Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
39 results
Oct 23, 2026Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalkCVE-2026-115752 · Other software · SignalK · reported by VulnCheckLow 2.3
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, storing image-typed responses served back via the admin UI.
- Product
- signalk-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the ChineseCVE-2026-9046 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.3
A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that when installed on a non‑system partition, could allow a local user to execute arbitrary code.
- Product
- Legion Zone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to executCVE-2026-13104 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7
A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.
- Product
- App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticatedCVE-2026-13103 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7
A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code.
- Product
- App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevCVE-2026-50356 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevCVE-2026-49784 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.CVE-2026-49165 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attacker to elevate privCVE-2026-42900 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attacker to elevate privileges over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.CVE-2026-44428 · Other software · modelcontextprotocol · reported by GitHubLow 2.1
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client side, the publisher always appends audience=mcp-registry when requesting the GitHub Actions ID token, regardless of the selected --registry URL. On the server side, the exchange endpoint validates only that same fixed audience and then derives publish permissions directly from repository_owner. As a result, a token legitimately obtained while interacting with one registry deployment remains acceptable to any other deployment that shares the same code and audience string. This vulnerability is fixed in 1.7.6.
- Product
- registry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.CVE-2026-44427 · Other software · modelcontextprotocol · reported by GitHubNone
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft a URL with a protocol-relative path (e.g., //evil.com/) that, after trailing slash removal, results in a Location header of //evil.com — which browsers interpret as an absolute URL to an external domain. This vulnerability is fixed in 1.7.5.
- Product
- registry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.CVE-2026-45781 · Other software · modelcontextprotocol · reported by GitHubLow 3.5
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github.<user>/* namespace to OCI images they do not control. internal/validators/registries/oci.go:104-119 fails open on http.StatusTooManyRequests: when the registry's anonymous fetch to the upstream OCI registry is rate-limited, ValidateOCI returns nil and the publish is accepted without ever running the io.modelcontextprotocol.server.name label-match check at lines 122-141. That label check is the only cross-system ownership proof the registry applies to OCI packages — every other registry type (NPM, PyPI, NuGet, MCPB) treats a non-200 upstream response as a hard error. This vulnerability is fixed in 1.7.9.
- Product
- registry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.CVE-2026-44430 · Other software · modelcontextprotocol · reported by GitHubMedium 6.3
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification (POST /v0/auth/http, POST /v0.1/auth/http) uses safeDialContext (internal/api/handlers/v0/auth/http.go:67-110) to refuse dialling private/internal addresses when fetching the well-known public-key file from a publisher-supplied domain. The blocklist (isBlockedIP, lines 125-133) relies entirely on Go stdlib's IsLoopback / IsPrivate / IsLinkLocalUnicast / IsMulticast / IsUnspecified plus a manual CGNAT range. None of these cover IPv6 6to4 (2002::/16), NAT64 (64:ff9b::/96 and 64:ff9b:1::/48 per RFC 8215), or deprecated site-local (fec0::/10) — all of which encode arbitrary IPv4 in the address bits and tunnel to RFC1918 / cloud-metadata services on dual-stack / NAT64-enabled hosts. This vulnerability is fixed in 1.7.7.
- Product
- registry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.CVE-2026-44429 · Other software · modelcontextprotocol · reported by GitHubMedium 5.1
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/handlers/v0/ui_index.html) is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published server.json. Server-side validation in internal/validators/validators.go (validateWebsiteURL) only checks that the URL parses, is absolute, and uses the https scheme; it does not reject quote characters. Client-side, the value is interpolated into a double-quoted href attribute via innerHTML, using a homegrown escapeHtml helper that performs the standard textContent → innerHTML round-trip. Per the HTML serialisation algorithm, that round-trip encodes only &, <, > and U+00A0 inside text nodes — it does not encode " or '. A literal " in websiteUrl therefore breaks out of the href attribute, allowing arbitrary on* event handlers to be appended to the same <a> element. The Content-Security-Policy on / is script-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com, so the injected event handlers execute. Any user able to obtain a publish token (e.g. via POST /v0/auth/github-at with their own G
- Product
- registry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attackeCVE-2025-13326 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.9
Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code wCVE-2025-12046 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.5
A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code with elevated privileges under certain conditions.
- Product
- App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime.CVE-2025-12792 · Other software · Canva · reported by 4ac701fe-44e9-4bcd-9585-dd6449257611Low 3.2
The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged access could execute arbitrary code that inherits the TCC (Transparency, Consent, and Control) permissions assigned to Canva.
- Product
- Canva
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges duriCVE-2025-8485 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7
An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges during installation of an application.
- Product
- App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certaiCVE-2025-10495 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.7
A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker on the same logical network to execute arbitrary code.
- Product
- App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025An authentication issue was addressed with improved state management.CVE-2025-31267 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.6
An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlocked device may be able to view sensitive user information.
- Product
- App Store Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system cCVE-2024-10254 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.7
A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.CVE-2024-10253 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.7
A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges.CVE-2024-4130 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges.
- Product
- App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2024udn News Android APP stores the unencrypted user session in the local database when user log into the application.CVE-2024-6295 · Other software · udn · reported by twcert@cert.org.twLow 3.9
udn News Android APP stores the unencrypted user session in the local database when user log into the application. A malicious APP or an attacker with physical access to the Android device can retrieve this session and use it to log into the news APP and other services provided by udn.
- Product
- udn News App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 24, 2024udn News Android APP stores the user session in logcat file when user log into the APP.CVE-2024-6294 · Other software · udn · reported by twcert@cert.org.twLow 3.9
udn News Android APP stores the user session in logcat file when user log into the APP. A malicious APP or an attacker with physical access to the Android device can retrieve this session and use it to log into the news APP and other services provided by udn.
- Product
- udn News App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 19, 2024An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, resulting in a denial of sCVE-2023-6450 · Other software · Lenovo · reported by psirt@lenovo.comMedium 5.5
An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, resulting in a denial of service.
- Product
- Lenovo App Store Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiknow.lenovo.com.cniknow.lenovo.com.cn
Oct 27, 2023An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive uCVE-2022-3611 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.6
An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive user data used by other unrelated applications.
- Product
- App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiknow.lenovo.com.cniknow.lenovo.com.cn
Aug 22, 2023Improper verification of applications' cryptographic signatures in the /e/OS app store client App Lounge before 0.19q allows attackers in control of the applicaCVE-2021-43171 · Other software · E.foundation · reported by MITREMedium 6.5
Improper verification of applications' cryptographic signatures in the /e/OS app store client App Lounge before 0.19q allows attackers in control of the application server to install malicious applications on user's systems by altering the server's API response.
- Product
- App Lounge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.e.foundationnervuri.net
Mar 27, 2023Juiker app stores debug logs which contains sensitive information to mobile external storage.CVE-2022-39043 · Other software · Juiker · reported by twcert@cert.org.twLow 2.4
Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to acquire partial user information such as personal contacts.
- Product
- Juiker app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 21, 2022A business logic vulnerability exists in Mi App Store.CVE-2020-14121 · Other software · MI · reported by security@xiaomi.comMedium 5.5
A business logic vulnerability exists in Mi App Store. The vulnerability is caused by incomplete permission checks of the products being bypassed, and an attacker can exploit the vulnerability to perform a local silent installation.
- Product
- MI App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Apr 21, 2022An intent redirection vulnerability in the Mi App Store product.CVE-2020-14118 · Other software · MI · reported by security@xiaomi.comMedium 6.1
An intent redirection vulnerability in the Mi App Store product. This vulnerability is caused by the Mi App Store does not verify the validity of the incoming data, can cause the app store to automatically download and install apps.
- Product
- MI App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Jul 13, 2018The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file.CVE-2016-6547 · Other software · Zizai Technology · reported by cret@cert.orgHigh 7.8
The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file.
- Product
- Tech Nut Mobile Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.rapid7.comkb.cert.org
Jul 10, 2018An information disclosure vulnerability exists in Windows Mail Client when a message is opened, aka "Windows Mail Client Information Disclosure Vulnerability." CVE-2018-8305 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
An information disclosure vulnerability exists in Windows Mail Client when a message is opened, aka "Windows Mail Client Information Disclosure Vulnerability." This affects Mail, Calendar, and People in Windows 8.1 App Store.
- Product
- Mail, Calendar, and People in Windows 8.1 App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jul 6, 2018The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file.CVE-2016-6538 · Other software · TrackR · reported by cret@cert.orgHigh 8.8
The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.
- Product
- Bravo Mobile Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comblog.rapid7.com
Jun 9, 2017Sleipnir 4 Black Edition for Mac 4.5.3 and earlier and Sleipnir 4 for Mac 4.5.3 and earlier (Mac App Store) may allow a remote attacker to spoof the URL displayCVE-2016-7831 · Other software · Fenrir Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Sleipnir 4 Black Edition for Mac 4.5.3 and earlier and Sleipnir 4 for Mac 4.5.3 and earlier (Mac App Store) may allow a remote attacker to spoof the URL display via a specially crafted webpage.
- Product
- Sleipnir 4 Black Edition for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comjvn.jp
Jan 30, 2015The App Store process in CommerceKit Framework in Apple OS X before 10.10.2 places Apple ID credentials in App Store logs, which allows local users to obtain seCVE-2014-4499 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 2.1
The App Store process in CommerceKit Framework in Apple OS X before 10.10.2 places Apple ID credentials in App Store logs, which allows local users to obtain sensitive information by reading a file.
- Product
- MAC OS X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comsupport.apple.com
Nov 17, 2013The App Store component in Apple iOS before 7.0.4 does not properly enforce an intended transaction-time password requirement, which allows local users to complCVE-2013-5193 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.7
The App Store component in Apple iOS before 7.0.4 does not properly enforce an intended transaction-time password requirement, which allows local users to complete a (1) App purchase or (2) In-App purchase by leveraging previous entry of Apple ID credentials.
- Product
- Iphone OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comsupport.apple.com
Oct 14, 2011The User Documentation component in Apple Mac OS X through 10.6.8 uses http sessions for updates to App Store help information, which allows man-in-the-middle aCVE-2011-3224 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 2.6
The User Documentation component in Apple Mac OS X through 10.6.8 uses http sessions for updates to App Store help information, which allows man-in-the-middle attackers to execute arbitrary code by spoofing the http server.
- Product
- MAC OS X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comosvdb.org
Jun 24, 2011App Store in Apple Mac OS X before 10.6.8 creates a log entry containing a user's AppleID password, which might allow local users to obtain sensitive informatioCVE-2011-0197 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 2.1
App Store in Apple Mac OS X before 10.6.8 creates a log entry containing a user's AppleID password, which might allow local users to obtain sensitive information by reading a log file, as demonstrated by a log file that has non-default permissions.
- Product
- MAC OS X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comsupport.apple.com
Jun 18, 2007PortalApp stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct reCVE-2007-3252 · Other software · Portalapp · reported by MITREHigh 7.8
PortalApp stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for 8691.mdb, a different vector than CVE-2004-1786.
- Product
- Portalapp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgsecurityreason.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.