.1.4
What to do
Update profile-builder to 2.1.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.CVE-2014-10385 · WordPress plugins & themes · reported by MITREMedium 6.1
The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.
Product
memphis-documents-library
Fixed in
3.0
What to do
Update memphis-documents-library to 3.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.CVE-2014-10384 · WordPress plugins & themes · reported by MITRECritical 9.8
The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.
Product
memphis-documents-library
Fixed in
3.0
What to do
Update memphis-documents-library to 3.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.CVE-2014-10383 · WordPress plugins & themes · reported by MITRECritical 9.8
The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.
Product
memphis-documents-library
Fixed in
3.0
What to do
Update memphis-documents-library to 3.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The reflex-gallery plugin before 1.4.3 for WordPress has XSS.CVE-2013-7482 · WordPress plugins & themes · reported by MITREMedium 6.1
The reflex-gallery plugin before 1.4.3 for WordPress has XSS.
Product
reflex-gallery
Fixed in
1.4.3
What to do
Update reflex-gallery to 1.4.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The tubepress plugin before 1.6.5 for WordPress has XSS.CVE-2008-7321 · WordPress plugins & themes · reported by MITREMedium 6.1
The tubepress plugin before 1.6.5 for WordPress has XSS.
Product
tubepress
Fixed in
1.6.5
What to do
Update tubepress to 1.6.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.CVE-2019-15318 · WordPress plugins & themes · reported by MITRECritical 9.8
The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.
Product
yikes-inc-easy-mailchimp-extender
Fixed in
6.5.3
What to do
Update yikes-inc-easy-mailchimp-extender to 6.5.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The give plugin before 2.4.7 for WordPress has XSS via a donor name.CVE-2019-15317 · WordPress plugins & themes · reported by MITREMedium 5.4
The give plugin before 2.4.7 for WordPress has XSS via a donor name.
Product
give
Fixed in
2.4.7
What to do
Update give to 2.4.7 or newer.
Full record and what to do →NVD record blog.sucuri.net wordpress.org
Aug 22, 2019The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.CVE-2018-20982 · WordPress plugins & themes · reported by MITREMedium 6.1
The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.
Product
media-library-assistant
Fixed in
2.74
What to do
Update media-library-assistant to 2.74 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.CVE-2018-20981 · WordPress plugins & themes · reported by MITRECritical 9.1
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.
Product
ninja-forms
Fixed in
3.3.9
What to do
Update ninja-forms to 3.3.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.CVE-2018-20980 · WordPress plugins & themes · reported by MITREHigh 7.5
The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.
Product
ninja-forms
Fixed in
3.2.15
What to do
Update ninja-forms to 3.2.15 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.CVE-2018-20979 · WordPress plugins & themes · reported by MITRECritical 9.8
The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.
Product
contact-form-7
Fixed in
5.0.4
What to do
Update contact-form-7 to 5.0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.CVE-2017-18575 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.
Product
newstatpress
Fixed in
1.2.5
What to do
Update newstatpress to 1.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.CVE-2017-18574 · WordPress plugins & themes · reported by MITREMedium 6.1
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
Product
ninja-forms
Fixed in
3.0.31
What to do
Update ninja-forms to 3.0.31 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.CVE-2017-18573 · WordPress plugins & themes · reported by MITRECritical 9.8
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
Product
simple-login-log
Fixed in
1.1.2
What to do
Update simple-login-log to 1.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The gnucommerce plugin before 1.4.2 for WordPress has XSS.CVE-2017-18572 · WordPress plugins & themes · reported by MITREMedium 6.1
The gnucommerce plugin before 1.4.2 for WordPress has XSS.
Product
gnucommerce
Fixed in
1.4.2
What to do
Update gnucommerce to 1.4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.CVE-2017-18571 · WordPress plugins & themes · reported by MITRECritical 9.8
The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.
Product
search-everything
Fixed in
8.1.7
What to do
Update search-everything to 8.1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.CVE-2017-18570 · WordPress plugins & themes · reported by MITRECritical 9.8
The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.
Product
cforms2
Fixed in
14.13
What to do
Update cforms2 to 14.13 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.CVE-2016-10921 · WordPress plugins & themes · reported by MITRECritical 9.8
The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.
Product
gallery-photo-gallery
Fixed in
1.0.1
What to do
Update gallery-photo-gallery to 1.0.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.