Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

333new WordPress flaws this week

390,007entries in the database

39 results

Feb 7, 2024Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page.CVE-2024-24133 · Other software · atmail · reported by MITRECritical 9.8
Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page.
Product
atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 27, 2023Atmail 5.62 allows XSS via the mail/parse.php?file=html/$this-%3ELanguage/help/filexp.html&FirstLoad=1&HelpFile=file.html Search Terms field.CVE-2022-31200 · Other software · Atmail · reported by MITREMedium 6.1
Atmail 5.62 allows XSS via the mail/parse.php?file=html/$this-%3ELanguage/help/filexp.html&FirstLoad=1&HelpFile=file.html Search Terms field.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com portswigger.net
May 16, 2022atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter.CVE-2022-30776 · Other software · Atmail · reported by MITREMedium 6.1
atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.atmail.com medium.com
Nov 15, 2021WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI.CVE-2021-43574 · Other software · Atmail · reported by MITREMedium 6.1
WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.atmail.com medium.com
Feb 6, 2020Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or CVE-2012-2593 · Other software · Atmail · reported by cret@cert.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or HTML via the Date field of an email.
Product
Atmail Webmail Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Jul 25, 2017Cross-site scripting (XSS) vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML within the body of anCVE-2017-11617 · Other software · Atmail · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML within the body of an email via an IMG element with both single quotes and double quotes.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.atmail.com bishopfox.com
Jun 8, 2017atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account.CVE-2017-9519 · Other software · Atmail · reported by MITREHigh 8.8
atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.atmail.com help.atmail.com
Jun 8, 2017atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails.CVE-2017-9518 · Other software · Atmail · reported by MITREHigh 8.8
atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.atmail.com help.atmail.com
Jun 8, 2017atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV.CVE-2017-9517 · Other software · Atmail · reported by MITREHigh 8.8
atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.atmail.com help.atmail.com
Feb 12, 2014Cross-site scripting (XSS) vulnerability in Atmail Webmail Server 6.6.x before 6.6.3 and 7.0.x before 7.0.3 allows remote attackers to inject arbitrary web scriCVE-2013-2585 · Other software · Atmail · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Atmail Webmail Server 6.6.x before 6.6.3 and 7.0.x before 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/<MessageID>/filenameOriginal/.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record isecauditors.com securityfocus.com
Feb 12, 2014Multiple cross-site scripting (XSS) vulnerabilities in Atmail Webmail Server 7.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) filCVE-2013-6229 · Other software · Atmail · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Atmail Webmail Server 7.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) filter parameter to index.php/mail/mail/listfoldermessages/searching/true/selectFolder/INBOX/resultContext/searchResultsTab5 or (2) mailId[] parameter to index.php/mail/mail/movetofolder/fromFolder/INBOX/toFolder/INBOX.Trash. NOTE: the view attachment message process vector is already covered by CVE-2013-2585.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record isecauditors.com securityfocus.com
Jan 12, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in Atmail Webmail Server before 7.2 allow remote attackers to hijack the authentication of administraCVE-2013-6028 · Other software · Atmail · reported by cret@cert.orgMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in Atmail Webmail Server before 7.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts, (2) modify user accounts, (3) delete user accounts, or (4) stop the product's service.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record atmail.com osvdb.org
Jan 12, 2014Cross-site scripting (XSS) vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an eCVE-2013-6017 · Other software · Atmail · reported by cret@cert.orgMedium 4.3
Cross-site scripting (XSS) vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an e-mail message, as demonstrated by the SRC attribute of an IFRAME element.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record atmail.com osvdb.org
Jan 12, 2014Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5031, CVECVE-2013-5034 · Other software · Atmail · reported by MITREHigh 10
Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5031, CVE-2013-5032, and CVE-2013-5033.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record atmail.com blog.atmail.com
Jan 12, 2014Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5031, CVECVE-2013-5033 · Other software · Atmail · reported by MITREHigh 10
Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5031, CVE-2013-5032, and CVE-2013-5034.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record atmail.com blog.atmail.com
Jan 12, 2014Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5031, CVECVE-2013-5032 · Other software · Atmail · reported by MITREHigh 10
Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5031, CVE-2013-5033, and CVE-2013-5034.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record atmail.com blog.atmail.com
Jan 12, 2014Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5032, CVECVE-2013-5031 · Other software · Atmail · reported by MITREHigh 10
Unspecified vulnerability in Atmail before 6.6.4, and 7.x before 7.1.2, has unknown impact and attack vectors, a different vulnerability than CVE-2013-5032, CVE-2013-5033, and CVE-2013-5034.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record atmail.com blog.atmail.com
Mar 27, 2012@Mail WebMail Client in AtMail Open-Source 1.04 and earlier allows remote attackers to obtain configuration information via a direct request to install/info.phpCVE-2012-1920 · Other software · Atmail · reported by MITREMedium 5
@Mail WebMail Client in AtMail Open-Source 1.04 and earlier allows remote attackers to obtain configuration information via a direct request to install/info.php, which calls the phpinfo function.
Product
Atmail Open
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record en.securitylab.ru secunia.com
Mar 27, 2012CRLF injection vulnerability in mime.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to conduct directory traversal attackCVE-2012-1919 · Other software · Atmail · reported by MITREMedium 6.4
CRLF injection vulnerability in mime.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to conduct directory traversal attacks and read arbitrary files via a %0A sequence followed by a .. (dot dot) in the file parameter.
Product
Atmail Open
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record atmail.org en.securitylab.ru
Mar 27, 2012Multiple directory traversal vulnerabilities in (1) compose.php and (2) libs/Atmail/SendMsg.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allow CVE-2012-1918 · Other software · Atmail · reported by MITREMedium 5
Multiple directory traversal vulnerabilities in (1) compose.php and (2) libs/Atmail/SendMsg.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allow remote attackers to read arbitrary files via a .. (dot dot) in the Attachment[] parameter.
Product
Atmail Open
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record atmail.org en.securitylab.ru
Mar 27, 2012compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter, which alloCVE-2012-1917 · Other software · Atmail · reported by MITREMedium 5
compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ (dot dot dot slash dot slash) sequence.
Product
Atmail Open
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record atmail.org en.securitylab.ru
Mar 27, 2012@Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension, CVE-2012-1916 · Other software · Atmail · reported by MITREHigh 7.5
@Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension, leading to the creation of an executable file under tmp/.
Product
Atmail Open
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record atmail.org en.securitylab.ru
Dec 1, 2011Multiple cross-site scripting (XSS) vulnerabilities in AtMail Open (aka AtMail Open-Source edition) 1.04 allow remote attackers to inject arbitrary web script oCVE-2011-4540 · Other software · Atmail · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in AtMail Open (aka AtMail Open-Source edition) 1.04 allow remote attackers to inject arbitrary web script or HTML via the func parameter to (1) ldap.php or (2) search.php.
Product
Atmail Open
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Oct 9, 2011Cross-site scripting (XSS) vulnerability in index.php in @mail Webmail before 6.2.0 allows remote attackers to inject arbitrary web script or HTML via the MailTCVE-2010-4930 · Other software · Atmail · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in @mail Webmail before 6.2.0 allows remote attackers to inject arbitrary web script or HTML via the MailType parameter in a mail/auth/processlogin action.
Product
Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Aug 21, 2009Insecure method vulnerability in ChilkatMail_v7_9.dll in the Chilkat Software IMAP ActiveX control (ChilkatMail2.ChilkatMailMan2.1) allows remote attackers to eCVE-2008-7022 · Other software · Chilkatsoft · reported by MITREHigh 9.3
Insecure method vulnerability in ChilkatMail_v7_9.dll in the Chilkat Software IMAP ActiveX control (ChilkatMail2.ChilkatMailMan2.1) allows remote attackers to execute arbitrary programs via the LoadXmlEmail method.
Product
Chilkat Imap Activex Control
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com exploit-db.com
Jul 14, 2009Multiple cross-site scripting (XSS) vulnerabilities in webadmin/admin.php in @mail 5.6.1 allow remote attackers to inject arbitrary web script or HTML via the (CVE-2009-2455 · Other software · Atmail · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in webadmin/admin.php in @mail 5.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) type and (2) func parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
@tmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com secunia.com
Aug 10, 2008Calacode @Mail 5.41 on Linux does not require administrative authentication for build-plesk-upgrade.php, which allows remote attackers to obtain sensitive inforCVE-2008-3579 · Other software · Calacode · reported by MITREHigh 7.8
Calacode @Mail 5.41 on Linux does not require administrative authentication for build-plesk-upgrade.php, which allows remote attackers to obtain sensitive information by creating and downloading a backup archive of the entire @Mail directory tree. NOTE: this can be leveraged for remote exploitation of CVE-2008-3395. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com exchange.xforce.ibmcloud.com
Jul 31, 2008Calacode @Mail 5.41 on Linux uses weak world-readable permissions for (1) webmail/libs/Atmail/Config.php and (2) webmail/webadmin/.htpasswd, which allows local CVE-2008-3395 · Other software · Calacode · reported by MITREMedium 5
Calacode @Mail 5.41 on Linux uses weak world-readable permissions for (1) webmail/libs/Atmail/Config.php and (2) webmail/webadmin/.htpasswd, which allows local users to obtain sensitive information by reading these files. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityfocus.com
Dec 1, 2007Cross-site scripting (XSS) vulnerability in util.php in Calacode @Mail before 5.2 allows remote attackers to inject arbitrary web script or HTML via the func paCVE-2007-6196 · Other software · Calacode · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in util.php in Calacode @Mail before 5.2 allows remote attackers to inject arbitrary web script or HTML via the func parameter.
Product
Atmail Webmail System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
May 22, 2007Multiple cross-site scripting (XSS) vulnerabilities in ReadMsg.php in @Mail 5.02 and earlier allow remote attackers to inject arbitrary web script or HTML via uCVE-2007-2825 · Other software · Atmail · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in ReadMsg.php in @Mail 5.02 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) links and (2) images.
Product
Atmail Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Apr 19, 2007Cross-site scripting (XSS) vulnerability in atmail.php in @Mail 5.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter.CVE-2007-2153 · Other software · Atmail · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in atmail.php in @Mail 5.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
Product
Atmail Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityreason.com majorsecurity.de
Feb 14, 2007Cross-site scripting (XSS) vulnerability in search.pl in @Mail 4.61 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords CVE-2007-0953 · Other software · Atmail · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in search.pl in @Mail 4.61 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.
Product
Atmail Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.atmail.com lostmon.blogspot.com
Dec 22, 2006Cross-site request forgery (CSRF) vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary sCVE-2006-6701 · Other software · Atmail · reported by MITREHigh 7.5
Cross-site request forgery (CSRF) vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG element in an HTML e-mail.
Product
Atmail Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com secunia.com
Dec 22, 2006Cross-site scripting (XSS) vulnerability in the Webadmin in @Mail before 4.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectCVE-2006-6704 · Other software · Atmail · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in the Webadmin in @Mail before 4.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "unescaped data in the database."
Product
Atmail Webadmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record terra.calacode.com exchange.xforce.ibmcloud.com
Dec 22, 2006Cross-site scripting (XSS) vulnerability in Global.pm in @Mail before 4.61 allows remote attackers to inject arbitrary web script or HTML via crafted e-mail mesCVE-2006-6702 · Other software · Atmail · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in Global.pm in @Mail before 4.61 allows remote attackers to inject arbitrary web script or HTML via crafted e-mail messages. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Product
Atmail Webmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.atmail.com support.atmail.com
Dec 22, 2006Cross-site scripting (XSS) vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2006-6700 · Other software · Calacode · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.
Product
Atmail Webmail System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securitytracker.com
Feb 21, 2006Cross-site scripting (XSS) vulnerability in Calacode @Mail 4.3 allows remote attackers to inject arbitrary web script or HTML via a modified javascript: string CVE-2006-0842 · Other software · Calacode · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Calacode @Mail 4.3 allows remote attackers to inject arbitrary web script or HTML via a modified javascript: string in the SRC attribute of an IMG element in an e-mail message, as demonstrated by "java	script:." NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Atmail Webmail System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com osvdb.org
Feb 8, 2006Directory traversal vulnerability in compose.pl in @Mail 4.3 and earlier for Windows allows remote attackers to upload arbitrary files to arbitrary locations viCVE-2006-0611 · Other software · Atmail · reported by MITREHigh 7.5
Directory traversal vulnerability in compose.pl in @Mail 4.3 and earlier for Windows allows remote attackers to upload arbitrary files to arbitrary locations via a .. (dot dot) in the unique parameter.
Product
Atmail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.atmail.com secunia.com
May 27, 2003Buffer overflow in catmail for ListProc 8.2.09 and earlier allows remote attackers to execute arbitrary code via a long ULISTPROC_UMASK value.CVE-2003-0274 · Other software · Cren · reported by MITREHigh 10
Buffer overflow in catmail for ListProc 8.2.09 and earlier allows remote attackers to execute arbitrary code via a long ULISTPROC_UMASK value.
Product
Listproc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info marc.info

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.