Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
88 results · page 1 of 2
Oct 19, 2026This issue was addressed by enforcing library validation on the affected binaries.CVE-2026-86949 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026This issue was addressed by enforcing library validation on the affected binaries.CVE-2026-86948 · Computers, phones & browsers · Apple · reported by product-security@apple.com
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026An input validation issue was addressed with improved input validation.CVE-2026-86875 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected app termination.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026An out-of-bounds read was addressed with improved input validation.CVE-2026-86874 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected tool termination.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026A permissions issue was addressed with improved validation.CVE-2026-65393 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to access user-sensitive data.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Apr 29, 2026A vulnerability was found in PolarVista xcode-mcp-server 1.0.0.CVE-2026-7416 · Other software · PolarVista · reported by VulDBMedium 5.5
A vulnerability was found in PolarVista xcode-mcp-server 1.0.0. This issue affects the function build_project/run_tests of the file src/index.ts of the component MCP Interface. The manipulation of the argument Request results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- xcode-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026An out-of-bounds read was addressed with improved bounds checking.CVE-2026-28890 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 26.4. An app may be able to cause unexpected system termination.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026A permissions issue was addressed with additional restrictions.CVE-2026-28889 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.2
A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 26.4. An app may be able to read arbitrary files as root.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2026A vulnerability was found in r-huijts xcode-mcp-server up to f3419f00117aa9949e326f78cc940166c88f18cb.CVE-2026-2178 · Other software · r-huijts · reported by VulDBLow 2.1
A vulnerability was found in r-huijts xcode-mcp-server up to f3419f00117aa9949e326f78cc940166c88f18cb. This affects the function registerXcodeTools of the file src/tools/xcode/index.ts of the component run_lldb. The manipulation of the argument args results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as 11f8d6bacadd153beee649f92a78a9dad761f56f. Applying a patch is advised to resolve this issue.
- Product
- xcode-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026A permissions issue was addressed with additional restrictions.CVE-2025-31186 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025An out-of-bounds write issue was addressed with improved input validation.CVE-2025-43505 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025A buffer overflow was addressed with improved bounds checking.CVE-2025-43504 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.9
A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025The issue was addressed with improved checks.CVE-2025-43375 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Sep 15, 2025This issue was addressed with improved checks.CVE-2025-43371 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.2
This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Sep 15, 2025A path handling issue was addressed with improved validation.CVE-2025-43370 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4
A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Sep 15, 2025The issue was addressed with improved checks.CVE-2025-43263 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.1
The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write files outside of its sandbox.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Mar 31, 2025This issue was addressed through improved state management.CVE-2025-30441 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed through improved state management. This issue is fixed in Xcode 16.3. An app may be able to overwrite arbitrary files.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Mar 31, 2025The issue was addressed with improved checks.CVE-2025-24226 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Oct 28, 2024This issue was addressed with improved permissions checking.CVE-2024-44228 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
This issue was addressed with improved permissions checking. This issue is fixed in Xcode 16. An app may be able to inherit Xcode permissions and access user data.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024This issue was addressed through improved state management.CVE-2024-44191 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed through improved state management. This issue is fixed in Xcode 16, iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. An app may gain unauthorized access to Bluetooth.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Sep 16, 2024This issue was addressed by enabling hardened runtime.CVE-2024-44162 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Sep 16, 2024A privacy issue was addressed by removing sensitive data.CVE-2024-40862 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
A privacy issue was addressed by removing sensitive data. This issue is fixed in Xcode 16. An attacker may be able to determine the Apple ID of the owner of the computer.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Mar 15, 2024A logic issue was addressed with improved state management.CVE-2024-23298 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A logic issue was addressed with improved state management. This issue is fixed in Xcode 15.3. An app may bypass Gatekeeper checks.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Sep 27, 2023This issue was addressed by enabling hardened runtime.CVE-2023-40435 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 15. An app may be able to access App Store credentials.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsupport.apple.com
Sep 5, 2023The issue was addressed with improved checks.CVE-2022-32920 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved checks. This issue is fixed in Xcode 14.0. Parsing a file may lead to disclosure of user information.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 8, 2023The issue was addressed with improved memory handling.CVE-2023-27967 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.6
The issue was addressed with improved memory handling. This issue is fixed in Xcode 14.3. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Feb 27, 2023An injection issue was addressed with improved input validation.CVE-2022-42797 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
An injection issue was addressed with improved input validation. This issue is fixed in Xcode 14.1. An app may be able to gain root privileges.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 30, 2023PixCodes: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4671 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PixCodes WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- PixCodes
- Fixed in
- 2.3.7
- What to do
- Update PixCodes to 2.3.7 or newer.
May 26, 2022This issue was addressed with improved checks.CVE-2022-26747 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
This issue was addressed with improved checks. This issue is fixed in Xcode 13.4. An app may be able to gain elevated privileges.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 18, 2022An out-of-bounds read was addressed with improved bounds checking.CVE-2022-22608 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 18, 2022An out-of-bounds read was addressed with improved bounds checking.CVE-2022-22607 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 18, 2022An out-of-bounds read was addressed with improved bounds checking.CVE-2022-22606 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 18, 2022An out-of-bounds read was addressed with improved bounds checking.CVE-2022-22605 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 18, 2022An out-of-bounds read was addressed with improved bounds checking.CVE-2022-22604 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 18, 2022An out-of-bounds read was addressed with improved bounds checking.CVE-2022-22603 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 18, 2022An out-of-bounds read was addressed with improved bounds checking.CVE-2022-22602 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 18, 2022An out-of-bounds read was addressed with improved bounds checking.CVE-2022-22601 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 11, 2021Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2021-21656 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 7.1
Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Product
- Jenkins Xcode integration Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2021A path handling issue was addressed with improved validation.CVE-2021-1800 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A path handling issue was addressed with improved validation. This issue is fixed in Xcode 12.4. A malicious application may be able to access arbitrary files on the host device while running an app that uses on-demand resources with Xcode.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 27, 2020An out-of-bounds read was addressed with improved bounds checking.CVE-2019-8840 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 11.3. Compiling with untrusted sources may lead to arbitrary code execution with user privileges.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 18, 2019A memory corruption issue was addressed with improved validation.CVE-2019-8806 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 18, 2019A memory corruption issue was addressed with improved validation.CVE-2019-8800 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 18, 2019A memory corruption issue was addressed with improved state management.CVE-2019-8739 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted file may lead to arbitrary code execution.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 18, 2019A memory corruption issue was addressed with improved state management.CVE-2019-8738 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted file may lead to arbitrary code execution.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 18, 2019Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4.CVE-2019-8724 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 18, 2019Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4.CVE-2019-8723 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 18, 2019Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4.CVE-2019-8722 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 18, 2019Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4.CVE-2019-8721 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Apr 3, 2019A memory corruption issue was addressed with improved input validation.CVE-2018-4357 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A memory corruption issue was addressed with improved input validation. This issue affected versions prior to Xcode 10.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Feb 20, 2019In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd_jxcode=true action to the nCVE-2019-8954 · Other software · Indexhibit · reported by MITREHigh 8.8
In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd_jxcode=true action to the ndxzstudio/?a=system URI.
- Product
- Indexhibit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.