Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
36 results
Jul 7, 2026Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config.CVE-2026-58315 · Other software · SEIKO EPSON CORPORATION · reported by vultures@jpcert.or.jpMedium 5.1
Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicious page while logged into Web Config, unintended operations may be performed.
- Product
- Web Config
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allowCVE-2026-9144 · Other software · Taiko Network Communications Pte Ltd. · reported by VulnCheckHigh 8.4
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allows authenticated attackers to execute persistent JavaScript by fragmenting malicious payloads across multiple administrative form fields. Attackers can bypass front-end length restrictions using JavaScript comments and template literals to concatenate executable script fragments that are rendered in administrative dashboard views such as index.zhtml, resulting in persistent script execution within administrative sessions.
- Product
- AG1000-01A SMS Alert Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comvulncheck.com
May 20, 2026Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web configuration interface that allows unaCVE-2026-9141 · Other software · Taiko Network Communications Pte Ltd. · reported by VulnCheckCritical 9.3
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web configuration interface that allows unauthenticated attackers to access internal application pages without any session management or server-side authentication checks. Attackers with network access can directly request internal resources such as index.zhtml, point.zhtml, and log.shtml to gain full administrative read and write access, enabling unauthorized modification of alarm routing, device configuration, and disruption of monitoring and control functions.
- Product
- AG1000-01A SMS Alert Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comvulncheck.com
May 20, 2026Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authenticaCVE-2026-9139 · Other software · Taiko Network Communications Pte Ltd. · reported by VulnCheckCritical 9.3
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentication is implemented entirely in client-side JavaScript in login.zhtml, exposing static plaintext credentials in the page source. Unauthenticated attackers with network access can recover administrative credentials directly from the client-side validate() function to obtain full administrative access to the device.
- Product
- AG1000-01A SMS Alert Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comvulncheck.com
Dec 16, 2025Stack-based buffer overflow vulnerability exists in SEIKO EPSON Web Config.CVE-2025-66635 · Other software · SEIKO EPSON CORPORATION · reported by vultures@jpcert.or.jpHigh 8.6
Stack-based buffer overflow vulnerability exists in SEIKO EPSON Web Config. Specially crafted data input by a logged-in user may execute arbitrary code. As for the details of the affected products and versions, see the information provided by the vendor under [References].
- Product
- Web Config
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2025Atcom 100M IP Phones firmware version 2.7.x.x contains an authenticated command injection vulnerability in the web configuration CGI script that allows attackerCVE-2024-58314 · Other software · ATCOM Technology co., LTD. · reported by VulnCheckHigh 8.7
Atcom 100M IP Phones firmware version 2.7.x.x contains an authenticated command injection vulnerability in the web configuration CGI script that allows attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'cmd' parameter in web_cgi_main.cgi, enabling remote code execution with administrative credentials.
- Product
- 100M IP Phones
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordatcom.cnexploit-db.com
Oct 27, 2025An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows authenticated network-adjacent attackers to upload crafted firmCVE-2025-52263 · Other software · reported by MITREHigh 8
An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows authenticated network-adjacent attackers to upload crafted firmware, leading to arbitrary code execution.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comstarcharge.com
Mar 11, 2025Many fields for the web configuration interface of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to execute arbitrary SQL commands becaCVE-2025-22370 · Other software · Mennekes · reported by csirt@divd.nlMedium 5.3
Many fields for the web configuration interface of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to execute arbitrary SQL commands because the values are insufficiently neutralized.
- Product
- Smart / Premium charging stations
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Oct 1, 2024Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the deCVE-2024-47295 · Other software · SEIKO EPSON CORPORATION · reported by vultures@jpcert.or.jpHigh 8.1
Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under [References].
- Product
- Web Config
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root.CVE-2024-3498 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0High 7.8
Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2023Improper input validation vulnerability in SEIKO EPSON printer Web Config allows a remote attacker to turned off the printer.CVE-2023-38556 · Other software · SEIKO EPSON CORPORATION · reported by vultures@jpcert.or.jpHigh 7.5
Improper input validation vulnerability in SEIKO EPSON printer Web Config allows a remote attacker to turned off the printer. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers via a web browser. Web Config is pre-installed in some printers provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.
- Product
- SEIKO EPSON printer Web Config
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote unauthenticated attacker to hijack the authCVE-2023-27520 · Other software · SEIKO EPSON CORPORATION · reported by vultures@jpcert.or.jpMedium 6.5
Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote unauthenticated attacker to hijack the authentication and perform unintended operations by having a logged-in user view a malicious page. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.
- Product
- SEIKO EPSON printers/network interface Web Config
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an administrative privilege CVE-2023-23572 · Other software · SEIKO EPSON CORPORATION · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.
- Product
- SEIKO EPSON printers/network interface Web Config
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2023 The web configuration service of the affected device contains an authenticated command injection vulnerability.CVE-2023-0432 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9
The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute system commands on the operating system (OS) from the device in the context of the user "root." If the attacker has credentials for the web service, then the device could be fully compromised.
- Product
- DX-2100-L1-CN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection vulnerability.CVE-2022-37860 · Network & remote access · Tp-link · reported by MITRECritical 9.8
The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection vulnerability.
- Product
- M7350 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022The affected product may allow an attacker with access to the Ignition web configuration to run arbitrary code.CVE-2022-1264 · Other software · Inductive Automation · reported by ics-cert@hq.dhs.govMedium 6.8
The affected product may allow an attacker with access to the Ignition web configuration to run arbitrary code.
- Product
- Ignition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration.CVE-2021-46010 · Other software · Totolink · reported by MITREHigh 8.8
Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSION_ID is predictable. An attacker can hijack a valid session and conduct further malicious operations.
- Product
- A3100r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2021An issue exists within the SSH console of Akkadian Provisioning Manager 4.50.02 which allows a low-level privileged user to escape the web configuration file edCVE-2020-27362 · Other software · Akkadianlabs · reported by MITREHigh 8.8
An issue exists within the SSH console of Akkadian Provisioning Manager 4.50.02 which allows a low-level privileged user to escape the web configuration file editor and escalate privileges.
- Product
- Akkadian Provisioning Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblacklanternsecurity.comblacklanternsecurity.com
Aug 11, 2020SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to execute arbitrary PCVE-2020-13124 · Other software · Sabnzbd · reported by MITREHigh 8.8
SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to execute arbitrary Python commands on the underlying operating system.
- Product
- Sabnzbd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2019In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to obtain web configuraCVE-2019-13525 · Other software · Honeywell · reported by ics-cert@hq.dhs.govMedium 5.3
In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data, which can be accessed without authentication over the network.
- Product
- Ip-ak2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Sep 26, 2019In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to obtain web configuraCVE-2019-13523 · Other software · Honeywell · reported by ics-cert@hq.dhs.govMedium 5.3
In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data in JSON format for IP cameras and NVRs (Network Video Recorders), which can be accessed without authentication over the network. Affected performance IP Cameras: HBD3PR2,H4D3PRV3,HED3PR3,H4D3PRV2,HBD3PR1,H4W8PR2,HBW8PR2,H2W2PC1M,H2W4PER3,H2W2PER3,HEW2PER3,HEW4PER3B,HBW2PER1,HEW4PER2,HEW4PER2B,HEW2PER2,H4W2PER2,HBW2PER2,H4W2PER3, and HPW2P1. Affected Performance Series NVRs: HEN08104,HEN08144,HEN081124,HEN16104,HEN16144,HEN16184,HEN16204,HEN162244,HEN16284,HEN16304,HEN16384,HEN32104,HEN321124,HEN32204,HEN32284,HEN322164,HEN32304, HEN32384,HEN323164,HEN64204,HEN64304,HEN643164,HEN643324,HEN643484,HEN04103,HEN04113,HEN04123,HEN08103,HEN08113,HEN08123,HEN08143,HEN16103,HEN16123,HEN16143,HEN16163,HEN04103L,HEN08103L,HEN16103L,HEN32103L.
- Product
- Performance IP Cameras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Jun 7, 2019A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044_update_05032019-482 that could allow aCVE-2019-12774 · Other software · Enttec · reported by MITREMedium 6.1
A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044_update_05032019-482 that could allow an unauthenticated threat actor to inject malicious code directly into the application. This affects, for example, the Profile Description field in JSON data to the Profile Editor.
- Product
- Datagate Mk2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmogozobo.commogozobo.com
Apr 18, 2019On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm, /smap.htm, and /cgi-bin/smapCVE-2019-11017 · Other software · Dlink · reported by MITREMedium 4.8
On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm, /smap.htm, and /cgi-bin/smap, as demonstrated by the cgi-bin/smap RC parameter.
- Product
- Di-524 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Mar 1, 2019The Glen Dimplex Deutschland GmbH implementation of the Carel pCOWeb configuration tool allows remote attackers to obtain access via an HTTP session on port 100CVE-2019-9484 · Other software · Carel · reported by MITREHigh 7.5
The Glen Dimplex Deutschland GmbH implementation of the Carel pCOWeb configuration tool allows remote attackers to obtain access via an HTTP session on port 10000, as demonstrated by reading the modem password (which is 1234), or reconfiguring "party mode" or "vacation mode."
- Product
- Pcoweb Card Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2017The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with certain privileges to read arbitrCVE-2017-16786 · Other software · Meinbergglobal · reported by MITREMedium 6.5
The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with certain privileges to read arbitrary files via (1) the ntpclientcounterlogfile parameter to cgi-bin/mainv2 or (2) vectors involving curl support of the "file" schema in the firmware update functionality.
- Product
- Lantime Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 15, 2017Directory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.CVE-2017-16788 · Other software · Meinbergglobal · reported by MITREHigh 7.2
Directory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with Admin-User access to write to arbitrary files and consequently gain root privileges by uploading a file, as demonstrated by storing a file in the cron.d directory.
- Product
- Lantime Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 15, 2017The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure toCVE-2017-16787 · Other software · Meinbergglobal · reported by MITREMedium 6.5
The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure to restrict URL access.
- Product
- Lantime Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgexploit-db.com
Mar 16, 2012The Web Configuration tool in VMware vCenter Orchestrator (vCO) 4.0 before Update 4, 4.1 before Update 2, and 4.2 before Update 1 places the vCenter Server passCVE-2012-1513 · Other software · VMware · reported by MITREMedium 4
The Web Configuration tool in VMware vCenter Orchestrator (vCO) 4.0 before Update 4, 4.1 before Update 2, and 4.2 before Update 1 places the vCenter Server password in an HTML document, which allows remote authenticated administrators to obtain sensitive information by reading this document.
- Product
- Vcenter Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2003Directory traversal vulnerability in the web configuration interface in Netgear FM114P 1.4 allows remote attackers to read arbitrary files, such as the netgear.CVE-2003-1427 · Network & remote access · Netgear · reported by MITREMedium 6.4
Directory traversal vulnerability in the web configuration interface in Netgear FM114P 1.4 allows remote attackers to read arbitrary files, such as the netgear.cfg configuration file, via a hex-encoded (%2e%2e%2f) ../ (dot dot slash) in the port parameter.
- Product
- Fm114p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
May 29, 2002Web configuration utility in HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier, allows unauthorized users to bypass authenticCVE-2002-0250 · Other software · HP · reported by MITREHigh 7.5
Web configuration utility in HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier, allows unauthorized users to bypass authentication via a direct HTTP request to the web_access.html file, which allows the user to change the switch's configuration and modify the administrator password.
- Product
- Advancestack 10base-t Switching HUB J3200a
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infoonline.securityfocus.com
Jun 18, 2001Web configuration server in 602Pro LAN SUITE allows remote attackers to cause a denial of service via an HTTP GET HTTP request to the aux directory, and possiblCVE-2001-0448 · Other software · Software602 · reported by MITREMedium 5
Web configuration server in 602Pro LAN SUITE allows remote attackers to cause a denial of service via an HTTP GET HTTP request to the aux directory, and possibly other directories with legacy DOS device names.
- Product
- 602pro LAN Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jun 18, 2001Web configuration server in 602Pro LAN SUITE allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long HTTP requCVE-2001-0447 · Other software · Software602 · reported by MITREHigh 7.5
Web configuration server in 602Pro LAN SUITE allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long HTTP request containing "%2e" (dot dot) characters.
- Product
- 602pro LAN Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Dec 19, 2000The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication when the enable passwCVE-2000-0945 · Network & remote access · Cisco · reported by MITREHigh 10
The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication when the enable password is not set, via a URL containing the /exec/ directory.
- Product
- Catalyst 3500 XL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Nov 14, 2000The web configuration server for NTMail V5 and V6 allows remote attackers to cause a denial of service via a series of partial HTTP requests.CVE-2000-0859 · Other software · Gordano · reported by MITREMedium 5
The web configuration server for NTMail V5 and V6 allows remote attackers to cause a denial of service via a series of partial HTTP requests.
- Product
- Ntmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
May 11, 2000NTMail 5.x allows network users to bypass the NTMail proxy restrictions by redirecting their requests to NTMail's web configuration server.CVE-2000-0416 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5
NTMail 5.x allows network users to bypass the NTMail proxy restrictions by redirecting their requests to NTMail's web configuration server.
- Product
- Windows 2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgordano.comsecurityfocus.com
Oct 15, 1999Buffer overflow in OpenLink 3.2 allows remote attackers to gain privileges via a long GET request to the web configurator.CVE-1999-0943 · Other software · Openlink · reported by MITREHigh 10
Buffer overflow in OpenLink 3.2 allows remote attackers to gain privileges via a long GET request to the web configurator.
- Product
- Openlink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.