Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
126 results · page 2 of 3
Apr 8, 2022An issue was discovered in ZZCMS 2021.CVE-2021-46437 · Other software · Zzcms · reported by MITREMedium 4.8
An issue was discovered in ZZCMS 2021. There is a cross-site scripting (XSS) vulnerability in ad_manage.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2022An issue was discovered in ZZCMS 2021.CVE-2021-46436 · Other software · Zzcms · reported by MITREHigh 7.2
An issue was discovered in ZZCMS 2021. There is a SQL injection vulnerability in ad_manage.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2022ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.CVE-2022-23881 · Other software · Zzzcms · reported by MITRECritical 9.8
ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use CVE-2021-45347 · Other software · Zzcms · reported by MITREHigh 7.5
An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use any password.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1) index.php, 2) bottom.php, and 3) top_index.php.CVE-2021-45286 · Other software · Zzcms · reported by MITREMedium 5.3
Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1) index.php, 2) bottom.php, and 3) top_index.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php.CVE-2021-42945 · Other software · Zzcms · reported by MITRECritical 9.8
A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2021Cross Site Scripting (XSS) vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php.CVE-2020-19042 · Other software · Zzcms · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2021A Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an editfile action in save.php.CVE-2020-19683 · Other software · Zzzcms · reported by MITREMedium 5.4
A Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an editfile action in save.php.
- Product
- Zzzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzhhhy.github.iozhhhy.github.io
Dec 9, 2021A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php.CVE-2020-19682 · Other software · Zzzcms · reported by MITREHigh 8.8
A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php.
- Product
- Zzzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzhhhy.github.iozhhhy.github.io
Dec 9, 2021An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php.CVE-2021-43703 · Other software · Zzcms · reported by MITRECritical 9.8
An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript, you can directly access the administrator console.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2021An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, abd 2021 in dl/dl_download.php.CVE-2021-40282 · Other software · Zzcms · reported by MITREHigh 8.8
An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, abd 2021 in dl/dl_download.php. when registering ordinary users.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 9, 2021An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary users.CVE-2021-40281 · Other software · Zzcms · reported by MITREHigh 8.8
An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary users.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 9, 2021An SQL Injection vulnerablitly exits in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/dl_sendmail.php.CVE-2021-40280 · Other software · Zzcms · reported by MITREHigh 7.2
An SQL Injection vulnerablitly exits in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/dl_sendmail.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 9, 2021An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/bad.php.CVE-2021-40279 · Other software · Zzcms · reported by MITREHigh 7.2
An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/bad.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 14, 2021A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php.CVE-2020-19961 · Other software · Zzcms · reported by MITREHigh 7.5
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2021A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_CVE-2020-19960 · Other software · Zzcms · reported by MITREHigh 7.5
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_sendsms.php page cookie.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2021A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_CVE-2020-19959 · Other software · Zzcms · reported by MITREHigh 7.5
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_sendmail.php page cookie.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2021A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dl_prCVE-2020-19957 · Other software · Zzcms · reported by MITREHigh 7.5
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dl_print.php page.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via the "ml" and "title" pCVE-2020-19822 · Other software · Zzcms · reported by MITREHigh 7.2
A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via the "ml" and "title" parameters.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Jun 3, 2021An issue was discovered in zzcms2020.CVE-2020-35973 · Other software · Zzcms · reported by MITREMedium 5.4
An issue was discovered in zzcms2020. There is a XSS vulnerability that can insert and execute JS code arbitrarily via /user/manage.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2021An issue was discovered in zzcms 2019.CVE-2019-12348 · Other software · Zzcms · reported by MITRECritical 9.8
An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2021Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php.CVE-2020-21342 · Other software · Zzcms · reported by MITREHigh 7.5
Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2021zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrCVE-2021-32605 · Other software · Zzzcms · reported by MITRECritical 9.8
zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzzzcms.comsrcincite.io
Apr 8, 2021zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further attCVE-2020-23426 · Other software · Zzcms · reported by MITRECritical 9.8
zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further attacks such as CSRF.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2021A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass.CVE-2020-24877 · Other software · Zzzcms · reported by MITRECritical 9.8
A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2021SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzz_template.php.CVE-2020-18717 · Other software · Zzzcms · reported by MITRECritical 9.8
SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzz_template.php.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2021A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection).CVE-2020-23630 · Other software · Zzcms · reported by MITREHigh 8.8
A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection).
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzzphp 1.7.2 allows remote attackers to execute arbitCVE-2020-20298 · Other software · Zzzcms · reported by MITRECritical 9.8
Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzzphp 1.7.2 allows remote attackers to execute arbitrary commands.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020There is a XSS in the user login page in zzcms 2019.CVE-2020-20285 · Other software · Zzcms · reported by MITREMedium 5.4
There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2019parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the danger_key function can be bypassed vCVE-2019-17408 · Other software · Zzzcms · reported by MITRECritical 9.8
parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the danger_key function can be bypassed via manipulations such as strtr.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2019ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an str_ireplace operation.CVE-2019-16722 · Other software · Zzzcms · reported by MITRECritical 9.8
ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an str_ireplace operation.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Sep 23, 2019ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading CVE-2019-16720 · Other software · Zzzcms · reported by MITREHigh 7.5
ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Jul 23, 2019zzcms 8.3 and earlier is affected by: SQL Injection.CVE-2019-1010153 · Other software · zzcms · reported by josh@bress.netCritical 9.8
zzcms 8.3 and earlier is affected by: SQL Injection. The impact is: sql inject. The component is: zs/subzs.php.
- Product
- zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 23, 2019zzcms 8.3 and earlier is affected by: File Delete to Code Execution.CVE-2019-1010152 · Other software · zzcms · reported by josh@bress.netCritical 9.8
zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80.
- Product
- zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 23, 2019zzcms 8.3 and earlier is affected by: File Delete to Code Execution.CVE-2019-1010150 · Other software · zzcms · reported by josh@bress.netCritical 9.8
zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php.
- Product
- zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 23, 2019zzcms version 8.3 and earlier is affected by: File Delete to Code Execution.CVE-2019-1010149 · Other software · zzcms · reported by josh@bress.netCritical 9.8
zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code Execution. The component is: user/licence_save.php.
- Product
- zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 23, 2019zzcms version 8.3 and earlier is affected by: SQL Injection.CVE-2019-1010148 · Other software · zzcms · reported by josh@bress.netCritical 9.8
zzcms version 8.3 and earlier is affected by: SQL Injection. The impact is: zzcms File Delete to Code Execution.
- Product
- zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 19, 2019zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell.CVE-2019-1010151 · Other software · zzcms · reported by josh@bress.netCritical 9.8
zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/ppsave.php.
- Product
- zzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Mar 30, 2019ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source[] pCVE-2019-10647 · Other software · Zzzcms · reported by MITRECritical 9.8
ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source[] parameter because of a lack of inc/zzz_file.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if the 192.168.0.1 web server sends the contents of a .php file (i.e., it does not interpret a .php file).
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter.CVE-2018-17416 · Other software · Zzcms · reported by MITREHigh 7.2
A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter.CVE-2018-17415 · Other software · Zzcms · reported by MITREHigh 8.8
zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter.CVE-2018-17414 · Other software · Zzcms · reported by MITREHigh 8.8
zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter.CVE-2018-17413 · Other software · Zzcms · reported by MITREMedium 6.1
XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header.CVE-2018-17412 · Other software · Zzcms · reported by MITRECritical 9.8
zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2019There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save.php?act=editfile request.CVE-2019-9182 · Other software · Zzzcms · reported by MITREHigh 8.8
There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save.php?act=editfile request. It allows PHP code injection by providing a filename in the file parameter, and providing file content in the filetext parameter.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cnpacketstorm.news
Feb 24, 2019zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT.CVE-2019-9078 · Other software · Zzcms · reported by MITREMedium 5.4
zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2019An issue was discovered in ZZZCMS zzzphp V1.6.1.CVE-2019-9041 · Other software · Zzzcms · reported by MITREHigh 7.2
An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cnexploit-db.com
Feb 17, 2019admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal.CVE-2019-8411 · Other software · Zzcms · reported by MITREHigh 7.5
admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2018An issue was discovered in zzzphp cms 1.5.8.CVE-2018-20127 · Other software · Zzzcms · reported by MITREHigh 7.5
An issue was discovered in zzzphp cms 1.5.8. del_file in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because (for example) "php" is blocked but path=F:/1.phP. succeeds.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Oct 29, 2018An issue was discovered in zzcms 8.3.CVE-2018-18792 · Other software · Zzcms · reported by MITRECritical 9.8
An issue was discovered in zzcms 8.3. SQL Injection exists in zs/zs_list.php via a pxzs cookie.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.