Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
48 results
Oct 26, 2026MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mCVE-2026-116216 · Other software · maccmspro · reported by VulnCheckMedium 6.9
MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.
- Product
- maccms10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiCVE-2026-116215 · Other software · maccmspro · reported by VulnCheckLow 2.3
MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.
- Product
- maccms10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because chCVE-2026-116214 · Other software · maccmspro · reported by VulnCheckCritical 9.3
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
- Product
- maccms10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounCVE-2026-111356 · Other software · magicblack · reported by VulnCheckCritical 9.1
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
- Product
- MacCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055.CVE-2026-90788 · Other software · magicblack · reported by VulDBLow 2
A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- MacCMS10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue.CVE-2026-75465 · Other software · reported by MITREHigh 7.5
The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the bCVE-2026-71232 · Other software · magicblack · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.2
MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.
- Product
- maccms10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2026A vulnerability was detected in MacCMS Pro up to 2022.1000.3005.CVE-2026-15516 · Other software · reported by VulDBLow 2.9
A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/install/controller/Index.php of the component Installation Module. The manipulation results in authorization bypass. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used. Upgrading to version 2022.1000.3025 is recommended to address this issue. Upgrading the affected component is recommended.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026A weakness has been identified in MacCMS Pro up to 2022.1.3.CVE-2026-7578 · Other software · reported by VulDBLow 2
A weakness has been identified in MacCMS Pro up to 2022.1.3. This vulnerability affects the function install of the file /admi.php/admin/addon/add.html of the component Plugin Installation Handler. Executing a manipulation can lead to unrestricted upload. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2026A weakness has been identified in MacCMS up to 2025.1000.4052.CVE-2026-4563 · Other software · reported by VulDBLow 2.1
A weakness has been identified in MacCMS up to 2025.1000.4052. This vulnerability affects the function order_info of the file application/index/controller/User.php of the component Member Order Detail Interface. This manipulation of the argument order_id causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2026A security flaw has been discovered in MacCMS 2025.1000.4052.CVE-2026-4562 · Other software · reported by VulDBMedium 5.5
A security flaw has been discovered in MacCMS 2025.1000.4052. This affects an unknown part of the file application/api/controller/Timming.php of the component Timming API Endpoint. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2025A vulnerability was identified in Magicblack MacCMS 2025.1000.4050.CVE-2025-10397 · Other software · Magicblack · reported by VulDBLow 2
A vulnerability was identified in Magicblack MacCMS 2025.1000.4050. This affects an unknown part of the component API Handler. The manipulation of the argument cjurl leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly available and might be used.
- Product
- MacCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2025A vulnerability was found in Magicblack MacCMS 2025.1000.4050.CVE-2025-10395 · Other software · Magicblack · reported by VulDBMedium 5.1
A vulnerability was found in Magicblack MacCMS 2025.1000.4050. Affected by this vulnerability is the function col_url of the component Scheduled Task Handler. Performing manipulation of the argument cjurl results in server-side request forgery. It is possible to initiate the attack remotely.
- Product
- MacCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025A vulnerability was found in Maccms10 2025.1000.4050.CVE-2025-10122 · Other software · Maccms · reported by VulDBLow 2
A vulnerability was found in Maccms10 2025.1000.4050. Affected is the function rep of the file application/admin/controller/Database.php. Performing manipulation of the argument where results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.CVE-2025-45474 · Other software · Maccms · reported by MITREHigh 7.3
maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2025maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management.CVE-2025-45475 · Other software · Maccms · reported by MITREMedium 5.4
maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.CVE-2025-28091 · Other software · Maccms · reported by MITRECritical 9.1
maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.CVE-2025-28090 · Other software · Maccms · reported by MITRECritical 9.1
maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.CVE-2025-28089 · Other software · Maccms · reported by MITRECritical 9.1
maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2024A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows attackers to execute arbitrary web scriptsCVE-2024-46654 · Other software · maccms · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2024Cross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload.CVE-2024-32391 · Other software · maccms · reported by MITREHigh 7.3
Cross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload.
- Product
- maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a crafted payload injeCVE-2022-47872 · Other software · Maccms · reported by MITREHigh 8.8
A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a crafted payload injected into the Name parameter under the Interface address module.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2023A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2022-44870 · Other software · Maccms · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the AD Management module.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/columns.html.CVE-2022-35148 · Other software · Maccms · reported by MITREMedium 6.5
maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/columns.html.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.CVE-2022-31303 · Other software · Maccms · reported by MITREMedium 5.4
maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.CVE-2022-31302 · Other software · Maccms · reported by MITREMedium 5.4
maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter.CVE-2021-43707 · Other software · Maccms · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.html via the repeat parameter.CVE-2022-27887 · Other software · Maccms · reported by MITREMedium 6.1
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.html via the repeat parameter.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/index.html via the wd parameter.CVE-2022-27886 · Other software · Maccms · reported by MITREMedium 6.1
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/index.html via the wd parameter.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via the select and inpuCVE-2022-27885 · Other software · Maccms · reported by MITREMedium 6.1
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via the select and input parameters.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index.html via the wd parameter.CVE-2022-27884 · Other software · Maccms · reported by MITREMedium 6.1
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index.html via the wd parameter.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the select and input paCVE-2022-26573 · Other software · Maccms · reported by MITREMedium 6.1
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the select and input parameters.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos.CVE-2021-45787 · Other software · Maccms · reported by MITREMedium 5.4
There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserted at parameter positions including name and remarks.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges.CVE-2021-45786 · Other software · Maccms · reported by MITRECritical 9.8
In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Maccms 10 contains a cross-site scripting (XSS) vulnerability in the Editing function under the Member module.CVE-2020-21434 · Other software · Maccms · reported by MITREMedium 5.4
Maccms 10 contains a cross-site scripting (XSS) vulnerability in the Editing function under the Member module. This vulnerability is exploited via a crafted payload in the nickname text field.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges viaCVE-2020-21387 · Other software · Maccms · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges via a crafted payload.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges.CVE-2020-21386 · Other software · Maccms · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2021A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users.CVE-2020-20514 · Other software · Maccms · reported by MITREHigh 8.1
A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2021A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal administrator and uCVE-2020-21082 · Other software · Maccms · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal administrator and user cookies via crafted payloads in the text fields for Chinese and English names.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2021A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a crafted URL.CVE-2020-21081 · Other software · Maccms · reported by MITREMedium 6.5
A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a crafted URL.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021An arbitrary file deletion vulnerability exists within Maccms10.CVE-2020-21363 · Other software · Maccms · reported by MITREMedium 6.5
An arbitrary file deletion vulnerability exists within Maccms10.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' CVE-2020-21362 · Other software · Maccms · reported by MITREMedium 5.4
A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrarCVE-2020-21359 · Other software · Maccms · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrary code via adding a character to the end of the uploaded file's name.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2019Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/system_config.html, relatedCVE-2018-19465 · Other software · Maccms · reported by MITREMedium 6.1
Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/system_config.html, related to template/paody/html/vod_index.html.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2019Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action.CVE-2019-9829 · Other software · Maccms · reported by MITREHigh 8.8
Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2019Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords parameter, and a/tpl/moduleCVE-2019-8410 · Other software · Maccms · reported by MITREMedium 6.1
Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the t_name parameter (not t_key).
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2018Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.CVE-2018-12114 · Other software · Maccms · reported by MITREHigh 8.8
Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cncnblogs.com
Dec 18, 2017Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.CVE-2017-17733 · Other software · Maccms · reported by MITRECritical 9.8
Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.