Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list
35added in the last 30 days
457new WordPress flaws this week
390,714entries in the database

442 results · page 8 of 9

  • Sep 1, 2020All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function.CVE-2020-7725 · Other software · Guidesmiths · reported by report@snyk.ioCritical 9.8

    All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function.

    Product
    Worksmith
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2020All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function.CVE-2020-7724 · Other software · Tiny-conf Project · reported by report@snyk.ioCritical 9.8

    All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function.

    Product
    Tiny-conf
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2020All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function.CVE-2020-7723 · Other software · Yola · reported by report@snyk.ioCritical 9.8

    All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function.

    Product
    Promisehelpers
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2020All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function.CVE-2020-7722 · Other software · Nodee-utils Project · reported by report@snyk.ioCritical 9.8

    All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function.

    Product
    Nodee-utils
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2020All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function.CVE-2020-7721 · Other software · Node-oojs Project · reported by report@snyk.ioCritical 9.8

    All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function.

    Product
    Node-oojs
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2020The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function.CVE-2020-7720 · Other software · Digitalbazaar · reported by report@snyk.ioCritical 9.8

    The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.

    Product
    Forge
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2020Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.CVE-2020-7719 · Other software · Locutus · reported by report@snyk.ioCritical 9.8

    Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.

    Product
    Locutus
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2020All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.CVE-2020-7718 · Other software · Gammautils Project · reported by report@snyk.ioCritical 9.8

    All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.

    Product
    Gammautils
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2020All versions of package dot-notes are vulnerable to Prototype Pollution via the create function.CVE-2020-7717 · Other software · Dot-notes Project · reported by report@snyk.ioCritical 9.8

    All versions of package dot-notes are vulnerable to Prototype Pollution via the create function.

    Product
    Dot-notes
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2020All versions of package deeps are vulnerable to Prototype Pollution via the set function.CVE-2020-7716 · Other software · Invertase · reported by report@snyk.ioCritical 9.8

    All versions of package deeps are vulnerable to Prototype Pollution via the set function.

    Product
    Deeps
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2020All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function.CVE-2020-7715 · Other software · Deep-get-set Project · reported by report@snyk.ioCritical 9.8

    All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function.

    Product
    Deep-get-set
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2020All versions of package confucious are vulnerable to Prototype Pollution via the set function.CVE-2020-7714 · Other software · Realseriousgames · reported by report@snyk.ioCritical 9.8

    All versions of package confucious are vulnerable to Prototype Pollution via the set function.

    Product
    Confucious
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 1, 2020All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor.CVE-2020-7713 · Other software · Arr-flatten-unflatten Project · reported by report@snyk.ioCritical 9.8

    All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor.

    Product
    Arr-flatten-unflatten
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 18, 2020The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal funcCVE-2020-7708 · Other software · Irrelon · reported by report@snyk.ioCritical 9.8

    The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.

    Product
    @irrelon/path
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 18, 2020The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.CVE-2020-7707 · Other software · Property-expr Project · reported by report@snyk.ioCritical 9.8

    The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.

    Product
    Property-expr
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 18, 2020The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie.CVE-2020-7706 · Other software · Connie-lang Project · reported by report@snyk.ioCritical 9.8

    The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie.

    Product
    Connie-lang
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 17, 2020The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor.CVE-2020-7704 · Computers, phones & browsers · Linux-cmdline Project · reported by report@snyk.ioCritical 9.8

    The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor.

    Product
    Linux-cmdline
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 17, 2020All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.CVE-2020-7703 · Other software · Nis-utils Project · reported by report@snyk.ioCritical 9.8

    All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.

    Product
    Nis-utils
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 17, 2020All versions of package templ8 are vulnerable to Prototype Pollution via the parse function.CVE-2020-7702 · Other software · Templ8 Project · reported by report@snyk.ioCritical 9.8

    All versions of package templ8 are vulnerable to Prototype Pollution via the parse function.

    Product
    Templ8
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 14, 2020madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.CVE-2020-7701 · Other software · Springtree · reported by report@snyk.ioCritical 9.8

    madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.

    Product
    Madlib-object-utils
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Aug 14, 2020All versions of phpjs are vulnerable to Prototype Pollution via parse_str.CVE-2020-7700 · Websites & servers · Php.js Project · reported by report@snyk.ioCritical 9.8

    All versions of phpjs are vulnerable to Prototype Pollution via parse_str.

    Product
    Php.js
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 15, 2020Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.CVE-2020-8203 · Other software · Lodash · reported by support@hackerone.comHigh 7.4

    Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

    Product
    Lodash
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 19, 2020In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution.CVE-2020-7679 · Other software · Casperjs · reported by report@snyk.ioHigh 7.3

    In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution.

    Product
    Casperjs
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 3, 2020Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB.CVE-2020-7013 · Other software · Elastic · reported by security@elastic.coHigh 7.2

    Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.

    Product
    Kibana
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 3, 2020Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant.CVE-2020-7012 · Other software · Elastic · reported by security@elastic.coHigh 8.8

    Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.

    Product
    Kibana
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 28, 2020fun-map through 3.3.1 is vulnerable to Prototype Pollution.CVE-2020-7644 · Other software · Fun-map Project · reported by report@snyk.ioHigh 8.1

    fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.

    Product
    Fun-map
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 23, 2020paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution.CVE-2020-7643 · Other software · Idea · reported by report@snyk.ioMedium 5.3

    paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

    Product
    Paypal-adaptive
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 7, 2020sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.prototype' by abusing theCVE-2020-7618 · Other software · SDS Project · reported by report@snyk.ioMedium 5.3

    sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.prototype' by abusing the 'set' function located in 'js/set.js'.

    Product
    SDS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 7, 2020express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution.CVE-2020-7616 · Other software · Express-mock-middleware Project · reported by report@snyk.ioMedium 5.3

    express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the `Object.prototype`. Exploitation of this vulnerability requires creation of a new directory where an attack code can be placed which will then be exported by `express-mock-middleware`. As such, this is considered to be a low risk.

    Product
    Express-mock-middleware
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 6, 2020eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototypCVE-2020-7639 · Other software · DOT Project · reported by report@snyk.ioMedium 5.3

    eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.

    Product
    DOT
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 6, 2020confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.protoCVE-2020-7638 · Other software · Confinit Project · reported by report@snyk.ioMedium 5.3

    confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.

    Product
    Confinit
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 6, 2020class-transformer before 0.3.1 allow attackers to perform Prototype Pollution.CVE-2020-7637 · Other software · Class-transformer Project · reported by report@snyk.ioMedium 5.3

    class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

    Product
    Class-transformer
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 3, 2020Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or CVE-2020-8147 · Other software · Utils-extend Project · reported by support@hackerone.comCritical 9.8

    Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using utils-extend.

    Product
    Utils-extend
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 2, 2020ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__prCVE-2020-7617 · Other software · rawiroaisen · reported by report@snyk.ioMedium 4.4

    ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__proto__' payload.

    Product
    ini-parser
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 20, 2020Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a speciallCVE-2020-8136 · Other software · Fastify · reported by support@hackerone.comHigh 7.5

    Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request.

    Product
    Fastify-multipart
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 16, 2020yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.CVE-2020-7608 · Other software · Yargs · reported by report@snyk.ioMedium 5.3

    yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

    Product
    Yargs-parser
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 11, 2020minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.CVE-2020-7598 · Other software · Substack · reported by report@snyk.ioMedium 5.6

    minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

    Product
    Minimist
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 10, 2020In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution.CVE-2020-5259 · Other software · dojo · reported by GitHubHigh 7.7

    In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

    Product
    dojox
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 10, 2020In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution.CVE-2020-5258 · Other software · dojo · reported by GitHubHigh 7.7

    In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

    Product
    dojo
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 9, 2020vega-util prior to 1.13.1 allows manipulation of object prototype.CVE-2019-10806 · Other software · Vega Project · reported by report@snyk.ioMedium 4.3

    vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype.

    Product
    Vega
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 24, 2020rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution.CVE-2019-10798 · Other software · Rdf-graph-array Project · reported by report@snyk.ioMedium 5.3

    rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into adding or modifying properties of Object.prototype.

    Product
    Rdf-graph-array
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 18, 2020undefsafe before 2.0.3 is vulnerable to Prototype Pollution.CVE-2019-10795 · Other software · Snyk · reported by report@snyk.ioMedium 6.3

    undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

    Product
    undefsafe
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 18, 2020All versions of component-flatten are vulnerable to Prototype Pollution.CVE-2019-10794 · Other software · Snyk · reported by report@snyk.ioMedium 6.3

    All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

    Product
    component-flatten
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 18, 2020dot-object before 2.1.3 is vulnerable to Prototype Pollution.CVE-2019-10793 · Other software · Snyk · reported by report@snyk.ioMedium 6.3

    dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

    Product
    dot-object
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 18, 2020bodymen before 1.1.1 is vulnerable to Prototype Pollution.CVE-2019-10792 · Other software · Snyk · reported by report@snyk.ioMedium 6.3

    bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

    Product
    bodymen
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 4, 2020Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial CVE-2020-8125 · Other software · Klona Project · reported by support@hackerone.comCritical 9.8

    Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.

    Product
    Klona
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 4, 2020Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to CVE-2020-8116 · Other software · Dot-prop Project · reported by support@hackerone.comHigh 7.3

    Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

    Product
    Dot-prop
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Feb 3, 2020Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.CVE-2020-7993 · Other software · Prototypejs · reported by MITREMedium 4.3

    Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.

    Product
    Prototype
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jan 8, 2020When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it.CVE-2019-11757 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8

    When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

    Product
    Firefox
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 20, 2019Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution.CVE-2019-19919 · Other software · Handlebars.js Project · reported by MITRECritical 9.8

    Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.

    Product
    Handlebars.js
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.